# The Java/Kotlin/XML analyzers detect misconfiguration security issues on Android applications

**URL:** <https://community.sonarsource.com/t/the-java-kotlin-xml-analyzers-detect-misconfiguration-security-issues-on-android-applications/52011>\
**Category:** Sonar Updates\
**Tags:** xml, android, kotlin, java\
**Created:** [October 25, 2021, 9:56am UTC](https://community.sonarsource.com/t/the-java-kotlin-xml-analyzers-detect-misconfiguration-security-issues-on-android-applications/52011 "2021-10-25T09:56:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [October 25, 2021, 9:56am UTC](https://community.sonarsource.com/t/the-java-kotlin-xml-analyzers-detect-misconfiguration-security-issues-on-android-applications/52011/1 "2021-10-25T09:56:48Z")

</div>

Hello Android developers,

There are a lot security-sensitive configurations to care about while developing an Android application and it’s not easy to know what each of these configurations imply from a security perspective.  
This is why we added rules on the Java, Kotlin and XML analyzers so that you pay attention to these security-sensitive configurations and know the impact these configurations can have on your Android application or your users.

Java and Kotlin Rules:

- [S6362](https://rules.sonarsource.com/kotlin/RSPEC-6362): Enabling JavaScript support for WebViews is security-sensitive
- [S6363](https://rules.sonarsource.com/kotlin/RSPEC-6363): Enabling file access for WebViews is security-sensitive
- [S4507](https://rules.sonarsource.com/kotlin/RSPEC-4507): Delivering code in production with debug features activated is security-sensitive
  - WebView support was added for the existing S4507 Security Hotspot

- [S5332](https://rules.sonarsource.com/kotlin/RSPEC-5332): Using clear-text protocols is security-sensitive
  - WebView support was added for the existing S4507 Security Hotspot

- [S5322](https://rules.sonarsource.com/kotlin/RSPEC-5322): Receiving intents is security-sensitive
- [S5320](https://rules.sonarsource.com/kotlin/RSPEC-5320): Broadcasting intents is security-sensitive
- [S2053](https://rules.sonarsource.com/kotlin/RSPEC-2053): Hashes should include an unpredictable salt
- [S4347](https://rules.sonarsource.com/kotlin/RSPEC-4347): “SecureRandom” seeds should not be predictable

XML Rules:

- [S5322](https://rules.sonarsource.com/xml/RSPEC-5322): Receiving intents is security-sensitive
- [S6359](https://rules.sonarsource.com/xml/RSPEC-6359): Custom permissions should not be defined in the ‘android.permission’ namespace
- [S6358](https://rules.sonarsource.com/xml/RSPEC-6358): Allowing application backup is security-sensitive
- [S6361](https://rules.sonarsource.com/xml/RSPEC-6361): Defining a single permission for read and write access of Content Providers is security-sensitive
- [S5332](https://rules.sonarsource.com/xml/RSPEC-5332): Using clear-text protocols is security-sensitive

This is available now on [SonarCloud](https://sonarcloud.io/) and will be included in SonarQube 9.2.

Alex

---

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [October 26, 2021, 10:06am UTC](https://community.sonarsource.com/t/the-java-kotlin-xml-analyzers-detect-misconfiguration-security-issues-on-android-applications/52011/2 "2021-10-26T10:06:27Z")

</div>

Listed on October 26, 2021, 10:06am UTC