mcp-server-semgrep/semgrep-rules/java/android/best-practice/manifest-security-features.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: manifest-usesCleartextTraffic-true
    languages:
      - generic
    message: >-
      The Android manifest is configured to allow non-encrypted connections.
      Evaluate if this is necessary for your app, and disable it if appropriate.
      This flag is ignored on Android 7 (API 24) and above if a Network Security
      Config is present.
    metadata:
      category: best-practice
      technology:
        - android
      references:
        - https://developer.android.com/guide/topics/manifest/application-element#usesCleartextTraffic
        - https://developer.android.com/training/articles/security-config
    patterns:
      - pattern: |
          android:usesCleartextTraffic="true"
      - pattern-not-inside: |
          <!-- ... -->
    severity: INFO
    paths:
      include:
        - "*.xml"
  - id: manifest-usesCleartextTraffic-ignored-by-nsc
    languages:
      - generic
    message: >-
      Manifest uses both `android:usesCleartextTraffic` and Network Security Config.
      The `usesCleartextTraffic` directive is ignored on Android 7 (API 24) and above
      if a Network Security Config is present.
    metadata:
      category: best-practice
      technology:
        - android
      references:
        - https://developer.android.com/guide/topics/manifest/application-element#usesCleartextTraffic
        - https://developer.android.com/training/articles/security-config
    patterns:
      - pattern-either:
          # Need to define both orders, as the generic parser does not know that the order does not matter
          - pattern: |
              android:usesCleartextTraffic ... android:networkSecurityConfig
          - pattern: |
              android:networkSecurityConfig ... android:usesCleartextTraffic
      - pattern-not-inside: |
          <!-- ... -->
    severity: INFO
    paths:
      include:
        - "*.xml"