SCI CERT Android Secure Coding Standard

The Android ^TM rules and recommendations in this wiki are a work in progress and reflect the current thinking of the secure coding community. Because this is a development website, many pages are incomplete or contain errors. As rules and recommendations mature, they are published in report or book form as official releases. These releases are issued as dictated by the needs and interests of the secure software development community.

Comments and Contributing

We provide access to the community members to contribute after subject matter expertise is verified.

For questions and comments about these standards, open a GitHub issue. For anything else, please submit feedback.

Front Matter

• Guidelines for Wiki Contributors
• Introduction

Rules

• Rule 00. Component Security (CPS)
• Rule 01. File I/O and Logging (FIO)
• Rule 02. Intent (ITT)
• Rule 03. WebView (WBV)
• Rule 04. Network - SSL/TLS (NET)
• Rule 05. Permission (PER)
• Rule 06. Cryptography (CRP)
• Rule 07. Miscellaneous (MSC)
• Rule 08. Declarations and Initialization (DCL)
• Rule 09. Application Programming Interfaces (API)
• Rule 10. Environment (ENV)
• Rule 11. Error Handling (ERR)
• Rule 12. Expressions (EXP)
• Rule 13. Floating Point (FLP)
• Rule 14. Integers (INT)
• Rule 15. Memory Management (MEM)
• Rule 16. Preprocessor (PRE)
• Rule 17. Characters and String (STR)
• Rule 18. Concurrency (CON)
• Rule 19. Input Validation and Data Sanitization (IDS)
• Rule 20. Java Native Interface (JNI)
• Rule 21. Locking (LCK)
• Rule 22. Methods (MET)
• Rule 23. Numeric Types and Operations (NUM)
• Rule 24. Object Orientation (OBJ)
• Rule 25. Serialization (SER)
• Rule 26. Thread APIs (THI)
• Rule 27. Thread-Safety Miscellaneous (TSM)
• Rule 28. Visibility and Atomicity (VNA)
• Rule 29. Platform Security (SEC)

Recommendations

• Rec. 00 Component Security (CPS)
• Rec. 01. File I/O and Logging (FIO)
• Rec. 02. Intent (ITT)
• Rec. 03. WebView (WBV)
• Rec. 04. Network - SSL/TLS (NET)
• Rec. 05. Permission (PER)
• Rec. 06. Cryptography (CRP)
• Rec. 07. Miscellaneous (MSC)
• Rec. 08. Declarations and Initialization (DCL)
• Rec. 09. Application Programming Interfaces (API)
• Rec. 10. Environment (ENV)
• Rec. 11. Error Handling (ERR)
• Rec. 12. Expressions (EXP)
• Rec. 13. Floating Point (FLP)
• Rec. 14. Integers (INT)
• Rec. 15. Memory Management (MEM)
• Rec. 16. Preprocessor (PRE)
• Rec. 17. Characters and Strings (STR)
• Rec. 18. Concurrency (CON)
• Rec. 19. Input Validation and Data Sanitization (IDS)
• Rec. 20. Java Native Interface (JNI)
• Rec. 21. Locking (LCK)
• Rec. 22. Methods (MET)
• Rec. 23. Numeric Types and Operations (NUM)
• Rec. 24. Object Orientation (OBJ)
• Rec. 25. Serialization (SER)
• Rec. 26. Thread APIs (THI)
• Rec. 27. Thread-Safety Miscellaneous (TSM)
• Rec. 28. Visibility and Atomicity (VNA)
• Rec. 29. Platform Security (SEC)

Rules and Recommendations by Language

• Android Only
• C Coding Language
• C++ Coding Language
• Java Coding Language
• XML

Rules vs. Recomendations

This coding standard consists of rules and recommendations , collectively referred to as guidelines . Rules are meant to provide normative requirements for code, whereas recommendations are meant to provide guidance that, when followed, should improve the safety, reliability, and security of software systems. Learn more about the differences.

Contact Us

Contact us if you

• have questions about the Secure Coding wiki
• have recommendations for standards in development
• want to request privileges to participate in standards development

Information for Editors

• To eliminate a section from the lists above, label it section and void .
• To have a section listed as a recommendation, label it section and recommendation .
• To have a section listed as a rule, label it section and rule .
• See a complete dictionary of labels to help you label your pages correctly.
• Link to guidelines using the Tiny Link under Tools→Link to this Page... (This URL will not change if the name of the guideline changes.)
• Review the guidelines for writing secure coding rules/recommendations.
• To add a new rule, follow the steps on the Guidelines for Wiki Contributors page.

Legal

The Android ^TM robot is reproduced from work created and shared by Google and used according to terms described in the Creative Commons 3.0 Attribution License .

Android is a trademark of Google Inc.

Attachments: