Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-015

World-readable or world-writable file mode

highKotlinCWE-732CVSS 7.1

What it detects

Using MODE_WORLD_READABLE or MODE_WORLD_WRITEABLE exposes app files and preferences to other applications.

How to fix

Use MODE_PRIVATE and store sensitive data with EncryptedSharedPreferences or the Keystore.

Vulnerable — Shield flags thisSessionStore.kt
import android.content.Context

fun rememberLastUser(context: Context, name: String) {
    val prefs = context.getSharedPreferences("session", Context.MODE_WORLD_READABLE)
    prefs.edit().putString("last_user", name).apply()
}
Fixed — scans cleanSessionStore.kt
import android.content.Context

fun rememberLastUser(context: Context, name: String) {
    val prefs = context.getSharedPreferences("session", Context.MODE_PRIVATE)
    prefs.edit().putString("last_user", name).apply()
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-015, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-015: World-readable or world-writable file mode — Zennoxa Shield