QA006
Datenschutz:
Überprüfung der Anwendung hinsichtlich Datenschutz und Datensicherheit.
Keine unnötigen Berechtigungen
Keine sensiblen Logs
Sichere Dateispeicherung
Backup-Verhalten geprüft
Datenschutz-Dokumentation erstellt
usw.
This commit is contained in:
NOrtmann1
@@ -0,0 +1,81 @@
|
||||
package de.medapp.wunddoku.media
|
||||
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Assert.assertTrue
|
||||
import org.junit.Assert.fail
|
||||
import org.junit.Rule
|
||||
import org.junit.Test
|
||||
import org.junit.rules.TemporaryFolder
|
||||
import java.io.File
|
||||
|
||||
/** Datenschutz/Sicherheit: kein Ausbrechen aus dem privaten Ordner per Path-Traversal. */
|
||||
class SafePathsTest {
|
||||
|
||||
@get:Rule
|
||||
val temp = TemporaryFolder()
|
||||
|
||||
private fun assertRejected(name: String) {
|
||||
val root = temp.newFolder()
|
||||
try {
|
||||
SafePaths.resolveChild(root, name)
|
||||
fail("'$name' hätte abgelehnt werden müssen")
|
||||
} catch (expected: IllegalArgumentException) {
|
||||
// erwartet
|
||||
}
|
||||
}
|
||||
|
||||
@Test
|
||||
fun normale_namen_werden_unterhalb_des_wurzelordners_aufgeloest() {
|
||||
val root = temp.newFolder()
|
||||
|
||||
val result = SafePaths.resolveChild(root, "3f2a-uuid.jpg")
|
||||
|
||||
assertEquals(File(root, "3f2a-uuid.jpg"), result)
|
||||
assertTrue(result.canonicalPath.startsWith(root.canonicalPath + File.separator))
|
||||
}
|
||||
|
||||
@Test
|
||||
fun uebliche_namen_mit_punkten_und_bindestrichen_sind_erlaubt() {
|
||||
val root = temp.newFolder()
|
||||
SafePaths.resolveChild(root, "2026-08-19_Max.Mustermann.v2.pdf")
|
||||
SafePaths.resolveChild(root, "..hidden") // beginnt mit Punkten, ist aber kein Traversal
|
||||
}
|
||||
|
||||
@Test
|
||||
fun path_traversal_wird_abgelehnt() {
|
||||
assertRejected("..")
|
||||
assertRejected("../geheim")
|
||||
assertRejected("../../etc/passwd")
|
||||
assertRejected("a/../../b")
|
||||
}
|
||||
|
||||
@Test
|
||||
fun pfadtrenner_und_leere_namen_werden_abgelehnt() {
|
||||
assertRejected("")
|
||||
assertRejected(" ")
|
||||
assertRejected(".")
|
||||
assertRejected("unter/ordner.jpg")
|
||||
assertRejected("unter\\ordner.jpg")
|
||||
assertRejected("/absolut.jpg")
|
||||
assertRejected("nullbyte\u0000.jpg")
|
||||
}
|
||||
|
||||
@Test
|
||||
fun symbolischer_link_aus_dem_ordner_heraus_wird_abgelehnt() {
|
||||
val root = temp.newFolder()
|
||||
val outside = temp.newFolder()
|
||||
val link = File(root, "link")
|
||||
try {
|
||||
java.nio.file.Files.createSymbolicLink(link.toPath(), outside.toPath())
|
||||
} catch (e: Exception) {
|
||||
return // Dateisystem ohne Symlink-Unterstützung: Test nicht anwendbar
|
||||
}
|
||||
|
||||
try {
|
||||
SafePaths.resolveChild(root, "link")
|
||||
fail("Symlink aus dem Ordner heraus hätte abgelehnt werden müssen")
|
||||
} catch (expected: IllegalArgumentException) {
|
||||
// erwartet
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,157 @@
|
||||
package de.medapp.wunddoku.pdf
|
||||
|
||||
import kotlinx.coroutines.runBlocking
|
||||
import org.junit.Assert.assertFalse
|
||||
import org.junit.Assert.assertTrue
|
||||
import org.junit.Before
|
||||
import org.junit.Rule
|
||||
import org.junit.Test
|
||||
import org.junit.rules.TemporaryFolder
|
||||
import java.io.File
|
||||
|
||||
/**
|
||||
* Datenschutz-Löschkonzept: PDF-/Bildexporte (enthalten Patientendaten) und liegengebliebene
|
||||
* Kameraaufnahmen dürfen nicht dauerhaft im Speicher bleiben.
|
||||
*/
|
||||
class ExportedFilesCleanerTest {
|
||||
|
||||
@get:Rule
|
||||
val temp = TemporaryFolder()
|
||||
|
||||
private lateinit var filesDir: File
|
||||
private lateinit var cacheDir: File
|
||||
private val day = 24L * 60 * 60 * 1000
|
||||
private val now = 1_800_000_000_000L // fester "Jetzt"-Zeitpunkt
|
||||
|
||||
@Before
|
||||
fun setUp() {
|
||||
filesDir = temp.newFolder("files")
|
||||
cacheDir = temp.newFolder("cache")
|
||||
}
|
||||
|
||||
private fun cleaner() = InternalExportedFilesCleaner(filesDir, cacheDir, now = { now })
|
||||
|
||||
private fun file(path: File, ageMillis: Long = 0): File {
|
||||
path.parentFile!!.mkdirs()
|
||||
path.writeText("x")
|
||||
path.setLastModified(now - ageMillis)
|
||||
return path
|
||||
}
|
||||
|
||||
private fun pdf(docId: String, ageMillis: Long = 0) = file(File(filesDir, "pdf/$docId/bericht.pdf"), ageMillis)
|
||||
private fun image(docId: String, ageMillis: Long = 0) = file(File(filesDir, "pdf_images/$docId/seite_01.jpg"), ageMillis)
|
||||
private fun capture(name: String, ageMillis: Long) = file(File(cacheDir, "camera/$name"), ageMillis)
|
||||
|
||||
// --- Löschen mit der Dokumentation ---------------------------------------------------
|
||||
|
||||
@Test
|
||||
fun deleteExportsFor_entfernt_pdf_und_bildexporte_der_dokumentation() = runBlocking {
|
||||
val p = pdf("doc-1")
|
||||
val i = image("doc-1")
|
||||
|
||||
cleaner().deleteExportsFor("doc-1")
|
||||
|
||||
assertFalse(p.exists())
|
||||
assertFalse(i.exists())
|
||||
assertFalse(File(filesDir, "pdf/doc-1").exists())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun deleteExportsFor_laesst_andere_dokumentationen_unberuehrt() = runBlocking {
|
||||
val other = pdf("doc-2")
|
||||
|
||||
cleaner().deleteExportsFor("doc-1")
|
||||
|
||||
assertTrue(other.exists())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun deleteExportsFor_ohne_vorhandene_ordner_wirft_nicht() = runBlocking {
|
||||
cleaner().deleteExportsFor("gibt-es-nicht")
|
||||
}
|
||||
|
||||
@Test
|
||||
fun deleteExportsFor_loescht_nie_ausserhalb_der_exportordner() = runBlocking {
|
||||
val secret = file(File(filesDir, "secret/patientendaten.db"))
|
||||
val photos = file(File(filesDir, "photos/doc-1/foto.jpg"))
|
||||
File(filesDir, "pdf").mkdirs()
|
||||
|
||||
cleaner().deleteExportsFor("../secret")
|
||||
cleaner().deleteExportsFor("..")
|
||||
cleaner().deleteExportsFor("../photos/doc-1")
|
||||
|
||||
assertTrue(secret.exists())
|
||||
assertTrue(photos.exists())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun deleteExportsFor_beruehrt_fotos_und_signaturen_der_dokumentation_nicht() = runBlocking {
|
||||
val photo = file(File(filesDir, "photos/doc-1/foto.jpg"))
|
||||
val signature = file(File(filesDir, "signatures/doc-1/sig.png"))
|
||||
pdf("doc-1")
|
||||
|
||||
cleaner().deleteExportsFor("doc-1")
|
||||
|
||||
assertTrue("Löschen der Exporte ist nicht Löschen der Dokumentation", photo.exists() && signature.exists())
|
||||
}
|
||||
|
||||
// --- Aufbewahrungsfristen ------------------------------------------------------------
|
||||
|
||||
@Test
|
||||
fun deleteStaleFiles_entfernt_exporte_aelter_als_7_tage_und_behaelt_frische() = runBlocking {
|
||||
val old = pdf("doc-old", ageMillis = 8 * day)
|
||||
val oldImage = image("doc-old", ageMillis = 8 * day)
|
||||
val fresh = pdf("doc-fresh", ageMillis = 1 * day)
|
||||
|
||||
cleaner().deleteStaleFiles()
|
||||
|
||||
assertFalse(old.exists())
|
||||
assertFalse(oldImage.exists())
|
||||
assertTrue(fresh.exists())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun deleteStaleFiles_entfernt_leere_unterordner() = runBlocking {
|
||||
pdf("doc-old", ageMillis = 30 * day)
|
||||
|
||||
cleaner().deleteStaleFiles()
|
||||
|
||||
assertFalse(File(filesDir, "pdf/doc-old").exists())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun deleteStaleFiles_entfernt_liegengebliebene_kameraaufnahmen_nach_24_stunden() = runBlocking {
|
||||
val stale = capture("capture_old.jpg", ageMillis = day + 60_000)
|
||||
val recent = capture("capture_new.jpg", ageMillis = 2 * 60 * 60 * 1000)
|
||||
|
||||
cleaner().deleteStaleFiles()
|
||||
|
||||
assertFalse("Wundfoto darf nicht dauerhaft im Cache liegen bleiben", stale.exists())
|
||||
assertTrue("aktuelle Aufnahme wird eventuell noch importiert", recent.exists())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun deleteStaleFiles_beruehrt_dokumentationsdaten_nie() = runBlocking {
|
||||
val photo = file(File(filesDir, "photos/doc-1/foto.jpg"), ageMillis = 365 * day)
|
||||
val signature = file(File(filesDir, "signatures/doc-1/sig.png"), ageMillis = 365 * day)
|
||||
|
||||
cleaner().deleteStaleFiles()
|
||||
|
||||
assertTrue("Dokumentationsfotos/-signaturen sind keine Exporte", photo.exists() && signature.exists())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun deleteStaleFiles_ohne_vorhandene_ordner_wirft_nicht() = runBlocking {
|
||||
cleaner().deleteStaleFiles()
|
||||
}
|
||||
|
||||
@Test
|
||||
fun none_cleaner_tut_nichts() = runBlocking {
|
||||
val p = pdf("doc-1", ageMillis = 100 * day)
|
||||
|
||||
ExportedFilesCleaner.None.deleteExportsFor("doc-1")
|
||||
ExportedFilesCleaner.None.deleteStaleFiles()
|
||||
|
||||
assertTrue(p.exists())
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,219 @@
|
||||
package de.medapp.wunddoku.privacy
|
||||
|
||||
import org.junit.Assert.assertEquals
|
||||
import org.junit.Assert.assertTrue
|
||||
import org.junit.Assume.assumeTrue
|
||||
import org.junit.Before
|
||||
import org.junit.Test
|
||||
import java.io.File
|
||||
import javax.xml.parsers.DocumentBuilderFactory
|
||||
|
||||
/**
|
||||
* Datenschutz-Regressionstests (QA-006) auf Quelltext- und Konfigurationsebene.
|
||||
*
|
||||
* Läuft als reiner JVM-Test ohne Gerät und liest die Projektdateien direkt. Er soll verhindern,
|
||||
* dass später versehentlich etwas eingebaut wird, das die Datenschutz-Zusagen der App bricht
|
||||
* (Netzwerkzugriff, sensible Logs, öffentlicher Speicher, Backup, zu weite Freigaben).
|
||||
* Schlägt ein Test fehl, ist das ein Hinweis zum Prüfen - nicht zwingend ein Fehler: dann
|
||||
* bewusst entscheiden und die Datenschutz-Dokumentation anpassen.
|
||||
*/
|
||||
class PrivacySourceScanTest {
|
||||
|
||||
private lateinit var mainDir: File
|
||||
|
||||
@Before
|
||||
fun locateSources() {
|
||||
mainDir = listOf(File("src/main"), File("app/src/main"))
|
||||
.firstOrNull { File(it, "AndroidManifest.xml").exists() }
|
||||
?: File("")
|
||||
assumeTrue("Quellverzeichnis nicht gefunden (Arbeitsverzeichnis: ${File(".").absolutePath})", mainDir.path.isNotEmpty())
|
||||
}
|
||||
|
||||
// --- Hilfsfunktionen -----------------------------------------------------------------
|
||||
|
||||
private fun kotlinSources(): List<Pair<String, String>> =
|
||||
File(mainDir, "java").walkTopDown()
|
||||
.filter { it.isFile && it.extension == "kt" }
|
||||
.map { it.relativeTo(mainDir).path to stripComments(it.readText()) }
|
||||
.toList()
|
||||
|
||||
/** Entfernt Kommentare, damit Dokumentationstext keine Fehlalarme auslöst. */
|
||||
private fun stripComments(source: String): String =
|
||||
source
|
||||
.replace(Regex("/\\*[\\s\\S]*?\\*/"), "")
|
||||
.replace(Regex("//[^\\n]*"), "")
|
||||
|
||||
private fun findings(pattern: Regex, sources: List<Pair<String, String>> = kotlinSources()): List<String> =
|
||||
sources.flatMap { (path, text) ->
|
||||
pattern.findAll(text).map { "$path: ${it.value}" }.toList()
|
||||
}
|
||||
|
||||
private fun assertNone(description: String, pattern: Regex) {
|
||||
val found = findings(pattern)
|
||||
assertTrue("$description - gefunden: $found", found.isEmpty())
|
||||
}
|
||||
|
||||
private fun parseXml(relativePath: String) =
|
||||
DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(File(mainDir, relativePath))
|
||||
|
||||
// --- Logging -------------------------------------------------------------------------
|
||||
|
||||
@Test
|
||||
fun keine_konsolenausgaben_oder_stacktrace_ausgaben() {
|
||||
assertNone(
|
||||
"println/printStackTrace/System.out/Timber können Patientendaten in Logs schreiben",
|
||||
Regex("""\bprintln\s*\(|printStackTrace\s*\(|System\.(out|err)\b|\bTimber\b"""),
|
||||
)
|
||||
}
|
||||
|
||||
@Test
|
||||
fun log_aufrufe_enthalten_keine_nachrichten_pfade_uris_oder_personendaten() {
|
||||
val callStart = Regex("""\bLog\s*\.\s*(v|d|i|w|e|wtf)\s*\(""")
|
||||
val forbidden = Regex(
|
||||
"""(?i)\.message\b|localizedMessage|stackTraceToString|getStackTraceString|\buri\b|\bpath\b|absolutePath|fileName|patient|firstName|lastName|birthDate|signer|street|phone"""
|
||||
)
|
||||
val violations = mutableListOf<String>()
|
||||
|
||||
for ((path, text) in kotlinSources()) {
|
||||
for (match in callStart.findAll(text)) {
|
||||
val openIndex = match.range.last
|
||||
var depth = 0
|
||||
var end = openIndex
|
||||
for (i in openIndex until text.length) {
|
||||
when (text[i]) {
|
||||
'(' -> depth++
|
||||
')' -> { depth--; if (depth == 0) { end = i; break } }
|
||||
}
|
||||
}
|
||||
val call = text.substring(match.range.first, end + 1)
|
||||
if (forbidden.containsMatchIn(call)) violations += "$path: ${call.replace(Regex("\\s+"), " ")}"
|
||||
}
|
||||
}
|
||||
|
||||
assertTrue("Log-Aufrufe mit potenziell sensiblem Inhalt: $violations", violations.isEmpty())
|
||||
}
|
||||
|
||||
// --- Speicherorte --------------------------------------------------------------------
|
||||
|
||||
@Test
|
||||
fun kein_zugriff_auf_oeffentlichen_oder_externen_speicher() {
|
||||
assertNone(
|
||||
"Patientendaten dürfen nur im privaten internen Speicher liegen",
|
||||
Regex(
|
||||
"""getExternalFilesDir|getExternalFilesDirs|externalCacheDir|externalMediaDirs|getExternalStorage|Environment\.getExternal|MediaStore\.|WRITE_EXTERNAL_STORAGE|READ_EXTERNAL_STORAGE|MANAGE_EXTERNAL_STORAGE|MODE_WORLD_READABLE|MODE_WORLD_WRITEABLE|DIRECTORY_(PICTURES|DOWNLOADS|DOCUMENTS)"""
|
||||
),
|
||||
)
|
||||
}
|
||||
|
||||
@Test
|
||||
fun keine_nutzung_der_zwischenablage() {
|
||||
assertNone(
|
||||
"Die Zwischenablage ist für andere Apps lesbar",
|
||||
Regex("""ClipboardManager|setPrimaryClip|ClipboardManager"""),
|
||||
)
|
||||
}
|
||||
|
||||
@Test
|
||||
fun keine_personendaten_als_text_oder_betreff_in_share_intents() {
|
||||
assertNone(
|
||||
"Share-Intents dürfen nur die PDF/Bilder (EXTRA_STREAM), keinen Text mit Patientendaten tragen",
|
||||
Regex("""EXTRA_TEXT|EXTRA_SUBJECT|EXTRA_EMAIL|EXTRA_CC|EXTRA_BCC|EXTRA_HTML_TEXT"""),
|
||||
)
|
||||
}
|
||||
|
||||
// --- Netzwerk ------------------------------------------------------------------------
|
||||
|
||||
@Test
|
||||
fun kein_netzwerkcode_im_quelltext() {
|
||||
assertNone(
|
||||
"Die App arbeitet offline - kein Netzwerkzugriff",
|
||||
Regex("""HttpURLConnection|HttpsURLConnection|java\.net\.URL\b|URLConnection|\bSocket\s*\(|okhttp|retrofit|\bktor\b|WebView|firebase|crashlytics|analytics""", RegexOption.IGNORE_CASE),
|
||||
)
|
||||
}
|
||||
|
||||
@Test
|
||||
fun keine_netzwerk_bibliotheken_in_den_abhaengigkeiten() {
|
||||
val gradle = listOf(File("app/build.gradle.kts"), File("build.gradle.kts")).firstOrNull { it.exists() }
|
||||
assumeTrue("build.gradle.kts nicht gefunden", gradle != null)
|
||||
val dependencies = gradle!!.readLines()
|
||||
.filter { it.trim().startsWith("implementation") || it.trim().startsWith("api(") }
|
||||
val forbidden = Regex("""okhttp|retrofit|\bktor\b|volley|firebase|crashlytics|analytics|sentry|coil|glide|picasso|play-services""", RegexOption.IGNORE_CASE)
|
||||
val found = dependencies.filter { forbidden.containsMatchIn(it) }
|
||||
assertTrue("Abhängigkeiten mit Netzwerk-/Tracking-Bezug: $found", found.isEmpty())
|
||||
}
|
||||
|
||||
// --- Manifest ------------------------------------------------------------------------
|
||||
|
||||
private fun manifest(): String = File(mainDir, "AndroidManifest.xml").readText()
|
||||
|
||||
@Test
|
||||
fun manifest_fordert_keine_berechtigungen_an() {
|
||||
val permissions = Regex("""<uses-permission[^>]*>""").findAll(manifest()).map { it.value }.toList()
|
||||
val requested = permissions.filterNot { it.contains("tools:node=\"remove\"") }
|
||||
assertTrue("Unnötige Berechtigungen im Manifest: $requested", requested.isEmpty())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun manifest_entfernt_die_internet_berechtigung_explizit() {
|
||||
val internet = Regex("""<uses-permission[^>]*android\.permission\.INTERNET[^>]*>""").find(manifest())
|
||||
assertTrue("INTERNET muss per tools:node=\"remove\" ausgeschlossen sein", internet != null && internet.value.contains("tools:node=\"remove\""))
|
||||
}
|
||||
|
||||
@Test
|
||||
fun manifest_deaktiviert_backup_und_verlangt_keine_cleartext_oder_debug_freigaben() {
|
||||
val text = manifest()
|
||||
assertTrue("allowBackup muss false sein", text.contains("""android:allowBackup="false""""))
|
||||
assertTrue("dataExtractionRules müssen gesetzt sein", text.contains("android:dataExtractionRules="))
|
||||
assertTrue(!text.contains("""android:usesCleartextTraffic="true""""))
|
||||
assertTrue(!text.contains("android:debuggable"))
|
||||
assertTrue(!text.contains("""android:allowBackup="true""""))
|
||||
}
|
||||
|
||||
@Test
|
||||
fun nur_die_start_activity_ist_exportiert_und_der_fileprovider_nicht() {
|
||||
val text = manifest()
|
||||
assertEquals(
|
||||
"Genau eine Komponente (MainActivity) darf exportiert sein",
|
||||
1,
|
||||
Regex("""android:exported="true"""").findAll(text).count(),
|
||||
)
|
||||
val provider = Regex("""<provider[\s\S]*?</provider>""").find(text)!!.value
|
||||
assertTrue(provider.contains("""android:exported="false""""))
|
||||
assertTrue(provider.contains("""android:grantUriPermissions="true""""))
|
||||
}
|
||||
|
||||
// --- Backup-Regeln -------------------------------------------------------------------
|
||||
|
||||
@Test
|
||||
fun data_extraction_rules_schliessen_alle_daten_aus_cloud_backup_und_geraetetransfer_aus() {
|
||||
val doc = parseXml("res/xml/data_extraction_rules.xml")
|
||||
for (section in listOf("cloud-backup", "device-transfer")) {
|
||||
val nodes = doc.getElementsByTagName(section)
|
||||
assertEquals("<$section> muss vorhanden sein", 1, nodes.length)
|
||||
val element = nodes.item(0) as org.w3c.dom.Element
|
||||
assertEquals("<$section> darf kein <include> enthalten", 0, element.getElementsByTagName("include").length)
|
||||
val excluded = (0 until element.getElementsByTagName("exclude").length)
|
||||
.map { (element.getElementsByTagName("exclude").item(it) as org.w3c.dom.Element).getAttribute("domain") }
|
||||
.toSet()
|
||||
assertTrue("<$section> muss database, file, sharedpref ausschließen, war $excluded", excluded.containsAll(setOf("database", "file", "sharedpref")))
|
||||
}
|
||||
}
|
||||
|
||||
// --- FileProvider-Freigaben ----------------------------------------------------------
|
||||
|
||||
@Test
|
||||
fun fileprovider_gibt_nur_export_und_kameraordner_frei() {
|
||||
val doc = parseXml("res/xml/file_paths.xml")
|
||||
val paths = doc.getElementsByTagName("paths").item(0).childNodes
|
||||
val entries = (0 until paths.length).map { paths.item(it) }
|
||||
.filterIsInstance<org.w3c.dom.Element>()
|
||||
.map { it.tagName to it.getAttribute("path") }
|
||||
|
||||
val allowed = setOf("files-path" to "pdf/", "files-path" to "pdf_images/", "cache-path" to "camera/")
|
||||
val unexpected = entries.filterNot { it in allowed }
|
||||
assertTrue(
|
||||
"Zu weite FileProvider-Freigaben (nur $allowed erlaubt): $unexpected",
|
||||
unexpected.isEmpty(),
|
||||
)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user