Mobile apps accept input from many channels: deep links, exported activities and intents, clipboard, QR codes, push payloads, and server responses. Treating any of these as trusted enables SQL injection in local SQLite stores, JavaScript injection in WebViews with native bridges, path traversal into app storage, and logic abuse through crafted deep links.
Validate and canonicalize all input against strict schemas, use parameterized queries for local databases, restrict deep link and intent parameters, disable JavaScript bridges in WebViews that load untrusted content, and encode output for the context it is rendered in.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#04mobile04-2024 Insufficient Input/Output Validation
