Android Sensitive Keyboard Cache

ID

kotlin.android_sensitive_keyboard_cache

Severity

high

Resource

Information Leak

Language

Kotlin

Tags

CWE:524, NIST.SP.800-53, PCI-DSS:6.5.6, android

Description

Storing sensitive data in keyboard cache can expose information to unauthorized access.

Rationale

Android’s virtual keyboard may cache input text for user convenience, potentially storing sensitive information like passwords or personal data. This caching can result in sensitive data being exposed or retrieved by unauthorized users or apps.

To prevent this, developers should disable keyboard caching for input fields handling sensitive data using options that prevent suggestions or treat input as passwords.

<!-- Insecure: Keyboard caching enabled -->
<EditText
    android:id="@+id/sensitive_input"
    android:layout_width="match_parent"
    android:layout_height="wrap_content"
    android:inputType="text" />

Remediation

To protect sensitive data, ensure that keyboard caching is disabled for input fields by configuring them in the XML layout file with android:inputType="textPassword".

<!-- Secure: Disable keyboard caching -->
<EditText
    android:id="@+id/sensitive_input"
    android:layout_width="match_parent"
    android:layout_height="wrap_content"
    android:inputType="textPassword" />

References