Securing Android Apps: OWASP Mobile Top 10 in Practice

<!-- res/xml/network_security_config.xml -->
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">api.example.com</domain>
        <pin-set expiration="2027-10-01">
            <pin digest="SHA-256">base64HashOfCurrentPublicKey=</pin>
            <!-- Backup pin: a key you hold but have not deployed -->
            <pin digest="SHA-256">base64HashOfBackupPublicKey=</pin>
        </pin-set>
    </domain-config>

    <!-- Trusted only in debuggable builds -->
    <debug-overrides>
        <trust-anchors>
            <certificates src="user" />
        </trust-anchors>
    </debug-overrides>
</network-security-config>

// SAFE: Room binds the value; it is never parsed as SQL
@Query("SELECT * FROM users WHERE name = :name")
suspend fun findUser(name: String): User?

// File paths: canonicalize, then compare with the expected directory
@Throws(IllegalArgumentException::class)
fun saferOpenFile(path: String, expectedDir: String): File {
    val file = File(path)
    require(file.canonicalPath.startsWith(expectedDir))
    return file
}

// Deep links: reject anything that is not the shape you expect
private val USER_ID = Regex("^[a-zA-Z0-9]{1,36}$")

fun handleDeepLink(uri: Uri) {
    val userId = uri.getQueryParameter("userId") ?: return
    if (!USER_ID.matches(userId)) return

    navigateToProfile(userId)
}