From 6509426fb383ba28bfc4f12f4b27f835bd392ed3 Mon Sep 17 00:00:00 2001
From: Ed Minnix <egregius313@github.com>
Date: Thu, 18 Aug 2022 22:03:51 -0400
Subject: [PATCH] `android:allowBackup` query documentation

---
 .../CWE-312/AllowBackupAttributeEnabled.qhelp | 51 +++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.qhelp

diff --git a/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.qhelp b/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.qhelp
new file mode 100644
index 00000000000..8945f40172f
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.qhelp
@@ -0,0 +1,51 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>The Android manifest file defines configuration settings for Android 
+applications. In this file, the <code>android:allowBackup</code> attribute of
+the <code>application</code> element can be used to define whether or not the
+application can have automatic backups.</p>
+
+<p>Enabling backups may allow an attacker to extract sensitive data. Therefore,
+it is advised to set <code>android:allowBackup</code> to <code>false</code> if 
+your application uses any sensitive data.</p>
+</overview>
+
+<recommendation>
+<p>For Android applications which process sensitive data, set the 
+<code>android:allowBackup</code> setting to <code>false</code> in the manifest
+file.</p>
+
+<p>Note: Since Android 6.0 (Marshmallow), applications default to participating
+in automatic backups. Therefore, it is necessary to explicitly disable backups.
+</p>
+</recommendation>
+
+<example>
+
+<p>In the two examples below, the <code>android:allowBackup</code> setting is enabled:</p>
+
+<sample src="AllowBackupTrue.xml" />
+
+<sample src="AllowBackupEmpty.xml"/>
+
+<p>A corrected version explicity sets <code>android:allowBackup</code> to <code>false</code>:</p>
+
+<sample src="AllowBackupFalse.xml"/>
+
+</example>
+<references>
+<li>
+   Android Documentation:
+   <a href="https://developer.android.com/guide/topics/data/autobackup#EnablingAutoBackup">Back up user data with Auto Backup</a>
+</li>
+<li>
+   OWASP Mobile Security Testing Guide:
+   <a href="https://github.com/OWASP/owasp-mstg/blob/b7a93a2e5e0557cc9a12e55fc3f6675f6986bb86/Document/0x05d-Testing-Data-Storage.md#backups">
+    Android Backups
+   </a>
+</li>
+</references>
+</qhelp>
\ No newline at end of file