From 2969e58bb2ef5423ac95fefc7a23b50a7735ca22 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 31 Jan 2026 22:48:52 +0000
Subject: [PATCH 01/18] Initial plan
From 22afcd3e3722fca9e819cb416a54f8fde2defb3a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 31 Jan 2026 22:56:29 +0000
Subject: [PATCH 02/18] Add MASTG content for Android 16
accessibilityDataSensitive feature
- Created Knowledge page MASTG-KNOW-0108 for accessibilityDataSensitive
- Created Best Practice MASTG-BEST-0029 for marking UI views as sensitive
- Created Test MASTG-TEST-0321 for static detection
- Created Test MASTG-TEST-0322 for dynamic verification
- Created Demo MASTG-DEMO-0083 demonstrating detection with semgrep
- Created semgrep rule for static analysis
Co-authored-by: cpholguera <29175115+cpholguera@users.noreply.github.com>
---
best-practices/MASTG-BEST-0029.md | 110 ++++++++++++++++++
.../MASTG-DEMO-0083/MASTG-DEMO-0083.md | 72 ++++++++++++
.../MASTG-DEMO-0083/MastgTest.kt | 35 ++++++
.../MASTG-DEMO-0083/activity_login.xml | 51 ++++++++
.../MASVS-PLATFORM/MASTG-DEMO-0083/output.txt | 60 ++++++++++
.../MASVS-PLATFORM/MASTG-DEMO-0083/run.sh | 12 ++
.../android/MASVS-PLATFORM/MASTG-KNOW-0108.md | 88 ++++++++++++++
...-android-accessibility-data-sensitive.yaml | 88 ++++++++++++++
.../android/MASVS-PLATFORM/MASTG-TEST-0321.md | 67 +++++++++++
.../android/MASVS-PLATFORM/MASTG-TEST-0322.md | 68 +++++++++++
10 files changed, 651 insertions(+)
create mode 100644 best-practices/MASTG-BEST-0029.md
create mode 100644 demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/MASTG-DEMO-0083.md
create mode 100644 demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/MastgTest.kt
create mode 100644 demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/activity_login.xml
create mode 100644 demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/output.txt
create mode 100755 demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/run.sh
create mode 100644 knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0108.md
create mode 100644 rules/mastg-android-accessibility-data-sensitive.yaml
create mode 100644 tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0321.md
create mode 100644 tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0322.md
diff --git a/best-practices/MASTG-BEST-0029.md b/best-practices/MASTG-BEST-0029.md
new file mode 100644
index 00000000000..f597f38536d
--- /dev/null
+++ b/best-practices/MASTG-BEST-0029.md
@@ -0,0 +1,110 @@
+---
+title: Marking UI Views as Containing Sensitive Data
+alias: marking-ui-views-sensitive-data
+id: MASTG-BEST-0029
+platform: android
+knowledge: [MASTG-KNOW-0108]
+available_since: 35
+---
+
+## Overview
+
+Starting with Android 16 (API level 35), developers should mark sensitive UI views using the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute to protect against malicious accessibility services. This protection prevents unauthorized apps with accessibility permissions from reading sensitive view content or performing interactions unless they are declared as legitimate accessibility tools via [`isAccessibilityTool`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityServiceInfo#FLAG_ACCESSIBILITY_TOOL).
+
+## Recommendation
+
+Apply `accessibilityDataSensitive="true"` to views that handle or display sensitive information, such as:
+
+- Login screens (username and password fields)
+- Payment and transaction confirmation screens
+- Personal information forms (SSN, credit card numbers, etc.)
+- Two-factor authentication inputs
+- Biometric authentication prompts
+- Any view displaying confidential user data
+
+### XML Implementation
+
+```xml
+(R.id.loginButton)
+ confirmButton.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)
+
+ // Check current sensitivity settings
+ val passwordField = findViewById(R.id.passwordField)
+ val isDataSensitive = passwordField.accessibilityDataSensitive
+ val isFilteringTouches = passwordField.isFilterTouchesWhenObscured
+
+ // PASS: [MASTG-TEST-0321] Programmatically set filterTouchesWhenObscured for additional protection
+ val usernameField = findViewById(R.id.usernameField)
+ usernameField.setFilterTouchesWhenObscured(true)
+
+ // Example: Conditionally disable protection (should be avoided for sensitive views)
+ // FAIL: [MASTG-TEST-0321] Never explicitly disable protection on sensitive views
+ // val creditCardField = findViewById(R.id.creditCardField)
+ // creditCardField.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_NO)
+ }
+}
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/activity_login.xml b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/activity_login.xml
new file mode 100644
index 00000000000..4efb800cf36
--- /dev/null
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/activity_login.xml
@@ -0,0 +1,51 @@
+
+
+
+
+
+
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/output.txt b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/output.txt
new file mode 100644
index 00000000000..7153d039763
--- /dev/null
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/output.txt
@@ -0,0 +1,60 @@
+=== Scanning XML Layout ===
+┌─────────────────┐
+│ 6 Code Findings │
+└─────────────────┘
+
+ activity_login.xml
+ ❯❱ rules.mastg-android-sensitive-view-without-protection
+ [MASVS-PLATFORM] Potentially sensitive view lacks accessibilityDataSensitive or
+ filterTouchesWhenObscured protection
+
+ 18┆
+ - pattern: |
+
+ - pattern: |
+
+ - pattern-not: <... android:accessibilityDataSensitive="true" ...>
+ - pattern-not: <... android:filterTouchesWhenObscured="true" ...>
diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0321.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0321.md
new file mode 100644
index 00000000000..50b3f1abd6f
--- /dev/null
+++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0321.md
@@ -0,0 +1,67 @@
+---
+title: References to Accessibility Data Sensitivity APIs
+platform: android
+id: MASTG-TEST-0321
+type: [static]
+profiles: [L2]
+best-practices: [MASTG-BEST-0029]
+weakness: MASWE-0055
+knowledge: [MASTG-KNOW-0108]
+apis: [View, setAccessibilityDataSensitive, filterTouchesWhenObscured]
+available_since: 35
+---
+
+## Overview
+
+This test verifies whether an app references Android's accessibility data sensitivity APIs. Starting with Android 16 (API level 35), developers can use the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute to protect sensitive views from malicious accessibility services. When set to `true` on a view, it restricts non-tool accessibility services from reading or interacting with sensitive content.
+
+Developers can apply this protection in two ways:
+
+1. **Explicit XML declaration**: Setting `android:accessibilityDataSensitive="true"` in layout files
+2. **Programmatic API**: Calling [`setAccessibilityDataSensitive(int)`](https://developer.android.com/reference/android/view/View#setAccessibilityDataSensitive(int)) with `View.ACCESSIBILITY_DATA_SENSITIVE_YES`
+3. **Implicit via filterTouchesWhenObscured**: Views with `android:filterTouchesWhenObscured="true"` automatically inherit accessibility data sensitivity protection on Android 16+
+
+Common failure modes include:
+
+- Not marking sensitive views (login fields, payment buttons, personal data forms) with `accessibilityDataSensitive`
+- Inconsistently applying protection across related sensitive screens
+- Explicitly disabling protection on sensitive views by setting `View.ACCESSIBILITY_DATA_SENSITIVE_NO`
+- Not leveraging automatic protection from existing `filterTouchesWhenObscured` flags
+
+## Steps
+
+1. Extract the app's layout XML files from the APK (@MASTG-TECH-0117).
+2. Run a static analysis tool (@MASTG-TECH-0014) to identify:
+ - Views with `android:accessibilityDataSensitive` set to `true` or `false`
+ - Views with `android:filterTouchesWhenObscured="true"` (which provide implicit protection)
+ - Calls to `setAccessibilityDataSensitive()` in decompiled code
+ - Calls to `setFilterTouchesWhenObscured()` in decompiled code
+3. Identify sensitive views based on their ID, type, or context (e.g., password fields, payment confirmation buttons).
+
+## Observation
+
+The output should include:
+
+1. A list of views with `android:accessibilityDataSensitive` explicitly set in XML layouts.
+2. A list of views with `android:filterTouchesWhenObscured="true"` (which gain implicit protection).
+3. A list of programmatic calls to `setAccessibilityDataSensitive()` in the codebase.
+4. A list of programmatic calls to `setFilterTouchesWhenObscured()` in the codebase.
+5. A mapping of identified sensitive views (by ID, type, or context) that should be protected.
+
+## Evaluation
+
+The test case fails if sensitive views that handle or display confidential information are not protected by `accessibilityDataSensitive` or `filterTouchesWhenObscured`. Specifically:
+
+- Password fields, PINs, credit card inputs, or other credential fields lack protection
+- Payment confirmation or transaction approval buttons are unprotected
+- Personal information forms (SSN, passport numbers, etc.) are not marked sensitive
+- The app explicitly disables protection on sensitive views using `View.ACCESSIBILITY_DATA_SENSITIVE_NO`
+
+The test passes if:
+
+- All sensitive views have `android:accessibilityDataSensitive="true"` in XML or call `setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)` programmatically
+- Or, sensitive views use `android:filterTouchesWhenObscured="true"` to gain implicit protection on Android 16+
+- Protection is applied consistently across all screens handling sensitive data
+- No code paths explicitly disable the protection without justification
+
+**Note**: This test is applicable only for apps targeting Android 16 (API level 35) or higher. For apps targeting lower API levels, the attribute is ignored by the system, and alternative protections like `filterTouchesWhenObscured` should be evaluated separately.
diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0322.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0322.md
new file mode 100644
index 00000000000..815c52071d8
--- /dev/null
+++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0322.md
@@ -0,0 +1,68 @@
+---
+title: Runtime Verification of Accessibility Data Sensitivity
+platform: android
+id: MASTG-TEST-0322
+type: [dynamic]
+profiles: [L2]
+best-practices: [MASTG-BEST-0029]
+weakness: MASWE-0055
+knowledge: [MASTG-KNOW-0108]
+apis: [View, getAccessibilityDataSensitive, setAccessibilityDataSensitive, isFilterTouchesWhenObscured]
+available_since: 35
+---
+
+## Overview
+
+This test is the dynamic counterpart to @MASTG-TEST-0321. It verifies that sensitive views in an Android app are properly configured with accessibility data sensitivity protection at runtime.
+
+At runtime, you can inspect view properties to determine:
+
+- Whether `accessibilityDataSensitive` is enabled using [`getAccessibilityDataSensitive()`](https://developer.android.com/reference/android/view/View#getAccessibilityDataSensitive())
+- Whether `filterTouchesWhenObscured` is enabled using [`isFilterTouchesWhenObscured()`](https://developer.android.com/reference/android/view/View#isFilterTouchesWhenObscured()), which provides implicit accessibility protection on Android 16+
+- Whether views handling sensitive data are protected appropriately
+
+This test focuses on observing the actual runtime configuration of views to ensure protection is active when the app is running.
+
+## Steps
+
+1. Install the app on a device running Android 16 (API level 35) or higher (@MASTG-TECH-0005).
+2. Use a dynamic analysis tool like @MASTG-TOOL-0031 (Frida) to:
+ - Enumerate all active View instances in the app's UI hierarchy
+ - For each view, call `getAccessibilityDataSensitive()` to check the current sensitivity setting
+ - For each view, call `isFilterTouchesWhenObscured()` to check if implicit protection is enabled
+ - Identify views by their resource ID, type, and context to determine if they handle sensitive data
+3. Navigate through sensitive screens in the app (login, payment, personal information forms) and collect runtime view configurations.
+
+## Observation
+
+The output should include:
+
+1. A list of all View instances found in the app's UI hierarchy with their:
+ - Resource ID (e.g., `@id/passwordField`)
+ - View type (e.g., `EditText`, `Button`)
+ - `accessibilityDataSensitive` setting (from `getAccessibilityDataSensitive()`)
+ - `filterTouchesWhenObscured` setting (from `isFilterTouchesWhenObscured()`)
+2. A classification of views as sensitive or non-sensitive based on their ID, type, and context.
+3. Any views where sensitivity settings change during app execution (e.g., via programmatic calls to `setAccessibilityDataSensitive()`).
+
+## Evaluation
+
+The test case fails if sensitive views are not properly protected at runtime:
+
+- Password fields, PIN inputs, or credential entry views have `ACCESSIBILITY_DATA_SENSITIVE_NO` or `ACCESSIBILITY_DATA_SENSITIVE_AUTO` without implicit protection from `filterTouchesWhenObscured`
+- Payment confirmation buttons, transaction approval actions lack accessibility sensitivity protection
+- Personal information forms (SSN, credit card details) are not marked as sensitive
+- Protection is inconsistently applied across related sensitive screens
+
+The test passes if:
+
+- All sensitive views return `View.ACCESSIBILITY_DATA_SENSITIVE_YES` from `getAccessibilityDataSensitive()`
+- Or, sensitive views return `true` from `isFilterTouchesWhenObscured()`, providing implicit accessibility protection on Android 16+
+- Protection is active and consistent across all screens handling sensitive data during runtime navigation
+- No runtime code paths dynamically disable the protection on sensitive views without justification
+
+**Note**: Views with `ACCESSIBILITY_DATA_SENSITIVE_AUTO` may inherit protection from parent views or from `filterTouchesWhenObscured`. Verify the effective protection by checking both the view and its parent hierarchy.
+
+**Additional Guidance**:
+
+If the app dynamically creates views or modifies their sensitivity settings at runtime, use method tracing or hooks to capture calls to `setAccessibilityDataSensitive()` and `setFilterTouchesWhenObscured()` to understand when and why protection is applied or removed. See @MASTG-TECH-0033 for method tracing techniques.
From 5a9c37335148cdbe8171044f1778bf7ed7e77327 Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sat, 24 Oct 2026 12:01:10 +0200
Subject: [PATCH 03/18] Update MASTG-BEST-0029 to reflect correct API level for
accessibilityDataSensitive attribute and updated recommendation
---
best-practices/MASTG-BEST-0029.md | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/best-practices/MASTG-BEST-0029.md b/best-practices/MASTG-BEST-0029.md
index f597f38536d..77f4b21f39a 100644
--- a/best-practices/MASTG-BEST-0029.md
+++ b/best-practices/MASTG-BEST-0029.md
@@ -4,19 +4,19 @@ alias: marking-ui-views-sensitive-data
id: MASTG-BEST-0029
platform: android
knowledge: [MASTG-KNOW-0108]
-available_since: 35
+available_since: 36
---
## Overview
-Starting with Android 16 (API level 35), developers should mark sensitive UI views using the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute to protect against malicious accessibility services. This protection prevents unauthorized apps with accessibility permissions from reading sensitive view content or performing interactions unless they are declared as legitimate accessibility tools via [`isAccessibilityTool`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityServiceInfo#FLAG_ACCESSIBILITY_TOOL).
+Starting with Android 16 (API level 36), developers should mark sensitive UI views using the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute to protect against malicious accessibility services. This protection prevents unauthorized apps with accessibility permissions from reading sensitive view content or performing interactions unless they are declared as legitimate accessibility tools via [`isAccessibilityTool`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityServiceInfo#FLAG_ACCESSIBILITY_TOOL).
## Recommendation
Apply `accessibilityDataSensitive="true"` to views that handle or display sensitive information, such as:
- Login screens (username and password fields)
-- Payment and transaction confirmation screens
+- system prompts, permissions, settings, and app specific confirmations such as payment and transaction confirmations
- Personal information forms (SSN, credit card numbers, etc.)
- Two-factor authentication inputs
- Biometric authentication prompts
@@ -84,7 +84,7 @@ This protection can impact legitimate accessibility services like screen readers
### API Level Compatibility
-The `accessibilityDataSensitive` attribute is only available on Android 16 (API level 35) and higher. On older devices:
+The `accessibilityDataSensitive` attribute is only available on Android 16 (API level 36) and higher. On older devices:
- The attribute is ignored; the app functions normally without this protection
- Consider using `filterTouchesWhenObscured` for broader compatibility against overlay attacks
From 0b296aba9dda6e9b12437fb3e59279a06704aeb2 Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sat, 24 Oct 2026 12:01:26 +0200
Subject: [PATCH 04/18] Update MASTG-KNOW-0108 to reflect correct API level for
accessibilityDataSensitive attribute
---
knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0108.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0108.md b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0108.md
index ca97c2fff7b..063139d15a3 100644
--- a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0108.md
+++ b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0108.md
@@ -2,12 +2,12 @@
masvs_category: MASVS-PLATFORM
platform: android
title: Accessibility Data Sensitivity
-available_since: 35
+available_since: 36
---
## Overview
-Starting with Android 16 (API level 35), the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute provides a mechanism for developers to protect sensitive UI views from being accessed by accessibility services that are not legitimate accessibility tools. When this attribute is set to `true` on a view, the system restricts apps with accessibility permissions from reading or interacting with that view's content unless the accessibility service declares itself as a legitimate accessibility tool via [`isAccessibilityTool`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityServiceInfo#FLAG_ACCESSIBILITY_TOOL) in its manifest.
+Starting with Android 16 (API level 36), the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute provides a mechanism for developers to protect sensitive UI views from being accessed by accessibility services that are not legitimate accessibility tools. When this attribute is set to `true` on a view, the system restricts apps with accessibility permissions from reading or interacting with that view's content unless the accessibility service declares itself as a legitimate accessibility tool via [`isAccessibilityTool`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityServiceInfo#FLAG_ACCESSIBILITY_TOOL) in its manifest.
## Purpose and Behavior
From fa57b9cdccd41be8a75dd5f49c15adcc01f3fa82 Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sat, 24 Oct 2026 12:05:46 +0200
Subject: [PATCH 05/18] Update MASTG-TEST-0321 and MASTG-TEST-0322 to reflect
correct API level for accessibilityDataSensitive attribute and enhance
validation guidance with Further Validation
---
.../android/MASVS-PLATFORM/MASTG-TEST-0321.md | 14 ++++++++++----
.../android/MASVS-PLATFORM/MASTG-TEST-0322.md | 12 +++++++++---
2 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0321.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0321.md
index 50b3f1abd6f..3ad80e18c61 100644
--- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0321.md
+++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0321.md
@@ -2,18 +2,18 @@
title: References to Accessibility Data Sensitivity APIs
platform: android
id: MASTG-TEST-0321
-type: [static]
+type: [static, manual]
profiles: [L2]
best-practices: [MASTG-BEST-0029]
weakness: MASWE-0055
knowledge: [MASTG-KNOW-0108]
apis: [View, setAccessibilityDataSensitive, filterTouchesWhenObscured]
-available_since: 35
+available_since: 36
---
## Overview
-This test verifies whether an app references Android's accessibility data sensitivity APIs. Starting with Android 16 (API level 35), developers can use the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute to protect sensitive views from malicious accessibility services. When set to `true` on a view, it restricts non-tool accessibility services from reading or interacting with sensitive content.
+This test verifies whether an app references Android's accessibility data sensitivity APIs. Starting with Android 16 (API level 36), developers can use the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute to protect sensitive views from malicious accessibility services. When set to `true` on a view, it restricts non-tool accessibility services from reading or interacting with sensitive content.
Developers can apply this protection in two ways:
@@ -64,4 +64,10 @@ The test passes if:
- Protection is applied consistently across all screens handling sensitive data
- No code paths explicitly disable the protection without justification
-**Note**: This test is applicable only for apps targeting Android 16 (API level 35) or higher. For apps targeting lower API levels, the attribute is ignored by the system, and alternative protections like `filterTouchesWhenObscured` should be evaluated separately.
+**Note**: This test is applicable only for apps targeting Android 16 (API level 36) or higher. For apps targeting lower API levels, the attribute is ignored by the system, and alternative protections like `filterTouchesWhenObscured` should be evaluated separately.
+
+**Further Validation Required:**
+
+Static analysis is a good starting point, but it can only show whether a view is protected. It cannot reliably determine whether the view displays sensitive data, nor whether the protection is effective at runtime. Use the results of this test as a complement and verify them dynamically by following @MASTG-TEST-0322, navigating the screens that handle or display sensitive data (e.g., login, payment, personal information) and confirming that the corresponding views are protected.
+
+Note that, without an auditor physically monitoring the tested screens, there is no obvious mechanism to determine if the displayed information is sensitive in nature. Connecting the testing to an LLM may help, but it may not always capture the screen displaying the data this API is intended to protect.
diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0322.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0322.md
index 815c52071d8..865082e2f9f 100644
--- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0322.md
+++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0322.md
@@ -2,13 +2,13 @@
title: Runtime Verification of Accessibility Data Sensitivity
platform: android
id: MASTG-TEST-0322
-type: [dynamic]
+type: [dynamic, manual]
profiles: [L2]
best-practices: [MASTG-BEST-0029]
weakness: MASWE-0055
knowledge: [MASTG-KNOW-0108]
apis: [View, getAccessibilityDataSensitive, setAccessibilityDataSensitive, isFilterTouchesWhenObscured]
-available_since: 35
+available_since: 36
---
## Overview
@@ -25,7 +25,7 @@ This test focuses on observing the actual runtime configuration of views to ensu
## Steps
-1. Install the app on a device running Android 16 (API level 35) or higher (@MASTG-TECH-0005).
+1. Install the app on a device running Android 16 (API level 36) or higher (@MASTG-TECH-0005).
2. Use a dynamic analysis tool like @MASTG-TOOL-0031 (Frida) to:
- Enumerate all active View instances in the app's UI hierarchy
- For each view, call `getAccessibilityDataSensitive()` to check the current sensitivity setting
@@ -66,3 +66,9 @@ The test passes if:
**Additional Guidance**:
If the app dynamically creates views or modifies their sensitivity settings at runtime, use method tracing or hooks to capture calls to `setAccessibilityDataSensitive()` and `setFilterTouchesWhenObscured()` to understand when and why protection is applied or removed. See @MASTG-TECH-0033 for method tracing techniques.
+
+**Further Validation Required:**
+
+Runtime inspection of view properties shows whether a view is protected, but it cannot reliably determine whether the view displays sensitive data. Without an auditor physically monitoring the tested screens, there is no obvious mechanism to tell if the information shown is sensitive in nature. Manually navigate through the screens that handle or display sensitive data (e.g., login, payment, personal information) and verify that the corresponding views are protected.
+
+If the automated testing is connected to an LLM to classify what is displayed, note that it may not always capture the screen displaying the data this API is intended to protect, so the result still needs to be confirmed manually.
From aea3d2fb0707231c228898751297fb1f6af76952 Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sat, 24 Oct 2026 12:09:28 +0200
Subject: [PATCH 06/18] Fix IDs to fake IDs
---
best-practices/{MASTG-BEST-0029.md => MASTG-BEST-0x01.md} | 4 ++--
.../MASTG-DEMO-0x01.md} | 4 ++--
.../{MASTG-DEMO-0083 => MASTG-DEMO-0x01}/MastgTest.kt | 6 +++---
.../activity_login.xml | 8 ++++----
.../{MASTG-DEMO-0083 => MASTG-DEMO-0x01}/output.txt | 0
.../{MASTG-DEMO-0083 => MASTG-DEMO-0x01}/run.sh | 0
.../{MASTG-KNOW-0108.md => MASTG-KNOW-0x01.md} | 0
.../{MASTG-TEST-0321.md => MASTG-TEST-0x01.md} | 8 ++++----
.../{MASTG-TEST-0322.md => MASTG-TEST-0x02.md} | 8 ++++----
9 files changed, 19 insertions(+), 19 deletions(-)
rename best-practices/{MASTG-BEST-0029.md => MASTG-BEST-0x01.md} (99%)
rename demos/android/MASVS-PLATFORM/{MASTG-DEMO-0083/MASTG-DEMO-0083.md => MASTG-DEMO-0x01/MASTG-DEMO-0x01.md} (98%)
rename demos/android/MASVS-PLATFORM/{MASTG-DEMO-0083 => MASTG-DEMO-0x01}/MastgTest.kt (88%)
rename demos/android/MASVS-PLATFORM/{MASTG-DEMO-0083 => MASTG-DEMO-0x01}/activity_login.xml (87%)
rename demos/android/MASVS-PLATFORM/{MASTG-DEMO-0083 => MASTG-DEMO-0x01}/output.txt (100%)
rename demos/android/MASVS-PLATFORM/{MASTG-DEMO-0083 => MASTG-DEMO-0x01}/run.sh (100%)
rename knowledge/android/MASVS-PLATFORM/{MASTG-KNOW-0108.md => MASTG-KNOW-0x01.md} (100%)
rename tests-beta/android/MASVS-PLATFORM/{MASTG-TEST-0321.md => MASTG-TEST-0x01.md} (97%)
rename tests-beta/android/MASVS-PLATFORM/{MASTG-TEST-0322.md => MASTG-TEST-0x02.md} (96%)
diff --git a/best-practices/MASTG-BEST-0029.md b/best-practices/MASTG-BEST-0x01.md
similarity index 99%
rename from best-practices/MASTG-BEST-0029.md
rename to best-practices/MASTG-BEST-0x01.md
index 77f4b21f39a..7ddfb1e413e 100644
--- a/best-practices/MASTG-BEST-0029.md
+++ b/best-practices/MASTG-BEST-0x01.md
@@ -1,9 +1,9 @@
---
title: Marking UI Views as Containing Sensitive Data
alias: marking-ui-views-sensitive-data
-id: MASTG-BEST-0029
+id: MASTG-BEST-0x01
platform: android
-knowledge: [MASTG-KNOW-0108]
+knowledge: [MASTG-KNOW-0x01]
available_since: 36
---
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/MASTG-DEMO-0083.md b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MASTG-DEMO-0x01.md
similarity index 98%
rename from demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/MASTG-DEMO-0083.md
rename to demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MASTG-DEMO-0x01.md
index 1b3413de048..9a242bbe31b 100644
--- a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/MASTG-DEMO-0083.md
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MASTG-DEMO-0x01.md
@@ -1,9 +1,9 @@
---
platform: android
title: Detecting Accessibility Data Sensitivity in Layouts with semgrep
-id: MASTG-DEMO-0083
+id: MASTG-DEMO-0x01
code: [xml, kotlin]
-test: MASTG-TEST-0321
+test: MASTG-TEST-0x01
---
## Sample
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/MastgTest.kt b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest.kt
similarity index 88%
rename from demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/MastgTest.kt
rename to demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest.kt
index 8c6c94562c3..e03447d5546 100644
--- a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/MastgTest.kt
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest.kt
@@ -14,7 +14,7 @@ class MastgTest : AppCompatActivity() {
super.onCreate(savedInstanceState)
setContentView(R.layout.activity_login)
- // PASS: [MASTG-TEST-0321] Programmatically set accessibility data sensitivity on a button
+ // PASS: [MASTG-TEST-0x01] Programmatically set accessibility data sensitivity on a button
val confirmButton = findViewById(R.id.loginButton)
confirmButton.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)
@@ -23,12 +23,12 @@ class MastgTest : AppCompatActivity() {
val isDataSensitive = passwordField.accessibilityDataSensitive
val isFilteringTouches = passwordField.isFilterTouchesWhenObscured
- // PASS: [MASTG-TEST-0321] Programmatically set filterTouchesWhenObscured for additional protection
+ // PASS: [MASTG-TEST-0x01] Programmatically set filterTouchesWhenObscured for additional protection
val usernameField = findViewById(R.id.usernameField)
usernameField.setFilterTouchesWhenObscured(true)
// Example: Conditionally disable protection (should be avoided for sensitive views)
- // FAIL: [MASTG-TEST-0321] Never explicitly disable protection on sensitive views
+ // FAIL: [MASTG-TEST-0x01] Never explicitly disable protection on sensitive views
// val creditCardField = findViewById(R.id.creditCardField)
// creditCardField.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_NO)
}
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/activity_login.xml b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/activity_login.xml
similarity index 87%
rename from demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/activity_login.xml
rename to demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/activity_login.xml
index 4efb800cf36..cf4fc3f3dca 100644
--- a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0083/activity_login.xml
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/activity_login.xml
@@ -6,7 +6,7 @@
android:orientation="vertical"
android:padding="16dp">
-
+
Date: Sun, 25 Oct 2026 18:16:49 +0100
Subject: [PATCH 07/18] Update MASTG-BEST-0x01 to clarify accessibility data
sensitivity for sensitive views and adjust API level references
---
best-practices/MASTG-BEST-0x01.md | 100 +++++++-----------------------
1 file changed, 22 insertions(+), 78 deletions(-)
diff --git a/best-practices/MASTG-BEST-0x01.md b/best-practices/MASTG-BEST-0x01.md
index 7ddfb1e413e..dd207d014d7 100644
--- a/best-practices/MASTG-BEST-0x01.md
+++ b/best-practices/MASTG-BEST-0x01.md
@@ -1,28 +1,26 @@
---
-title: Marking UI Views as Containing Sensitive Data
-alias: marking-ui-views-sensitive-data
+title: Restricting Accessibility Service Access to Sensitive Views
+alias: restricting-accessibility-service-access-to-sensitive-views
id: MASTG-BEST-0x01
platform: android
knowledge: [MASTG-KNOW-0x01]
-available_since: 36
+available_since: 34
---
-## Overview
+Mark views that display or accept sensitive data as accessibility data sensitive (@MASTG-KNOW-0x01). On Android 14 (API level 34) and higher, this restricts access to these views to accessibility services that declare themselves as accessibility tools by setting [`android:isAccessibilityTool`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityServiceInfo#attr_android:isAccessibilityTool) to `true` in their service configuration, such as screen readers. Accessibility services that don't declare `android:isAccessibilityTool="true"`, including malware that tricks the user into enabling it, can't read the content of these views or perform interactions on them, for example, capturing typed credentials or tapping a payment confirmation button on the user's behalf.
-Starting with Android 16 (API level 36), developers should mark sensitive UI views using the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute to protect against malicious accessibility services. This protection prevents unauthorized apps with accessibility permissions from reading sensitive view content or performing interactions unless they are declared as legitimate accessibility tools via [`isAccessibilityTool`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityServiceInfo#FLAG_ACCESSIBILITY_TOOL).
-
-## Recommendation
-
-Apply `accessibilityDataSensitive="true"` to views that handle or display sensitive information, such as:
+Apply this protection to views that handle or display sensitive information, such as:
- Login screens (username and password fields)
-- system prompts, permissions, settings, and app specific confirmations such as payment and transaction confirmations
-- Personal information forms (SSN, credit card numbers, etc.)
+- System prompts, permissions, settings, and app-specific confirmations, such as payment and transaction confirmations
+- Personal information forms (for example, national ID numbers or credit card numbers)
- Two-factor authentication inputs
- Biometric authentication prompts
- Any view displaying confidential user data
-### XML Implementation
+## Marking Views as Sensitive
+
+Set the [`android:accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute to `true` in the layout file:
```xml
Date: Sun, 25 Oct 2026 18:18:09 +0100
Subject: [PATCH 08/18] Update MASTG-KNOW-0x01 to correct available_since
value, align with writing guidelines, enhance accessibility data sensitivity
explanation and add accessibility tools
---
.../android/MASVS-PLATFORM/MASTG-KNOW-0x01.md | 88 +++++--------------
1 file changed, 20 insertions(+), 68 deletions(-)
diff --git a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0x01.md b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0x01.md
index 063139d15a3..9807a4899f0 100644
--- a/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0x01.md
+++ b/knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0x01.md
@@ -2,87 +2,39 @@
masvs_category: MASVS-PLATFORM
platform: android
title: Accessibility Data Sensitivity
-available_since: 36
+available_since: 34
+best-practices: [MASTG-BEST-0x01]
---
-## Overview
+Android 14 (API level 34) introduced accessibility data sensitivity, which lets an app specify that a [`View`](https://developer.android.com/reference/android/view/View) only allows interactions from accessibility services that are declared as accessibility tools. Accessibility services that aren't declared as [accessibility tools](#accessibility-tools) are denied access to the content of these views and can't perform interactions on them. Accessibility tools, such as screen readers, keep full access.
-Starting with Android 16 (API level 36), the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute provides a mechanism for developers to protect sensitive UI views from being accessed by accessibility services that are not legitimate accessibility tools. When this attribute is set to `true` on a view, the system restricts apps with accessibility permissions from reading or interacting with that view's content unless the accessibility service declares itself as a legitimate accessibility tool via [`isAccessibilityTool`](https://developer.android.com/reference/android/accessibilityservice/AccessibilityServiceInfo#FLAG_ACCESSIBILITY_TOOL) in its manifest.
-
-## Purpose and Behavior
-
-The `accessibilityDataSensitive` flag addresses a security concern where malicious apps can abuse Android's accessibility framework to eavesdrop on sensitive user interactions or inject clicks on behalf of the user. By marking views as sensitive, developers can:
-
-- Prevent unauthorized accessibility services from reading view content (text, descriptions, etc.)
-- Block non-legitimate accessibility services from performing clicks or other interactions on sensitive views
-- Protect against overlay attacks that exploit accessibility permissions
+The feature complements touch filtering for obscured windows (see @MASTG-KNOW-0022), which uses the same [`View.setFilterTouchesWhenObscured`](https://developer.android.com/reference/android/view/View#setFilterTouchesWhenObscured(boolean)) setting. However, on devices running Android versions earlier than Android 14 (API level 34), this mechanism only filters touch events when the view is obscured by another window and doesn't affect accessibility services.
## Configuration
-The attribute can be set in two ways:
-
-### XML Layout
-
-In layout files, developers can explicitly mark views as containing sensitive data:
-
-```xml
-
Date: Sun, 25 Oct 2026 18:18:43 +0100
Subject: [PATCH 09/18] Add MASTG-TECH-0x01: Document methods for inspecting UI
hierarchy and accessibility data sensitivity
---
techniques/android/MASTG-TECH-0x01.md | 106 ++++++++++++++++++++++++++
1 file changed, 106 insertions(+)
create mode 100644 techniques/android/MASTG-TECH-0x01.md
diff --git a/techniques/android/MASTG-TECH-0x01.md b/techniques/android/MASTG-TECH-0x01.md
new file mode 100644
index 00000000000..2a67a47f07d
--- /dev/null
+++ b/techniques/android/MASTG-TECH-0x01.md
@@ -0,0 +1,106 @@
+---
+title: Inspecting the UI Hierarchy
+platform: android
+---
+
+You can inspect the UI hierarchy of an app's screen in several ways. The methods differ in where the data comes from (the accessibility node tree, the app's `View` objects, or the pixels on the screen), what they require, and which properties they reveal. Choose the method based on the property you need to check, and be aware of what each method can't show.
+
+## Using @MASTG-TOOL-0004 with UI Automator
+
+The `uiautomator dump` command writes an XML representation of the foreground window:
+
+```bash
+adb shell uiautomator dump /sdcard/ui.xml
+adb pull /sdcard/ui.xml
+```
+
+Each node includes attributes such as `class`, `text`, `resource-id`, `content-desc`, `bounds`, and flags such as `clickable`, `focusable`, and `password`. The dump also includes UI elements built with Jetpack Compose, because Compose exposes its semantics through the accessibility framework.
+
+This method doesn't require root access or instrumentation and works with release builds. It's useful to get an inventory of the elements and the text shown on a screen, for example, to identify the views that display or accept sensitive data.
+
+However, keep the following limitations in mind:
+
+- The dump only contains the attributes listed above. It doesn't include other `View` properties, such as accessibility data sensitivity (@MASTG-KNOW-0x01) or `filterTouchesWhenObscured`.
+- UI Automator reads the screen through the platform's UI automation framework, which isn't restricted by accessibility data sensitivity. Views marked as accessibility data sensitive still appear in the dump with their text and attributes. As a result, the dump doesn't reflect what an accessibility service that isn't an accessibility tool can access, and you can't use it to verify this protection.
+
+## Using @MASTG-TOOL-0x01
+
+The `hierarchy` command of @MASTG-TOOL-0x01 prints the UI hierarchy of the current screen as JSON:
+
+```bash
+maestro hierarchy > hierarchy.json
+```
+
+Each node includes attributes such as `class`, `text`, `hintText`, `accessibilityText`, `resource-id`, `bounds`, and flags such as `clickable`, `enabled`, and `focused`. The output also includes Jetpack Compose elements and the system UI, such as the status bar.
+
+Maestro reads the UI through the same accessibility layer as UI Automator, so it has the same limitations: the output doesn't include accessibility data sensitivity, and views marked as accessibility data sensitive still appear with their attributes. Compared to `uiautomator dump`, it reports the hint of a text field separately from its text, which makes it easier to identify input fields that are still empty.
+
+Maestro can also interact with views marked as accessibility data sensitive. For example, a flow can tap protected input fields, such as a password field, and enter text into them. Because Maestro acts through test automation with shell privileges and not as an accessibility service, this doesn't show what an accessibility service that isn't an accessibility tool can do. Don't use the results of a Maestro flow to verify this protection.
+
+## Using @MASTG-TOOL-0004 with dumpsys
+
+The `dumpsys activity top` command prints information about the foreground activity, including a "View Hierarchy" section:
+
+```bash
+adb shell dumpsys activity top
+```
+
+The output can contain a view hierarchy for several activities, for example, the launcher or the Settings app in addition to the app you're testing. Each hierarchy starts with a `DecorView` line followed by the name of the activity in brackets, for example, `[MainActivity]`.
+
+Each line of the view hierarchy contains the class name of a `View`, a summary of its state flags (such as visibility, focusability, and clickability), its bounds, and its resource ID, if any:
+
+```text
+android.widget.LinearLayout{5beae27 V.E...... ........ 0,1549-1080,2400 aid=1073741832}
+ android.widget.EditText{46a38d4 VFED..CL. ........ 48,32-1032,150 aid=1073741828}
+ android.widget.EditText{682fa7d VFED..CL. ........ 48,150-1032,268 aid=1073741829}
+```
+
+This method doesn't require root access, instrumentation, or a debuggable build. However, it has the following limitations:
+
+- It only lists `View` objects, so the content of a Jetpack Compose UI appears as a single `AndroidComposeView` without its individual elements.
+- The output doesn't include the text or hint of the views, which makes it hard to tell which view handles which data.
+- The state flags don't include properties such as accessibility data sensitivity or `filterTouchesWhenObscured`. For example, a protected password field and an unprotected username field have identical entries.
+
+## Using @MASTG-TOOL-0007
+
+The Layout Inspector in Android Studio shows the live view hierarchy of an app, including Jetpack Compose elements, and lets you inspect the attributes of each view.
+
+The Layout Inspector requires a debuggable build of the app, so it's usually not an option when you test a release build. Use it when the development team provides a debuggable build.
+
+## Using @MASTG-TOOL-0001
+
+You can use @MASTG-TECH-0043 to enumerate the `View` objects of the foreground activity and call any `View` method on them, for example, `isAccessibilityDataSensitive` and `getFilterTouchesWhenObscured`. Because the methods run inside the app, they return the effective values, including values inherited from parent views or implied by other settings.
+
+This method requires instrumentation (see @MASTG-TOOL-0001) and only covers `View` objects. Jetpack Compose elements aren't `View` objects, so they appear as a single `AndroidComposeView`. The values reflect the state at the time of the enumeration, so you need to repeat it on each screen you want to check.
+
+See @MASTG-DEMO-0x02 for an example script that enumerates the views of the foreground activity and prints their accessibility data sensitivity.
+
+## Using a Custom Accessibility Service
+
+You can build a test app with an accessibility service that isn't declared as an accessibility tool and log the [`AccessibilityNodeInfo`](https://developer.android.com/reference/android/view/accessibility/AccessibilityNodeInfo) tree that the service receives for each screen. This reflects what any other accessibility service that isn't an accessibility tool, including malware, can access. It's the most direct way to confirm the effect of protections such as accessibility data sensitivity.
+
+This method requires building and installing a separate app. You can enable its service in the device's accessibility settings or with @MASTG-TOOL-0004:
+
+```bash
+adb shell settings put secure enabled_accessibility_services /
+```
+
+On Android 13 (API level 33) and higher, the device's settings may block enabling accessibility services for some sideloaded apps ("restricted settings"). In that case, enable the service with the command above.
+
+## Taking Screenshots
+
+Screenshots only show the pixels on the screen and don't reveal any property of the views. They're still useful to determine which data each screen displays. See @MASTG-TECH-0x02 for the available methods.
+
+## Choosing a Method
+
+| Method | Requirements | Source of the data | Shows accessibility data sensitivity |
+| --- | --- | --- | --- |
+| `uiautomator dump` | @MASTG-TOOL-0004 | Accessibility node tree, not restricted by accessibility data sensitivity | No, and protected views are still included |
+| `maestro hierarchy` | @MASTG-TOOL-0x01 | Accessibility node tree, not restricted by accessibility data sensitivity | No, and protected views are still included |
+| `dumpsys activity top` | @MASTG-TOOL-0004 | Summary of the app's `View` objects, without text | No |
+| Layout Inspector | Debuggable build | App's `View` objects and Compose elements | Not usable with release builds |
+| View enumeration with @MASTG-TOOL-0001 | Instrumentation | App's `View` objects, using the full `View` API | Yes, the effective value of each view |
+| Custom accessibility service | Separate test app with the service enabled | Accessibility node tree as received by a service that isn't an accessibility tool | Indirectly, by showing which views the service can access |
+| Screenshots | @MASTG-TECH-0x02 | Pixels on the screen | No |
+
+For example, to verify accessibility data sensitivity at runtime (@MASTG-TEST-0x02), enumerate the views with @MASTG-TOOL-0001 and use screenshots (@MASTG-TECH-0x02), `uiautomator dump`, or `maestro hierarchy` only to identify which views display sensitive data. To confirm what a malicious accessibility service can access, use a custom accessibility service.
From 7276bf6bdf218900e38b2abc89bc434744c0e6e0 Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sun, 25 Oct 2026 18:18:50 +0100
Subject: [PATCH 10/18] Add MASTG-TECH-0x02: Document methods for taking
screenshots in Android
---
techniques/android/MASTG-TECH-0x02.md | 39 +++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
create mode 100644 techniques/android/MASTG-TECH-0x02.md
diff --git a/techniques/android/MASTG-TECH-0x02.md b/techniques/android/MASTG-TECH-0x02.md
new file mode 100644
index 00000000000..d3c076eae73
--- /dev/null
+++ b/techniques/android/MASTG-TECH-0x02.md
@@ -0,0 +1,39 @@
+---
+title: Taking Screenshots
+platform: android
+---
+
+Screenshots show what an app displays on a screen at a given moment. They're useful as evidence and to determine which data a screen displays, for example, during manual validation. However, they only capture pixels and don't reveal any property of the UI elements, such as whether a view is marked as accessibility data sensitive. To inspect those properties, see @MASTG-TECH-0x01.
+
+Windows that use [`FLAG_SECURE`](https://developer.android.com/reference/android/view/WindowManager.LayoutParams#FLAG_SECURE) appear black in screenshots taken with these methods.
+
+## Using @MASTG-TOOL-0004
+
+Use the `screencap` command to capture the screen and write the PNG image directly to your computer:
+
+```bash
+adb exec-out screencap -p > screenshot.png
+```
+
+## Using @MASTG-TOOL-0x02
+
+Use the `screen capture` command:
+
+```bash
+android screen capture --output=screenshot.png
+```
+
+Add `--annotate` to draw labeled bounding boxes around the UI elements detected on the screen, which helps you refer to specific elements when you document the screen.
+
+## Using @MASTG-TOOL-0x01
+
+Use the `takeScreenshot` command in a flow to capture the screen at a specific point, for example, after the flow has navigated to a screen that handles sensitive data:
+
+```yaml
+appId: org.owasp.mastestapp
+---
+- tapOn: "Start"
+- takeScreenshot: payment-form
+```
+
+This is useful when you need screenshots of several screens or want to capture the same screens repeatedly.
From 21184149e14ea0fde69bde366e8e0b48e8ac9e42 Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sun, 25 Oct 2026 18:19:31 +0100
Subject: [PATCH 11/18] Add MASTG-TOOL-0x01: Document Maestro UI testing
framework
---
tools/generic/MASTG-TOOL-0x01.md | 37 ++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
create mode 100644 tools/generic/MASTG-TOOL-0x01.md
diff --git a/tools/generic/MASTG-TOOL-0x01.md b/tools/generic/MASTG-TOOL-0x01.md
new file mode 100644
index 00000000000..25e4a126a93
--- /dev/null
+++ b/tools/generic/MASTG-TOOL-0x01.md
@@ -0,0 +1,37 @@
+---
+title: Maestro
+platform: generic
+source: https://github.com/mobile-dev-inc/maestro
+hosts: [windows, linux, macOS]
+---
+
+[Maestro](https://github.com/mobile-dev-inc/maestro) is an open-source UI testing framework for Android, iOS, and web apps. You describe interactions, such as tapping elements, entering text, and taking screenshots, in YAML files called flows, and Maestro runs them against the app on a connected device or emulator.
+
+For security testing, Maestro is useful to inspect the UI hierarchy of a screen and to automate repetitive UI interactions, for example, to reach a specific screen before you run other tools.
+
+## Installation
+
+Maestro requires Java 17 or later. Install it with the following command:
+
+```bash
+curl -fsSL "https://get.maestro.mobile.dev" | bash
+```
+
+See the [official documentation](https://docs.maestro.dev/) for other installation options.
+
+## Usage
+
+Print the UI hierarchy of the current screen as JSON:
+
+```bash
+maestro hierarchy
+```
+
+Run a flow:
+
+```bash
+maestro test flow.yaml
+```
+
+!!! note
+ On Android, Maestro reads the UI through the accessibility framework, so the hierarchy only includes the attributes the accessibility framework exposes. See @MASTG-TECH-0x01 for what this method reveals compared to other methods.
From fde73be023d0262ee04ceff25ee781bcbbcd72bd Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sun, 25 Oct 2026 18:19:47 +0100
Subject: [PATCH 12/18] Add MASTG-TOOL-0x02: Document Android CLI tool
---
tools/android/MASTG-TOOL-0x02.md | 41 ++++++++++++++++++++++++++++++++
1 file changed, 41 insertions(+)
create mode 100644 tools/android/MASTG-TOOL-0x02.md
diff --git a/tools/android/MASTG-TOOL-0x02.md b/tools/android/MASTG-TOOL-0x02.md
new file mode 100644
index 00000000000..85cfd60e58d
--- /dev/null
+++ b/tools/android/MASTG-TOOL-0x02.md
@@ -0,0 +1,41 @@
+---
+title: Android CLI
+platform: android
+source: https://developer.android.com/tools/agents/android-cli
+hosts: [windows, linux, macOS]
+---
+
+[Android CLI](https://developer.android.com/tools/agents/android-cli) is a command-line tool from Google that gives scripts, CI pipelines, and coding agents a single interface to Android projects, devices, and emulators. Among other things, it can capture screenshots and return the UI layout of the app running on a connected device or emulator.
+
+## Installation
+
+Follow the instructions on the [official download page](https://developer.android.com/tools/agents/android-cli/download), which provides installers for Linux, macOS, and Windows. For example, on macOS you can install it with Homebrew:
+
+```bash
+brew tap android/tap
+brew install android-cli
+```
+
+Keep it up to date with:
+
+```bash
+android update
+```
+
+## Usage
+
+Capture a screenshot of the connected device:
+
+```bash
+android screen capture --output=screenshot.png
+```
+
+Add `--annotate` to draw labeled bounding boxes around the UI elements detected on the screen.
+
+Return the UI layout of the running app as JSON:
+
+```bash
+android layout --pretty --output=layout.json
+```
+
+See the [Android CLI documentation](https://developer.android.com/tools/agents/android-cli) for all commands and options.
From 3164d4db6991a696bf28c02d5c0873c8cf42d35b Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sun, 25 Oct 2026 18:20:55 +0100
Subject: [PATCH 13/18] Update MASTG-TEST-0x01 and MASTG-TEST-0x02: Align with
writing guidelines and adjust available_since value
---
.../android/MASVS-PLATFORM/MASTG-TEST-0x01.md | 73 +++++++-----------
.../android/MASVS-PLATFORM/MASTG-TEST-0x02.md | 76 +++++++------------
2 files changed, 56 insertions(+), 93 deletions(-)
diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0x01.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0x01.md
index 5f4b3c0cc76..f02347c9851 100644
--- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0x01.md
+++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0x01.md
@@ -1,73 +1,56 @@
---
-title: References to Accessibility Data Sensitivity APIs
platform: android
+title: References to Accessibility Data Sensitivity APIs
id: MASTG-TEST-0x01
-type: [static, manual]
-profiles: [L2]
+apis: [View.setAccessibilityDataSensitive, View.setFilterTouchesWhenObscured, ACCESSIBILITY_DATA_SENSITIVE_YES, ACCESSIBILITY_DATA_SENSITIVE_NO, ACCESSIBILITY_DATA_SENSITIVE_AUTO]
+type: [static, code, manual]
+maswe: [MASWE-0040]
best-practices: [MASTG-BEST-0x01]
-weakness: MASWE-0055
+prerequisites:
+- identify-sensitive-data
knowledge: [MASTG-KNOW-0x01]
-apis: [View, setAccessibilityDataSensitive, filterTouchesWhenObscured]
-available_since: 36
+available_since: 34
---
## Overview
-This test verifies whether an app references Android's accessibility data sensitivity APIs. Starting with Android 16 (API level 36), developers can use the [`accessibilityDataSensitive`](https://developer.android.com/reference/android/view/View#attr_android:accessibilityDataSensitive) attribute to protect sensitive views from malicious accessibility services. When set to `true` on a view, it restricts non-tool accessibility services from reading or interacting with sensitive content.
-
-Developers can apply this protection in two ways:
+Accessibility services can read the content of the views an app displays and perform interactions on them. Malware often tricks users into enabling its accessibility service so it can capture typed credentials or one-time codes, read sensitive data shown on screen, or tap buttons such as payment confirmations on the user's behalf.
-1. **Explicit XML declaration**: Setting `android:accessibilityDataSensitive="true"` in layout files
-2. **Programmatic API**: Calling [`setAccessibilityDataSensitive(int)`](https://developer.android.com/reference/android/view/View#setAccessibilityDataSensitive(int)) with `View.ACCESSIBILITY_DATA_SENSITIVE_YES`
-3. **Implicit via filterTouchesWhenObscured**: Views with `android:filterTouchesWhenObscured="true"` automatically inherit accessibility data sensitivity protection on Android 16+
+On Android 14 (API level 34) and higher, apps can restrict access to sensitive views to accessibility services declared as accessibility tools by marking those views as accessibility data sensitive (@MASTG-KNOW-0x01). If the app doesn't mark the views that display or accept sensitive data, or explicitly disables the protection on them, any enabled accessibility service can access them.
-Common failure modes include:
+This test checks whether the app marks the views that handle sensitive data as accessibility data sensitive, either explicitly or through `filterTouchesWhenObscured`. It looks for:
-- Not marking sensitive views (login fields, payment buttons, personal data forms) with `accessibilityDataSensitive`
-- Inconsistently applying protection across related sensitive screens
-- Explicitly disabling protection on sensitive views by setting `View.ACCESSIBILITY_DATA_SENSITIVE_NO`
-- Not leveraging automatic protection from existing `filterTouchesWhenObscured` flags
+- The `android:accessibilityDataSensitive` and `android:filterTouchesWhenObscured` attributes in layout files.
+- Calls to `setAccessibilityDataSensitive` and the value passed to it.
+- Calls to `setFilterTouchesWhenObscured`.
## Steps
-1. Extract the app's layout XML files from the APK (@MASTG-TECH-0117).
-2. Run a static analysis tool (@MASTG-TECH-0014) to identify:
- - Views with `android:accessibilityDataSensitive` set to `true` or `false`
- - Views with `android:filterTouchesWhenObscured="true"` (which provide implicit protection)
- - Calls to `setAccessibilityDataSensitive()` in decompiled code
- - Calls to `setFilterTouchesWhenObscured()` in decompiled code
-3. Identify sensitive views based on their ID, type, or context (e.g., password fields, payment confirmation buttons).
+1. Use @MASTG-TECH-0013 to reverse engineer the app.
+2. Use @MASTG-TECH-0014 to look for the relevant APIs.
+3. Use @MASTG-TECH-0007 to extract the layout files from the app package.
## Observation
-The output should include:
+The output should contain:
-1. A list of views with `android:accessibilityDataSensitive` explicitly set in XML layouts.
-2. A list of views with `android:filterTouchesWhenObscured="true"` (which gain implicit protection).
-3. A list of programmatic calls to `setAccessibilityDataSensitive()` in the codebase.
-4. A list of programmatic calls to `setFilterTouchesWhenObscured()` in the codebase.
-5. A mapping of identified sensitive views (by ID, type, or context) that should be protected.
+- All `android:accessibilityDataSensitive` and `android:filterTouchesWhenObscured` XML attributes, if using XML for the UI.
+- All calls to `setAccessibilityDataSensitive` and the values passed to it.
+- All calls to `setFilterTouchesWhenObscured` and the values passed to it.
## Evaluation
-The test case fails if sensitive views that handle or display confidential information are not protected by `accessibilityDataSensitive` or `filterTouchesWhenObscured`. Specifically:
+The test case fails if any view that handles sensitive data isn't marked as accessibility data sensitive, either on the view itself or on one of its parents, or if the app sets `ACCESSIBILITY_DATA_SENSITIVE_NO` (or `android:accessibilityDataSensitive="false"`) on such a view.
-- Password fields, PINs, credit card inputs, or other credential fields lack protection
-- Payment confirmation or transaction approval buttons are unprotected
-- Personal information forms (SSN, passport numbers, etc.) are not marked sensitive
-- The app explicitly disables protection on sensitive views using `View.ACCESSIBILITY_DATA_SENSITIVE_NO`
-
-The test passes if:
+**Further Validation Required:**
-- All sensitive views have `android:accessibilityDataSensitive="true"` in XML or call `setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)` programmatically
-- Or, sensitive views use `android:filterTouchesWhenObscured="true"` to gain implicit protection on Android 16+
-- Protection is applied consistently across all screens handling sensitive data
-- No code paths explicitly disable the protection without justification
+Inspect each reported code location using @MASTG-TECH-0023 to determine whether the protected and unprotected views handle sensitive data:
-**Note**: This test is applicable only for apps targeting Android 16 (API level 36) or higher. For apps targeting lower API levels, the attribute is ignored by the system, and alternative protections like `filterTouchesWhenObscured` should be evaluated separately.
+- Determine which views handle sensitive data, such as credentials, one-time codes, payment details, or personal information, based on the app's sensitive data definitions.
+- Determine whether each of these views, or one of its parents, sets `android:accessibilityDataSensitive="true"`, calls `setAccessibilityDataSensitive` with `ACCESSIBILITY_DATA_SENSITIVE_YES`, or sets `filterTouchesWhenObscured` to `true` without setting `ACCESSIBILITY_DATA_SENSITIVE_NO`.
-**Further Validation Required:**
+Static analysis can only show where the protection is configured. Views for which the app doesn't configure anything don't appear in the output at all, even though they're the ones most likely to be missing the protection. To find them statically, you'd need to review every view the app creates in its layout files and code and resolve the values they inherit from their parents. Static analysis also can't reliably determine whether a view displays sensitive data or whether the protection is active at runtime. For these reasons, use the results of this test as a starting point and confirm them with @MASTG-TEST-0x02, which lists every view on a screen together with its effective accessibility data sensitivity.
-Static analysis is a good starting point, but it can only show whether a view is protected. It cannot reliably determine whether the view displays sensitive data, nor whether the protection is effective at runtime. Use the results of this test as a complement and verify them dynamically by following @MASTG-TEST-0x02, navigating the screens that handle or display sensitive data (e.g., login, payment, personal information) and confirming that the corresponding views are protected.
+**Expected False Negatives:**
-Note that, without an auditor physically monitoring the tested screens, there is no obvious mechanism to determine if the displayed information is sensitive in nature. Connecting the testing to an LLM may help, but it may not always capture the screen displaying the data this API is intended to protect.
+This test may produce false negatives if the app builds its UI with frameworks that don't use Android `View` attributes for this purpose (for example, Jetpack Compose, Flutter, or game engines), or if views are created or configured dynamically in ways that static analysis can't resolve, for example, through reflection or values computed at runtime.
diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0x02.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0x02.md
index 0120069f524..b539e718d15 100644
--- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0x02.md
+++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0x02.md
@@ -1,74 +1,54 @@
---
-title: Runtime Verification of Accessibility Data Sensitivity
platform: android
+title: Runtime Verification of Accessibility Data Sensitivity
id: MASTG-TEST-0x02
-type: [dynamic, manual]
-profiles: [L2]
+apis: [View.isAccessibilityDataSensitive, View.setAccessibilityDataSensitive, View.getFilterTouchesWhenObscured, View.setFilterTouchesWhenObscured]
+type: [dynamic, hooks, manual]
+maswe: [MASWE-0040]
best-practices: [MASTG-BEST-0x01]
-weakness: MASWE-0055
+prerequisites:
+- identify-sensitive-data
knowledge: [MASTG-KNOW-0x01]
-apis: [View, getAccessibilityDataSensitive, setAccessibilityDataSensitive, isFilterTouchesWhenObscured]
-available_since: 36
+available_since: 34
---
## Overview
-This test is the dynamic counterpart to @MASTG-TEST-0x01. It verifies that sensitive views in an Android app are properly configured with accessibility data sensitivity protection at runtime.
+This test is the dynamic counterpart to @MASTG-TEST-0x01.
+
+If the views that display or accept sensitive data aren't accessibility data sensitive at runtime, any enabled accessibility service can read their content or perform interactions on them, regardless of how the app's layout files and code appear to configure them. For example, the app may change the setting of a view at runtime, or a view may lose the protection inherited from a parent.
-At runtime, you can inspect view properties to determine:
+This test combines two approaches:
-- Whether `accessibilityDataSensitive` is enabled using [`getAccessibilityDataSensitive()`](https://developer.android.com/reference/android/view/View#getAccessibilityDataSensitive())
-- Whether `filterTouchesWhenObscured` is enabled using [`isFilterTouchesWhenObscured()`](https://developer.android.com/reference/android/view/View#isFilterTouchesWhenObscured()), which provides implicit accessibility protection on Android 16+
-- Whether views handling sensitive data are protected appropriately
+- Hook `setAccessibilityDataSensitive` and `setFilterTouchesWhenObscured` to capture when and where the app changes these settings.
+- Obtain the UI hierarchy of each screen that handles sensitive data, including the effective state of each view as returned by `isAccessibilityDataSensitive` and `getFilterTouchesWhenObscured`. This reveals views that inherit the protection from a parent and views for which the app never configures the protection, which the hooks alone don't show.
-This test focuses on observing the actual runtime configuration of views to ensure protection is active when the app is running.
+Run this test on a device running Android 14 (API level 34) or higher, since the protection isn't available on earlier versions.
## Steps
-1. Install the app on a device running Android 16 (API level 36) or higher (@MASTG-TECH-0005).
-2. Use a dynamic analysis tool like @MASTG-TOOL-0031 (Frida) to:
- - Enumerate all active View instances in the app's UI hierarchy
- - For each view, call `getAccessibilityDataSensitive()` to check the current sensitivity setting
- - For each view, call `isFilterTouchesWhenObscured()` to check if implicit protection is enabled
- - Identify views by their resource ID, type, and context to determine if they handle sensitive data
-3. Navigate through sensitive screens in the app (login, payment, personal information forms) and collect runtime view configurations.
+1. Use @MASTG-TECH-0005 to install the app.
+2. Use @MASTG-TECH-0043 to hook the relevant API calls.
+3. Exercise the app extensively to trigger as many flows as possible and enter sensitive data wherever you can.
+4. Use @MASTG-TECH-0x01 to obtain the UI hierarchy of each screen that handles sensitive data, including the effective accessibility data sensitivity of each view.
+5. Use @MASTG-TECH-0x02 to take a screenshot of each screen that handles sensitive data.
## Observation
-The output should include:
+The output should contain:
-1. A list of all View instances found in the app's UI hierarchy with their:
- - Resource ID (e.g., `@id/passwordField`)
- - View type (e.g., `EditText`, `Button`)
- - `accessibilityDataSensitive` setting (from `getAccessibilityDataSensitive()`)
- - `filterTouchesWhenObscured` setting (from `isFilterTouchesWhenObscured()`)
-2. A classification of views as sensitive or non-sensitive based on their ID, type, and context.
-3. Any views where sensitivity settings change during app execution (e.g., via programmatic calls to `setAccessibilityDataSensitive()`).
+- The calls to `setAccessibilityDataSensitive` and `setFilterTouchesWhenObscured` with their argument values and backtraces.
+- The UI hierarchy of each screen that handles sensitive data, including the class, resource ID, and hint or text of each view, and the values returned by `isAccessibilityDataSensitive` and `getFilterTouchesWhenObscured`.
+- A screenshot of each screen that handles sensitive data.
## Evaluation
-The test case fails if sensitive views are not properly protected at runtime:
-
-- Password fields, PIN inputs, or credential entry views have `ACCESSIBILITY_DATA_SENSITIVE_NO` or `ACCESSIBILITY_DATA_SENSITIVE_AUTO` without implicit protection from `filterTouchesWhenObscured`
-- Payment confirmation buttons, transaction approval actions lack accessibility sensitivity protection
-- Personal information forms (SSN, credit card details) are not marked as sensitive
-- Protection is inconsistently applied across related sensitive screens
-
-The test passes if:
-
-- All sensitive views return `View.ACCESSIBILITY_DATA_SENSITIVE_YES` from `getAccessibilityDataSensitive()`
-- Or, sensitive views return `true` from `isFilterTouchesWhenObscured()`, providing implicit accessibility protection on Android 16+
-- Protection is active and consistent across all screens handling sensitive data during runtime navigation
-- No runtime code paths dynamically disable the protection on sensitive views without justification
-
-**Note**: Views with `ACCESSIBILITY_DATA_SENSITIVE_AUTO` may inherit protection from parent views or from `filterTouchesWhenObscured`. Verify the effective protection by checking both the view and its parent hierarchy.
-
-**Additional Guidance**:
-
-If the app dynamically creates views or modifies their sensitivity settings at runtime, use method tracing or hooks to capture calls to `setAccessibilityDataSensitive()` and `setFilterTouchesWhenObscured()` to understand when and why protection is applied or removed. See @MASTG-TECH-0033 for method tracing techniques.
+The test case fails if any view that handles sensitive data returns `false` from `isAccessibilityDataSensitive`.
**Further Validation Required:**
-Runtime inspection of view properties shows whether a view is protected, but it cannot reliably determine whether the view displays sensitive data. Without an auditor physically monitoring the tested screens, there is no obvious mechanism to tell if the information shown is sensitive in nature. Manually navigate through the screens that handle or display sensitive data (e.g., login, payment, personal information) and verify that the corresponding views are protected.
+Inspect the screenshots of the screens that handle sensitive data to determine which views display or accept sensitive information, such as credentials, one-time codes, payment details, or personal information. Match these views with the UI hierarchy of the same screen to determine whether they're protected.
+
+Using the backtraces from the hook output, inspect the code locations using @MASTG-TECH-0023 to determine whether the app disables the protection on sensitive views, for example, by calling `setAccessibilityDataSensitive` with `ACCESSIBILITY_DATA_SENSITIVE_NO`.
-If the automated testing is connected to an LLM to classify what is displayed, note that it may not always capture the screen displaying the data this API is intended to protect, so the result still needs to be confirmed manually.
+Without a tester monitoring the screens, there's no reliable way to determine whether the displayed information is sensitive. Automated classification, for example with an LLM, can help, but it may miss the screens that display the data this API is intended to protect, so you must confirm the results manually.
From de70df6745a4ba2e64d06e5597872e17ebde1fe6 Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sun, 25 Oct 2026 18:21:18 +0100
Subject: [PATCH 14/18] Refactor accessibility data sensitivity rules:
streamline XML patterns and enhance detection messages
---
...-android-accessibility-data-sensitive.yaml | 90 ++++++-------------
1 file changed, 26 insertions(+), 64 deletions(-)
diff --git a/rules/mastg-android-accessibility-data-sensitive.yaml b/rules/mastg-android-accessibility-data-sensitive.yaml
index ce6961e6d2a..15940ebdca6 100644
--- a/rules/mastg-android-accessibility-data-sensitive.yaml
+++ b/rules/mastg-android-accessibility-data-sensitive.yaml
@@ -1,88 +1,50 @@
rules:
- - id: mastg-android-accessibility-data-sensitive-xml
- severity: INFO
- languages:
- - xml
- metadata:
- summary: Views with accessibilityDataSensitive attribute in XML layouts
- message: "[MASVS-PLATFORM] View has accessibilityDataSensitive attribute set"
- patterns:
- - pattern: <$VIEW ... android:accessibilityDataSensitive="$VALUE" ...>
- - focus-metavariable: $VALUE
-
- - id: mastg-android-filter-touches-when-obscured-xml
- severity: INFO
- languages:
- - xml
- metadata:
- summary: Views with filterTouchesWhenObscured providing implicit accessibility protection
- message: "[MASVS-PLATFORM] View has filterTouchesWhenObscured set (provides implicit accessibilityDataSensitive protection on Android 16+)"
- patterns:
- - pattern: <$VIEW ... android:filterTouchesWhenObscured="true" ...>
-
- - id: mastg-android-set-accessibility-data-sensitive
+ - id: mastg-android-accessibility-data-sensitive-set
severity: INFO
languages:
- java
metadata:
- summary: Programmatic use of setAccessibilityDataSensitive method
- message: "[MASVS-PLATFORM] View's accessibility data sensitivity is being set programmatically"
- pattern-either:
+ summary: Detects calls to setAccessibilityDataSensitive that mark views as sensitive or keep the automatic behavior (0 = ACCESSIBILITY_DATA_SENSITIVE_AUTO, 1 = ACCESSIBILITY_DATA_SENSITIVE_YES).
+ message: "[MASVS-PLATFORM-3] setAccessibilityDataSensitive is used to configure the accessibility data sensitivity of a view"
+ patterns:
- pattern: $VIEW.setAccessibilityDataSensitive($VALUE)
+ - pattern-not: $VIEW.setAccessibilityDataSensitive(2)
+ - pattern-not: $VIEW.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_NO)
- - id: mastg-android-get-accessibility-data-sensitive
- severity: INFO
+ - id: mastg-android-accessibility-data-sensitive-disabled
+ severity: WARNING
languages:
- java
metadata:
- summary: Checking accessibility data sensitivity at runtime
- message: "[MASVS-PLATFORM] Code is checking view's accessibility data sensitivity"
+ summary: Detects calls to setAccessibilityDataSensitive with ACCESSIBILITY_DATA_SENSITIVE_NO (2), which disables the protection for a view, including protection inherited from its parents.
+ message: "[MASVS-PLATFORM-3] setAccessibilityDataSensitive is used to explicitly disable the accessibility data sensitivity of a view"
pattern-either:
- - pattern: $VIEW.getAccessibilityDataSensitive()
+ - pattern: $VIEW.setAccessibilityDataSensitive(2)
+ - pattern: $VIEW.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_NO)
- - id: mastg-android-set-filter-touches-when-obscured
+ - id: mastg-android-accessibility-data-sensitive-filter-touches
severity: INFO
languages:
- java
metadata:
- summary: Programmatic use of setFilterTouchesWhenObscured method
- message: "[MASVS-PLATFORM] View's filterTouchesWhenObscured is being set (provides implicit accessibility protection on Android 16+)"
- pattern-either:
- - pattern: $VIEW.setFilterTouchesWhenObscured($VALUE)
+ summary: Detects calls to setFilterTouchesWhenObscured, which implies accessibility data sensitivity for views using ACCESSIBILITY_DATA_SENSITIVE_AUTO.
+ message: "[MASVS-PLATFORM-3] setFilterTouchesWhenObscured is used, which implies accessibility data sensitivity unless the view sets ACCESSIBILITY_DATA_SENSITIVE_NO"
+ pattern: $VIEW.setFilterTouchesWhenObscured(...)
- - id: mastg-android-is-filter-touches-when-obscured
+ - id: mastg-android-accessibility-data-sensitive-xml-attribute
severity: INFO
languages:
- - java
+ - xml
metadata:
- summary: Checking filterTouchesWhenObscured at runtime
- message: "[MASVS-PLATFORM] Code is checking view's filterTouchesWhenObscured state"
- pattern-either:
- - pattern: $VIEW.isFilterTouchesWhenObscured()
+ summary: Detects the android:accessibilityDataSensitive attribute in layout XML files.
+ message: "[MASVS-PLATFORM-3] android:accessibilityDataSensitive is set to $VALUE"
+ pattern: android:accessibilityDataSensitive="$VALUE"
- - id: mastg-android-sensitive-view-without-protection
- severity: WARNING
+ - id: mastg-android-accessibility-data-sensitive-xml-filter-touches
+ severity: INFO
languages:
- xml
metadata:
- summary: Potentially sensitive input fields without accessibility or overlay protection
- message: "[MASVS-PLATFORM] Potentially sensitive view lacks accessibilityDataSensitive or filterTouchesWhenObscured protection"
- patterns:
- - pattern-either:
- - pattern: |
-
- - pattern: |
-
- - pattern: |
-
- - pattern-not: <... android:accessibilityDataSensitive="true" ...>
- - pattern-not: <... android:filterTouchesWhenObscured="true" ...>
+ summary: Detects the android:filterTouchesWhenObscured attribute in layout XML files, which implies accessibility data sensitivity.
+ message: "[MASVS-PLATFORM-3] android:filterTouchesWhenObscured is set to true, which implies accessibility data sensitivity unless the view sets android:accessibilityDataSensitive to false"
+ pattern: android:filterTouchesWhenObscured="true"
From 597b9c7cdaba85b02d30e4a4cf07676d330673cf Mon Sep 17 00:00:00 2001
From: Carlos Holguera
Date: Sun, 25 Oct 2026 18:22:06 +0100
Subject: [PATCH 15/18] Update MASTG-DEMO-0x01 to use programmatic view
configurations and remove XML layout
---
.../MASTG-DEMO-0x01/MASTG-DEMO-0x01.md | 69 ++++----
.../MASTG-DEMO-0x01/MastgTest.kt | 138 +++++++++++++---
.../MASTG-DEMO-0x01/MastgTest_reversed.java | 155 ++++++++++++++++++
.../MASTG-DEMO-0x01/activity_login.xml | 51 ------
.../MASVS-PLATFORM/MASTG-DEMO-0x01/output.txt | 83 ++++------
.../MASVS-PLATFORM/MASTG-DEMO-0x01/run.sh | 12 +-
6 files changed, 331 insertions(+), 177 deletions(-)
create mode 100644 demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest_reversed.java
delete mode 100644 demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/activity_login.xml
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MASTG-DEMO-0x01.md b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MASTG-DEMO-0x01.md
index 9a242bbe31b..2d9b942fdb3 100644
--- a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MASTG-DEMO-0x01.md
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MASTG-DEMO-0x01.md
@@ -1,37 +1,30 @@
---
platform: android
-title: Detecting Accessibility Data Sensitivity in Layouts with semgrep
+title: Sensitive Views Without Accessibility Data Sensitivity
id: MASTG-DEMO-0x01
-code: [xml, kotlin]
+code: [kotlin]
test: MASTG-TEST-0x01
---
## Sample
-This sample demonstrates how to detect the use of `accessibilityDataSensitive` and `filterTouchesWhenObscured` attributes in Android layout files using Semgrep. The sample includes both properly protected views and views that lack protection.
+The sample creates a login and payment form with views that handle sensitive data, each using a different accessibility data sensitivity configuration. It does so by using Kotlin and the Android `View` APIs (instead of Android layout XML).
-{{ activity_login.xml # MastgTest.kt }}
+1. **Username field:** isn't marked as accessibility data sensitive.
+2. **Password field:** is explicitly marked as accessibility data sensitive using `setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)`.
+3. **One-time code field:** sets `filterTouchesWhenObscured`, which implies accessibility data sensitivity.
+4. **Payment container:** a `LinearLayout` that is explicitly marked as accessibility data sensitive using `setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)`. It contains two views:
+ - **Card number field:** keeps the default value, `ACCESSIBILITY_DATA_SENSITIVE_AUTO`, so it inherits the protection from the payment container.
+ - **Confirm Payment button:** explicitly disables the protection using `setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_NO)`, which overrides the value inherited from the payment container.
+5. **Cancel button:** is outside the payment container and keeps the default value, `ACCESSIBILITY_DATA_SENSITIVE_AUTO`. It doesn't handle sensitive data, so it isn't protected.
-### activity_login.xml
+When you tap **Start**, the app shows the form at the bottom of the screen and lists the value returned by `isAccessibilityDataSensitive` for each view. Tapping **Confirm Payment** or **Cancel** closes the form and shows a confirmation message.
-The layout file contains several EditText fields for user credentials:
-
-1. `usernameField` - Has no protection (neither `accessibilityDataSensitive` nor `filterTouchesWhenObscured`)
-2. `passwordField` - Protected with `android:accessibilityDataSensitive="true"`
-3. `pinField` - Protected with `android:filterTouchesWhenObscured="true"` (which provides implicit accessibility protection on Android 16+)
-4. `creditCardField` - Protected with both `android:accessibilityDataSensitive="true"` and `android:filterTouchesWhenObscured="true"`
-
-### MastgTest.kt
-
-The Kotlin code demonstrates programmatic configuration of accessibility data sensitivity:
-
-1. Sets `accessibilityDataSensitive` on a button using the View API
-2. Checks the current state of `accessibilityDataSensitive` on views
-3. Sets `filterTouchesWhenObscured` which provides implicit protection
+{{ MastgTest.kt # MastgTest_reversed.java }}
## Steps
-Let's run our @MASTG-TOOL-0110 rule against the layout file and decompiled code.
+Let's run our @MASTG-TOOL-0110 rule against the reverse-engineered code.
{{ ../../../../rules/mastg-android-accessibility-data-sensitive.yaml }}
@@ -39,34 +32,28 @@ Let's run our @MASTG-TOOL-0110 rule against the layout file and decompiled code.
## Observation
-The rule has identified:
-
-1. Views with explicit `accessibilityDataSensitive` attributes in XML
-2. Views with `filterTouchesWhenObscured` which provide implicit accessibility protection
-3. Programmatic calls to set or check accessibility data sensitivity
-4. Potentially sensitive input fields that lack any protection
+The rule reports the calls to `setAccessibilityDataSensitive` and `setFilterTouchesWhenObscured` in the reverse-engineered code. In the decompiled code, the constants appear as their integer values: `1` for `ACCESSIBILITY_DATA_SENSITIVE_YES` and `2` for `ACCESSIBILITY_DATA_SENSITIVE_NO`.
{{ output.txt }}
-## Evaluation
+- Line 64: the password field calls `setAccessibilityDataSensitive(1)`.
+- Line 67: the one-time code field calls `setFilterTouchesWhenObscured(true)`.
+- Line 71: the payment container calls `setAccessibilityDataSensitive(1)`.
+- Line 82: the **Confirm Payment** button calls `setAccessibilityDataSensitive(2)`.
-Based on the Semgrep output:
+## Evaluation
-**Failures (views lacking protection):**
+The test case fails because two views that handle sensitive data aren't accessibility data sensitive:
-- `usernameField` (line 12 in activity_login.xml): An EditText for username input lacks both `accessibilityDataSensitive` and `filterTouchesWhenObscured` protection. While usernames may be less sensitive than passwords, credential fields should generally be protected.
+- The username field (line 61) doesn't appear in the output because the app doesn't configure any protection for it.
+- The **Confirm Payment** button (line 82) is reported by the `mastg-android-accessibility-data-sensitive-disabled` rule because the app calls `setAccessibilityDataSensitive(2)` on it, which overrides the protection inherited from the payment container.
-**Passes (properly protected views):**
+The remaining views are protected:
-- `passwordField` (line 23): Protected with `android:accessibilityDataSensitive="true"` - malicious accessibility services cannot read password input
-- `pinField` (line 34): Protected with `android:filterTouchesWhenObscured="true"` - gains implicit accessibility protection on Android 16+ while also preventing tapjacking
-- `creditCardField` (line 45): Protected with both attributes - defense in depth approach
-- `confirmButton` (line 18 in MastgTest.kt): Programmatically sets `ACCESSIBILITY_DATA_SENSITIVE_YES` for a payment confirmation button
-- Runtime checks (lines 22-23): The code properly checks current sensitivity settings
+- The password field (line 64) is explicitly marked as accessibility data sensitive.
+- The one-time code field (line 67) sets `filterTouchesWhenObscured` and keeps the default `ACCESSIBILITY_DATA_SENSITIVE_AUTO` value, so it's treated as accessibility data sensitive.
+- The card number field (line 72) doesn't appear in the output, but the payment container (line 71) is marked as accessibility data sensitive and the field keeps the default value, so it inherits the protection.
-**Recommendations:**
+Note that the output only lists the views for which the app configures the protection. Views without any configuration, such as the username field (line 61) and the **Cancel** button (line 85), don't appear, so you have to find them by reviewing the reverse-engineered code. This is manageable in a small sample but hard in a real app. @MASTG-DEMO-0x02 shows how enumerating the views at runtime lists every view on the screen, including these, together with its effective value.
-1. Add `android:accessibilityDataSensitive="true"` or `android:filterTouchesWhenObscured="true"` to `usernameField`
-2. Consider using `filterTouchesWhenObscured` on all credential fields for broader protection across Android versions
-3. Review all payment and transaction confirmation buttons to ensure they are protected programmatically or in XML
-4. Test with legitimate accessibility tools (TalkBack, Voice Access) to ensure protected views remain accessible when needed
+When you tap **Start**, the app confirms these results at runtime by listing the value returned by `isAccessibilityDataSensitive` for each view: `false` for the username field and the **Confirm Payment** button, and `true` for the other fields.
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest.kt b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest.kt
index e03447d5546..3555681d201 100644
--- a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest.kt
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest.kt
@@ -1,35 +1,131 @@
package org.owasp.mastestapp
-import android.os.Bundle
+import android.app.Activity
+import android.content.Context
+import android.graphics.Color
+import android.os.Build
+import android.text.InputType
+import android.util.Log
+import android.view.Gravity
import android.view.View
+import android.view.ViewGroup
+import android.view.WindowInsets
import android.widget.Button
import android.widget.EditText
-import androidx.appcompat.app.AppCompatActivity
+import android.widget.FrameLayout
+import android.widget.LinearLayout
+import android.widget.Toast
-// SUMMARY: This sample demonstrates programmatic configuration of accessibility data sensitivity in Android.
+// SUMMARY: This sample demonstrates views that handle sensitive data with and without accessibility data sensitivity,
+// set explicitly, inherited from a parent, implied by filterTouchesWhenObscured, or explicitly disabled.
-class MastgTest : AppCompatActivity() {
+class MastgTest(private val context: Context) {
- override fun onCreate(savedInstanceState: Bundle?) {
- super.onCreate(savedInstanceState)
- setContentView(R.layout.activity_login)
+ val shouldRunInMainThread = true
- // PASS: [MASTG-TEST-0x01] Programmatically set accessibility data sensitivity on a button
- val confirmButton = findViewById(R.id.loginButton)
- confirmButton.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)
+ private val formTag = "mastg-demo-form"
- // Check current sensitivity settings
- val passwordField = findViewById(R.id.passwordField)
- val isDataSensitive = passwordField.accessibilityDataSensitive
- val isFilteringTouches = passwordField.isFilterTouchesWhenObscured
+ fun mastgTest(): String {
+ val r = DemoResults("0x01")
- // PASS: [MASTG-TEST-0x01] Programmatically set filterTouchesWhenObscured for additional protection
- val usernameField = findViewById(R.id.usernameField)
- usernameField.setFilterTouchesWhenObscured(true)
+ if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+ r.add(Status.ERROR, "Accessibility data sensitivity requires Android 14 (API level 34) or higher.")
+ return r.toJson()
+ }
- // Example: Conditionally disable protection (should be avoided for sensitive views)
- // FAIL: [MASTG-TEST-0x01] Never explicitly disable protection on sensitive views
- // val creditCardField = findViewById(R.id.creditCardField)
- // creditCardField.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_NO)
+ val form = LinearLayout(context).apply {
+ tag = formTag
+ orientation = LinearLayout.VERTICAL
+ setBackgroundColor(Color.rgb(48, 48, 48))
+ setOnApplyWindowInsetsListener { view, insets ->
+ val bottom = insets.getInsets(WindowInsets.Type.systemBars() or WindowInsets.Type.ime()).bottom
+ view.setPadding(48, 32, 48, 32 + bottom)
+ insets
+ }
+ }
+
+ // FAIL: [MASTG-TEST-0x01] The username field handles credentials but isn't marked as accessibility data sensitive.
+ val usernameField = createField("Username", InputType.TYPE_CLASS_TEXT)
+ form.addView(usernameField)
+
+ // PASS: [MASTG-TEST-0x01] The password field is explicitly marked as accessibility data sensitive.
+ val passwordField = createField("Password", InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD)
+ passwordField.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)
+ form.addView(passwordField)
+
+ // PASS: [MASTG-TEST-0x01] The one-time code field uses filterTouchesWhenObscured, which implies accessibility data sensitivity.
+ val otpField = createField("One-time code", InputType.TYPE_CLASS_NUMBER or InputType.TYPE_NUMBER_VARIATION_PASSWORD)
+ otpField.filterTouchesWhenObscured = true
+ form.addView(otpField)
+
+ // PASS: [MASTG-TEST-0x01] The payment container is marked as accessibility data sensitive, so its children inherit the protection.
+ val paymentContainer = LinearLayout(context).apply {
+ orientation = LinearLayout.VERTICAL
+ }
+ paymentContainer.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)
+
+ val cardField = createField("Card number", InputType.TYPE_CLASS_NUMBER)
+ paymentContainer.addView(cardField)
+
+ // FAIL: [MASTG-TEST-0x01] The payment confirmation button explicitly disables the protection inherited from its parent.
+ val confirmButton = Button(context).apply {
+ text = "Confirm Payment"
+ setOnClickListener { closeForm(form, "Payment confirmed.") }
+ }
+ confirmButton.setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_NO)
+ paymentContainer.addView(confirmButton)
+
+ form.addView(paymentContainer)
+
+ val cancelButton = Button(context).apply {
+ text = "Cancel"
+ setOnClickListener { closeForm(form, "Payment cancelled.") }
+ }
+ form.addView(cancelButton)
+
+ (context as? Activity)?.let { activity ->
+ val root = activity.findViewById(android.R.id.content)
+ root.findViewWithTag(formTag)?.let { root.removeView(it) }
+ root.addView(
+ form,
+ FrameLayout.LayoutParams(
+ FrameLayout.LayoutParams.MATCH_PARENT,
+ FrameLayout.LayoutParams.WRAP_CONTENT,
+ Gravity.BOTTOM
+ )
+ )
+ form.requestApplyInsets()
+ }
+
+ listOf(
+ "Username field" to usernameField,
+ "Password field" to passwordField,
+ "One-time code field" to otpField,
+ "Card number field" to cardField,
+ "Confirm Payment button" to confirmButton
+ ).forEach { (name, view) ->
+ val sensitive = view.isAccessibilityDataSensitive()
+ r.add(
+ if (sensitive) Status.PASS else Status.FAIL,
+ "$name: isAccessibilityDataSensitive=$sensitive"
+ )
+ }
+
+ return r.toJson()
+ }
+
+ private fun closeForm(form: View, message: String) {
+ (form.parent as? ViewGroup)?.removeView(form)
+ Log.i("MASTG-DEMO", message)
+ Toast.makeText(context, message, Toast.LENGTH_SHORT).show()
+ }
+
+ private fun createField(hintText: String, type: Int): EditText {
+ return EditText(context).apply {
+ hint = hintText
+ inputType = type
+ setTextColor(Color.WHITE)
+ setHintTextColor(Color.LTGRAY)
+ }
}
}
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest_reversed.java b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest_reversed.java
new file mode 100644
index 00000000000..70965ceef69
--- /dev/null
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/MastgTest_reversed.java
@@ -0,0 +1,155 @@
+package org.owasp.mastestapp;
+
+import android.app.Activity;
+import android.content.Context;
+import android.graphics.Color;
+import android.os.Build;
+import android.util.Log;
+import android.view.View;
+import android.view.ViewGroup;
+import android.view.ViewParent;
+import android.view.WindowInsets;
+import android.widget.Button;
+import android.widget.EditText;
+import android.widget.FrameLayout;
+import android.widget.LinearLayout;
+import android.widget.TextView;
+import android.widget.Toast;
+import androidx.savedstate.serialization.ClassDiscriminatorModeKt;
+import kotlin.Metadata;
+import kotlin.Pair;
+import kotlin.TuplesKt;
+import kotlin.collections.CollectionsKt;
+import kotlin.jvm.internal.Intrinsics;
+
+/* JADX INFO: compiled from: MastgTest.kt */
+/* JADX INFO: loaded from: classes3.dex */
+@Metadata(d1 = {"\u0000D\n\u0002\u0018\u0002\n\u0002\u0010\u0000\n\u0000\n\u0002\u0018\u0002\n\u0002\b\u0003\n\u0002\u0010\u000b\n\u0002\b\u0003\n\u0002\u0010\u000e\n\u0002\b\u0002\n\u0002\u0010\u0002\n\u0000\n\u0002\u0018\u0002\n\u0002\b\u0002\n\u0002\u0018\u0002\n\u0002\b\u0002\n\u0002\u0010\b\n\u0000\n\u0002\u0018\u0002\n\u0000\b\u0007\u0018\u00002\u00020\u0001B\u000f\u0012\u0006\u0010\u0002\u001a\u00020\u0003¢\u0006\u0004\b\u0004\u0010\u0005J\u0006\u0010\f\u001a\u00020\u000bJ\u0018\u0010\r\u001a\u00020\u000e2\u0006\u0010\u000f\u001a\u00020\u00102\u0006\u0010\u0011\u001a\u00020\u000bH\u0002J\u0018\u0010\u0012\u001a\u00020\u00132\u0006\u0010\u0014\u001a\u00020\u000b2\u0006\u0010\u0015\u001a\u00020\u0016H\u0002R\u000e\u0010\u0002\u001a\u00020\u0003X\u0082\u0004¢\u0006\u0002\n\u0000R\u0014\u0010\u0006\u001a\u00020\u0007X\u0086D¢\u0006\b\n\u0000\u001a\u0004\b\b\u0010\tR\u000e\u0010\n\u001a\u00020\u000bX\u0082D¢\u0006\u0002\n\u0000Ê\u0001\f\b\u0018\u0012\b\b\u0019\u0012\u0004\b\u0003\u0010\u0000¨\u0006\u0017"}, d2 = {"Lorg/owasp/mastestapp/MastgTest;", "", "context", "Landroid/content/Context;", "", "(Landroid/content/Context;)V", "shouldRunInMainThread", "", "getShouldRunInMainThread", "()Z", "formTag", "", "mastgTest", "closeForm", "", "form", "Landroid/view/View;", "message", "createField", "Landroid/widget/EditText;", "hintText", ClassDiscriminatorModeKt.CLASS_DISCRIMINATOR_KEY, "", "app", "Landroidx/compose/runtime/internal/StabilityInferred;", "parameters"}, k = 1, mv = {2, 4, 0}, xi = 48)
+public final class MastgTest {
+ public static final int $stable = 8;
+ private final Context context;
+ private final String formTag;
+ private final boolean shouldRunInMainThread;
+
+ public MastgTest(Context context) {
+ Intrinsics.checkNotNullParameter(context, "context");
+ this.context = context;
+ this.shouldRunInMainThread = true;
+ this.formTag = "mastg-demo-form";
+ }
+
+ public final boolean getShouldRunInMainThread() {
+ return this.shouldRunInMainThread;
+ }
+
+ public final String mastgTest() {
+ DemoResults r = new DemoResults("0x01");
+ if (Build.VERSION.SDK_INT < 34) {
+ r.add(Status.ERROR, "Accessibility data sensitivity requires Android 14 (API level 34) or higher.");
+ return r.toJson();
+ }
+ final LinearLayout form = new LinearLayout(this.context);
+ form.setTag(this.formTag);
+ form.setOrientation(1);
+ form.setBackgroundColor(Color.rgb(48, 48, 48));
+ form.setOnApplyWindowInsetsListener(new View.OnApplyWindowInsetsListener() { // from class: org.owasp.mastestapp.MastgTest$$ExternalSyntheticLambda0
+ @Override // android.view.View.OnApplyWindowInsetsListener
+ public final WindowInsets onApplyWindowInsets(View view, WindowInsets windowInsets) {
+ return MastgTest.mastgTest$lambda$0$0(view, windowInsets);
+ }
+ });
+ EditText usernameField = createField("Username", 1);
+ form.addView(usernameField);
+ EditText passwordField = createField("Password", 129);
+ passwordField.setAccessibilityDataSensitive(1);
+ form.addView(passwordField);
+ EditText otpField = createField("One-time code", 18);
+ otpField.setFilterTouchesWhenObscured(true);
+ form.addView(otpField);
+ LinearLayout paymentContainer = new LinearLayout(this.context);
+ paymentContainer.setOrientation(1);
+ paymentContainer.setAccessibilityDataSensitive(1);
+ EditText cardField = createField("Card number", 2);
+ paymentContainer.addView(cardField);
+ Button confirmButton = new Button(this.context);
+ confirmButton.setText("Confirm Payment");
+ confirmButton.setOnClickListener(new View.OnClickListener() { // from class: org.owasp.mastestapp.MastgTest$$ExternalSyntheticLambda1
+ @Override // android.view.View.OnClickListener
+ public final void onClick(View view) {
+ MastgTest.mastgTest$lambda$2$0(this.f$0, form, view);
+ }
+ });
+ confirmButton.setAccessibilityDataSensitive(2);
+ paymentContainer.addView(confirmButton);
+ form.addView(paymentContainer);
+ Button button = new Button(this.context);
+ button.setText("Cancel");
+ button.setOnClickListener(new View.OnClickListener() { // from class: org.owasp.mastestapp.MastgTest$$ExternalSyntheticLambda2
+ @Override // android.view.View.OnClickListener
+ public final void onClick(View view) {
+ MastgTest.mastgTest$lambda$3$0(this.f$0, form, view);
+ }
+ });
+ form.addView(button);
+ Context context = this.context;
+ Activity activity = context instanceof Activity ? (Activity) context : null;
+ if (activity != null) {
+ ViewGroup viewGroup = (ViewGroup) activity.findViewById(android.R.id.content);
+ View viewFindViewWithTag = viewGroup.findViewWithTag(this.formTag);
+ if (viewFindViewWithTag != null) {
+ viewGroup.removeView(viewFindViewWithTag);
+ }
+ viewGroup.addView(form, new FrameLayout.LayoutParams(-1, -2, 80));
+ form.requestApplyInsets();
+ }
+ Iterable iterableListOf = CollectionsKt.listOf((Object[]) new Pair[]{TuplesKt.to("Username field", usernameField), TuplesKt.to("Password field", passwordField), TuplesKt.to("One-time code field", otpField), TuplesKt.to("Card number field", cardField), TuplesKt.to("Confirm Payment button", confirmButton)});
+ int i = 0;
+ for (Pair pair : iterableListOf) {
+ String str = (String) pair.component1();
+ boolean zIsAccessibilityDataSensitive = ((TextView) pair.component2()).isAccessibilityDataSensitive();
+ r.add(zIsAccessibilityDataSensitive ? Status.PASS : Status.FAIL, str + ": isAccessibilityDataSensitive=" + zIsAccessibilityDataSensitive);
+ i = i;
+ iterableListOf = iterableListOf;
+ usernameField = usernameField;
+ }
+ return r.toJson();
+ }
+
+ /* JADX INFO: Access modifiers changed from: private */
+ public static final WindowInsets mastgTest$lambda$0$0(View view, WindowInsets insets) {
+ Intrinsics.checkNotNullParameter(view, "view");
+ Intrinsics.checkNotNullParameter(insets, "insets");
+ int bottom = insets.getInsets(WindowInsets.Type.systemBars() | WindowInsets.Type.ime()).bottom;
+ view.setPadding(48, 32, 48, bottom + 32);
+ return insets;
+ }
+
+ /* JADX INFO: Access modifiers changed from: private */
+ public static final void mastgTest$lambda$2$0(MastgTest this$0, LinearLayout $form, View it) {
+ this$0.closeForm($form, "Payment confirmed.");
+ }
+
+ /* JADX INFO: Access modifiers changed from: private */
+ public static final void mastgTest$lambda$3$0(MastgTest this$0, LinearLayout $form, View it) {
+ this$0.closeForm($form, "Payment cancelled.");
+ }
+
+ private final void closeForm(View form, String message) {
+ ViewParent parent = form.getParent();
+ ViewGroup viewGroup = parent instanceof ViewGroup ? (ViewGroup) parent : null;
+ if (viewGroup != null) {
+ viewGroup.removeView(form);
+ }
+ Log.i("MASTG-DEMO", message);
+ Toast.makeText(this.context, message, 0).show();
+ }
+
+ private final EditText createField(String hintText, int type) {
+ EditText editText = new EditText(this.context);
+ editText.setHint(hintText);
+ editText.setInputType(type);
+ editText.setTextColor(-1);
+ editText.setHintTextColor(-3355444);
+ return editText;
+ }
+}
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/activity_login.xml b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/activity_login.xml
deleted file mode 100644
index cf4fc3f3dca..00000000000
--- a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/activity_login.xml
+++ /dev/null
@@ -1,51 +0,0 @@
-
-
-
-
-
-
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/output.txt b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/output.txt
index 7153d039763..7727d549094 100644
--- a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/output.txt
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x01/output.txt
@@ -1,60 +1,35 @@
-=== Scanning XML Layout ===
+
+
┌─────────────────┐
-│ 6 Code Findings │
+│ 4 Code Findings │
└─────────────────┘
-
- activity_login.xml
- ❯❱ rules.mastg-android-sensitive-view-without-protection
- [MASVS-PLATFORM] Potentially sensitive view lacks accessibilityDataSensitive or
- filterTouchesWhenObscured protection
-
- 18┆
Date: Sun, 25 Oct 2026 18:28:11 +0100
Subject: [PATCH 16/18] Add MASTG-DEMO-0x02: Implement runtime accessibility
data sensitivity demo with Frida
---
.../MASTG-DEMO-0x02/MASTG-DEMO-0x02.md | 75 ++++++++++++++++++
.../MASTG-DEMO-0x02/MastgTest.kt | 1 +
.../MASVS-PLATFORM/MASTG-DEMO-0x02/output.txt | 54 +++++++++++++
.../MASVS-PLATFORM/MASTG-DEMO-0x02/run.sh | 4 +
.../MASTG-DEMO-0x02/screenshot.png | Bin 0 -> 226178 bytes
5 files changed, 134 insertions(+)
create mode 100644 demos/android/MASVS-PLATFORM/MASTG-DEMO-0x02/MASTG-DEMO-0x02.md
create mode 120000 demos/android/MASVS-PLATFORM/MASTG-DEMO-0x02/MastgTest.kt
create mode 100644 demos/android/MASVS-PLATFORM/MASTG-DEMO-0x02/output.txt
create mode 100755 demos/android/MASVS-PLATFORM/MASTG-DEMO-0x02/run.sh
create mode 100644 demos/android/MASVS-PLATFORM/MASTG-DEMO-0x02/screenshot.png
diff --git a/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x02/MASTG-DEMO-0x02.md b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x02/MASTG-DEMO-0x02.md
new file mode 100644
index 00000000000..0017acfda62
--- /dev/null
+++ b/demos/android/MASVS-PLATFORM/MASTG-DEMO-0x02/MASTG-DEMO-0x02.md
@@ -0,0 +1,75 @@
+---
+platform: android
+title: Runtime Accessibility Data Sensitivity of Sensitive Views with Frida
+id: MASTG-DEMO-0x02
+code: [kotlin]
+test: MASTG-TEST-0x02
+---
+
+## Sample
+
+This demo uses the same sample as @MASTG-DEMO-0x01. The app creates a login and payment form with views that handle sensitive data, each using a different accessibility data sensitivity configuration:
+
+1. **Username field:** isn't marked as accessibility data sensitive.
+2. **Password field:** is explicitly marked as accessibility data sensitive.
+3. **One-time code field:** sets `filterTouchesWhenObscured`, which implies accessibility data sensitivity.
+4. **Payment container:** a `LinearLayout` that is explicitly marked as accessibility data sensitive using `setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_YES)`. It contains two views:
+ - **Card number field:** keeps the default value, `ACCESSIBILITY_DATA_SENSITIVE_AUTO`, so it inherits the protection from the payment container.
+ - **Confirm Payment button:** explicitly disables the protection using `setAccessibilityDataSensitive(View.ACCESSIBILITY_DATA_SENSITIVE_NO)`, which overrides the value inherited from the payment container.
+5. **Cancel button:** is outside the payment container and keeps the default value, `ACCESSIBILITY_DATA_SENSITIVE_AUTO`. It doesn't handle sensitive data, so it isn't protected.
+
+{{ MastgTest.kt }}
+
+## Steps
+
+1. Install the app on a device running Android 14 (API level 34) or higher (@MASTG-TECH-0005).
+2. Make sure you have @MASTG-TOOL-0001 installed on your machine and the frida-server running on the device.
+3. Run `run.sh` to spawn the app with Frida. The script uses @MASTG-TECH-0043 to hook the relevant API calls.
+4. Tap the **Start** button.
+5. Use @MASTG-TECH-0x01 to obtain the view hierarchy of the screen. The script does this automatically shortly after the app changes the hooked settings. On other screens, call `dumpViews()` from the Frida REPL.
+6. In another terminal, use @MASTG-TECH-0x02 to take a screenshot of the screen with @MASTG-TOOL-0004:
+
+ ```bash
+ adb exec-out screencap -p > screenshot.png
+ ```
+
+7. Stop the script by pressing `Ctrl+C` and/or `q` to quit the Frida CLI.
+
+{{ run.sh # script.js }}
+
+The Frida script covers both techniques:
+
+- **Hooks (@MASTG-TECH-0043):** it hooks `setAccessibilityDataSensitive` and `setFilterTouchesWhenObscured` and prints the arguments and a backtrace for each call.
+- **View hierarchy (@MASTG-TECH-0x01):** its `dumpViews()` function enumerates the views of the foreground activity and prints the effective value returned by `isAccessibilityDataSensitive` for each view, which includes the protection inherited from parent views and implied by `filterTouchesWhenObscured`.
+
+## Observation
+
+The output shows the calls to the hooked setters, including their arguments and backtraces, followed by the view hierarchy of the screen with the effective accessibility data sensitivity of each view.
+
+{{ output.txt }}
+
+- The hooks capture four calls from `MastgTest.mastgTest`: `setAccessibilityDataSensitive` with the `YES` mode on the **Password** field (`MastgTest.kt:53`) and on the payment container, a `LinearLayout` (`MastgTest.kt:65`), `setFilterTouchesWhenObscured(true)` on the **One-time code** field (`MastgTest.kt:58`), and `setAccessibilityDataSensitive` with the `NO` mode on the **Confirm Payment** button (`MastgTest.kt:75`).
+- The view hierarchy shows the form at the end of the `content` frame. The **Username** field and the **Confirm Payment** button return `isAccessibilityDataSensitive=false`, while the **Password**, **One-time code**, and **Card number** fields return `true`.
+
+The screenshot shows the screen with the form at the bottom:
+
+RI(&+~r&h4+{DI*xn0jvd?X`}&;yInM|!4P}ZujCY8Lh$vKEztSNhx*lG#;^$@qH6;73JO}fj`o&BM7;4qaRAld^7NhHluzK2kgct_A76E7n@Ut^ziQ}k
zyv-hcrt+mel(X=b3+Ni)^U^NwOIy;LFI;H=pClSPd2S~Noyso27iG^}efG(|Fwk_|
zIl*WTmrO+^Zj?U7^&}}VrZ8jFC}E%l(fzqzKrIq#Ro$kZCDvt=
zt#5qkFXGR+mw!6#h66infKkR)PS_VK;0M6dCSvI;ajs%;V1bt=tY2vJ^SS4b#y?AO
z6a!u;fAa7@3X<$nd2yi{4(y5YF|9Oo%4(x+yAepLX_gMR%QQz)j>hU=^9ohT;+DBL
zG=*U)XX6dm1(G9sKOujeG53pG9_pWE;hwv{bXIz2oJ~fd36<1ApPFatk4Vu@mf){H
zN>azl*17ye?}o=q6}?-86?n@!oQUWVk;5-75ABglr1<;
zI^9}i>=c_1$uGsR2y&HDxt@hWd|#TJ>qYeDtCTPeNGl-r9VZ{&zcU
z{8z+;CEv&K^V&bVcP!T^|Je*5-E#eB^D#yFBk@1GI+^Pa|Ji(7zqjFBa3ODIz+3V0$-(8MR*32lih
z`(uCr5j8)XJc{{>d@_YjIVe6zpksw`fZf#WG)rdpF)h-c0D?ic!
zX0P2YeAlYL;o&p-PkHFq+L;ZN>N>`pP?a4Kh5CJh5(HJTD>`eVfXzqe@{iryM4@e1
zH6Il4=ZlW>2oOPsrbiSHp&<7W$PI}E2(A+&4m$@ZW+s
zra(fdvQC3_Q>fV$K`Ak>vP$nkN%#6s3o7g1#l0#*i_;kWkQTcB@MjFa%5wR5gs-w$
z)?CR0L{(?{bwSU2*&l$*-exRmP3nqiR!0zZAZ)8L0Q{+&(g;
zd%rCKCeEq*d?q`rKrO5CzW%dE5Nd+1fRb;plDwx^ZWe~B6tUL$=cC`0ZY>ByFXRk+ktJsdN{LCkU1?>T0Sq5hT@Flp$>G6h9zIOj*)ff?wwhJ#GbJ`
ze7zE4<@^w^xbV0vYIn}6)P?yD_;UkEkz{+EE?n32vT+FgwE4#)`EhRjo#e_twd~?Y
z5e`L8q6vpzg0e?#&Go1j_OmO5-H3`uS!{4+f96`qV;(vhCs8iAv@aJ_
zF;*+)KeI2?zVU+0pWm+|z)#Pghi<2Ec|G%;wocAWiCnOUGd^WDdz*W
z^lNTUiiJVp=!@@3OByRdPU0b=lC}l2&5v$gD@khEgLTpKmGLvh+)q1usUx_g9Z};o
zP8wX=YqW`=a({h@ef$g%Rx?Nyn??||AbA0D>Q0YE9t|=
zLdlKm_hGCV!TMtT-idRu+vp9s*L4%Ij|w~h(_X6gkucoEfk@4Mx+nv63QrtVQ-CvSBo|0|-7MiF|?$N<337hlev?_I%A{fA)+Ew&au-eJKXCf<9<`J^OqjA&9fj
zGvyi2#3zOc=a~*0`#)2T)xw~UO0)t`l1xg%guFBLhf}ES=y_=+gJ~0Q5Y=a%{95pw
z;s!o9ST(6R
zgCbc#y^eHO++-(uc}{#|zH%|an8Gz%U^k;iQgcp6a;1O0mMll9!wSRe)t}m4!%C&&
zP2>6jR>jp;GKY5BDUlK2r<*mh2^W(5Bg5}#32|<>u53;n*Km|=5^
zRz%{-)=PzJ{zt#L#Iv|y)4~&pAXt~|No3M$LIC=-6Zn(%Mc_@Gc#B^&iS
zC;yN6j{*SKu_dP|UtiOYLh9;w`#(r9PE9Qr(z7IBU*+Gw^%IKwFb_4;j2TM2HV9f0
zndbZU{I1q%SQ^zI{P1Qtou%uS&?3&@NU8GN^8^*e#IN;o>2H6moK}i6kfF5_>RQY$
zExxY3Vu%8S4!t9pxc&Ceu@|Slx_eBy(zXNNAp#U&_r|>ofUu!a(Z0H356_c-!liQv
zO8lv0F*?D^FsmaR(C#nP^NwNH{6)K3%+Ejhu-otir<^xytyc*XpUZ-m9uX1!lz)1-
zc<`H4IQq9I<$)_hey+HTE$NGo#3B68c;wfp%EN`{nVN2i2GLB%eY$r0Ib+;+9_i>!
z_wd;pcyD)1_CXSp1tsjW67UB
zf&?dbzlguI?}nlD?pct}I^FdxpaPepjq)qPBNn+PNB%_k+wOe~etRUsaNWX@-FL;D
zbMxedlo{xYZsLazX)Z_=j?#$RQECm^N!EVd@QuohK$6$7vEN?wbog1{{Jp{z?6Dsv
zucY;QeD5YOL2Rxim$_#+i;c#T>ZWAgay&bjl2N)b-YIfZKZ4*Kv>wvj5iBPs7};I5
z)EdcQ5(fyPrFnUpx<6#H`j)H3@H6II^}W{etB{Ae{RwiJ>k_wJP82;BZdQu2eQ4%%
zpqa>9*^W!hD_SwivNj`n}NpkRgO-3ZTFXypBaF5iRS9mP1qvLQ069q5QT%k0jXZ~SI
z?vr52zc;7o{%#~H5ga-!<66{L(ga0!)cj~sCLtwJHpc7lH|TtJ=&Mpfnbj-Hkmmx}
zt46+G4&NV3+;W-d{zEsXeZ-25TeZBo^YG_WaIivnsLkexXJ{%+oyU276E%GQYLDtB
zmv80YBv)ke=m*aF`vyz7kNQ)3kGNgC?xmkUYg5Id)2mhvfw`L)E5AN1*ZksA$0BJ;
zdQV1u>FBaKwMypd(qBDKm}VmoTIh*>nEl$c+C-!nHaH{rvg2-b)Cvnkw&>M>=?v4=
zY4>cIpzvH<`pcGN09|?wmvt@4idEfRI)Vi&yaZ6PK3%xuN!($U{p9nK(&D3^!Piom
z6z{%HK3g}?vOjv+>H@j*i7AKy@f;DX*SMfj@GQ-+fVgqLq|$rDrELRh-Vd+A3BEc4K#UQJwWOkh(G)j@nkC_0+)jC|6zEy}Zongu^7QZb
zQKx;S7K=sv_VC-9N{&01d1}O*Gg$V>GXRayRerszD~BXY+rCQNZ%>BO`;^{Xs$G;3
z#5ahD4$?I8?Oq9oQD(lARv0A`j)v!R{0t7>j2*Q*Sb6%auETGk?OXJIE1jYPmcQ{H
zw7mY0T}SU@-s%zGRhy_&+K$aGGtBsn>(|^QrH|QrbV^7>*hi;2|EyQY|CTqso9Sz=
z@-267TUA6RDgyb+UZJz(hb6r?x#dR@{T-FCe$M74r6$3=jefg8ESVE40!gvgC+Ho1k^#-N!+0V^*|T~SD=pcJq(0K&^i>cugLz7u=A|EIZbOBi)6BbG
zmrT%O&Wb2;(heYQr@+E$xLj5@%ZXv1s0aoEJYgp$`0-`63Ar4@yEi1ByuKtWuYs|T
z=JI&shS%hCSxth=4}L8vQGw3CV6+(?B$F7p59tRSQcty=Yi^X=DTzETbTZhi?;cp7
zU-}BNqRKw}B)Gl9ubAlYz$Ww0zJP5^wALfr?;%WHp@nODcev@Jhb*C@W-)#x_&fp@
zx3+p7G6qS8DT7PmT1GbM^FF<>Y*O2MDbpgaZcrO8djDm6_%Kz2L#o>+GAQdOm-Kf;
zkA_*teErireCEf|%l-ZjRg#yrQDOG?n@j!(eEhued23y5kPrc+``if**gKKT6d4vU
z{-C>n?=BR^@GQiA#5|cM{h0z+BxeU5E}k|kJnwapLocz|;ZcdU;&wBiws8_mB6asR
z%lvM1-fhK@O@L0lX9Wb6)L;AbGq|0Q$&On!jUQyu;(pvwg}m8lP=K)i3~s+?UUKo`
zONqLdAuV5)MGe1x1A}6+(?V!gUVkJvxN%xNQz&t;-EzM;*J}G~vOq#qq_yvxBoi7s
z^DSwDTs|!%exN#^VG40Q15m8hm7miY7d}`E=ZAhY-22qZu0LCQ%xQDA5lTtnj#d)<
zJ}&RdQPaCo6SBf46)glIBiP)Zbb?3Mi-TpBphp&Ga3vyHyU}?0{#zkMKW_bZ%iu}lQyzq)jUYcROWzXLgsN){TR*5%o`c6;o~$B!c)Jx0wx>!|}%0!Hjk+C!EbFxA4AAd8a2;?qNpol9FCL4W>U$
z{yX8^7RpwUh6dY&2Oy4)P{dMQqa<&25R|Y;AalpEkDs8Jw>*VDf!;SIunD*uK6_fm
ztO_Q%HQMu1-CG%uUd;}3ub#|F&D_108eP**3gk+8=3(_6Y?Nkwu8qRIx3x&)^x)uQ
zQtb7b4stB)vMzY{t-$OJt=CuWW2xy;yK_5y?M^g6<-%fkuQ-m?-Sdqamh
zhkath8$><+InJ*`m~4)nIIoqMX&4YrIqaa;u#($y7_Ee7ncebQMrtDKg=`VSZqb>FL;V}5qN-U7+1LfWg)Gunoo9{LZ%a0
zG=cxwEvaA=*uI-&Jsr6=Sbgs*ld@1Hw6>03H#x6tM*|`=El_ZyquNmFlGBueN2?C7
z;YJ8*cG?Pjjci;BHtas3gR76!tV64(igkKN-x?{214X|@OhVYVY
zt=%EF24>jS8!LQG&<903D1^S&Cb)8Ob*D@!|&Q`Hom@hivC;n!9?=G~l3s_^79{cGV?W2+h?K={a+B&>FL5
zk^r3_6geL2FgGhe3pM0toLDG&`g``drEey8EPYWahq7J6$nUzTw0jwH?rBdB^7dlN
zO3ewi2O&7nPkQ<6oMldK&kP{z3amoR_NPm#_Jqnm(-IvJGvpGzvNrFwr9*4e+;a6r
zU7YTEWDwMrbG1@Syq33n
zj;05^spW|sxd)G$Y^PQx3;K_fCckzpUOh4IC2-mwI#pNcSYAL98pk;`6igl(S3`Di
z#KsBjy1=Iew(#CL=>iJNaCQtdc3*$Q?K-hT#m9&Axj=vD>yaMRk`(w!Z3mnW_hy#!
z%F;-aG9cAtpB^#%mmdH5$Y=^tIyc#x7dBZn9O|6O*l%&m`oUT+Ppta4EbFMC8N^$X
zmj^G~zO^_7pe6Ws8-88OkYDP|4#>9y%z%-k;YZhUF0~#Yv0C!Q5k%U1r_V;m-F|zm
zxKMjy_Es4>M^*pB@1ty+SBQ&Ii<)M&vDsXlnS?C^*(vu(#YAmuL+=;jd&{}BF!c5G
z+bZBFwMQ0rXMuX(5uhqNz`|$skqT8va%=N_TfbI3Cuy+QiY`-)QD
zv2OlYGivB!X_W@|LWt3XD=PH#&CEnccuu&<<&*~*+Vkm4Uwe?f5#
zkrMN_UJg@&_b8Jg~2?@#~e4yjor)?>Qvsg&&o
zXN%v;>s+^g5A_WqxHnx=ZrE0$h&1GdJpFd!b~M~(J!JE!Kyy0wn1OU=I8jN2{|GhX
z;gmGkl6zTG_60{qDf`2A{+4YxC(1T4FoohaU$^V_VO)YzuOEt*L@M&S#)Z4`u9y(qfk9R`AMQ}8
z+^)>fsZ(>{KuwrucTjaVdH_FP=Z&Vk#<#0!`B7yVWrIpS;h{M=Ab!OMrhUi}%{)^@
zhK5v#p3(Ds{(A@Cc8EnyhxWu;~+jF`fXK!^<
z3|vqgQ-YEasP?~JV_4b62(Bhx^Q3W|v5)>>vy7MDa6Si;8xNh^
zic9DWbxop5|KVtRE$WDktwu!HU%KGc&Gm|XB)W^`lU`P-?tBjGQmHJF+&0${nx@x#>IgYjYy8aPbWNaAqp{(p
zVKrX{jWLH}vg`I-hNw=vH4`$J-cbWGA)lWo-5#4`%~rdi;7F`aHXDYGm|%>$ZKRABZXd-=O%7mR8=m;o&l#p3n_~>_3pxko)mv{HZyF$$kw{sc1
z+qS5*?h$(9I)_ackF=IfU-$trxeHhg9W=lHtLL4nq52`~)X>kK>u*49wOzNV?SyY1
zG_R^tpSI$7>}&~y-CqUCa9uAaJ2{_C)k|WF3j_kGNZF4R#4>u`zE*y6;|!SWSkPka
zA(YR_8h4v&BD?~hWb@>+=z~Z@XFi~CGXm3E%Er|y|1s~0Xt5c17rm2Q+hDs1NT-3;
zf%R3AUl$KNEdENFK_gYd%=j;icEjt{a`_jIslLYfOE>N1mcE7ZGv#j^d4npaYO8*fdU6K_iX8&BkkYx<)v
zSUOn`-XopTomd2hmk48A#~5Y8e+h0{zmw3ksaE!vdl}3W5dOxR$}b{|y@Nr>+xUVg
zR@C-&)#3#@?+vGJWzbb-s<{35cd?fJkB7@Rl*NC5L^v+^8XcRN^YVQa7#Dh+Sl;(j
zE9sT%L{i>+qktJ|w0Jz++^X5eT-~71B>)dX1k%9gCbdaK^=ewU)9-gO{ff_OxKt6j
z$ur2z|Gq|2F01tmHt}lm&lOdc-=+)~DfNZAUplJ`IBSa62UPo0-7UZcd?)eEsB&;W
zwScR2nZcY=lh-myG?UqgG@2!Iagj3g-<~&3Bf+i__*v0I4uRue@O)NDx
zKpVy8rS;G{8aUyDN7}Z&GV4^hZ^7Fe7cWl36Ze9xyp>6mzc=pC+z=T^_@`if-J}-s
zWqn=t@>a<5ipEO^+s4b4ZLbWGGSe;%rc!1GkAHgj@;_H9nNEg;0VNJlX~c$^Z%U>A
z{RK0*Go>U%_>c|v=dfpMNVtOhJbsOs+{;kiZDXZm(abJ}3VVGXvFBht7*}C#GpD)}
z5L|eKx|1)KGA8%a`|!i?o+`{CaQI{G)BWMX>qtixWmS|<*c?o3H%?U
zeL@qoIZ<4(q=XvuLsd0;8OrtUjoKa?yy~Go5|%++JazEeg?4b+j@E70D5+_ttvA9EQd^zw`
zvll|OIX}CJ5TxVkN^NEFmTUv*JQmnwf#^%s^vzU9`8eT00zIiT`n&FUBz36=d;}~D
zGmsYfH^41j#L{XyICn`oewBrVxV5UYFj}d9ivs~``1d%;4T69x;U|4%Npjv7r>L$$
zxfaX?{=91yJtQ|+AWQAQiLgFvf9sWiOPe)xx#Io~nHBGJkRFHR5%(smVv^)6D?kCH
zR&7NZLHlo8Fx=-Yx6xhn>oHxtV3#Z$4^>%FN{6<-)DJs+W3AQOdT)3uoS5`Kr|@w-
z#jEe6A7gWq;krwaJa26-x)M4X8ML|RD4g_T$=Z#^`hKI)^%(@-BEX*3rwz{=(Ku(+
z`DMyXyC^(B<8n1|3<$4u0@UmndsX76)0tG@pbgamUM)Zz+bXlB$&8@kNyes#I86ns
zB<_b97a)YA7n9baH*@uJa{^>udLKskNf6e{W9K!M&`cgY)p;Z)Tt$gc{u4by6S5CP
z<4*c4vn!Vew*&VfHPit7=u7<#qf`KIrD7dm}t
zN)w$bJ1F9kfaxiF7JpP;u2>b5XR*Sj=bgf971mgTNEly$s>&AEaI_WMicm$ZvXho~Ki|
ze0b3kbxrbgzMljPaG$$<(v?m9TQd#6DMGjM7i0FQYO|NTSUFNT1Q1MNQxi1#*76%O3L75rW57-sdah
zH3ay~ZwDyWNDsphTVTk{H)e`|LywlTU2j6P078;70e%USd~hjAIS)TFg1NR_KD^(F
zsK!-3H~efm1=(bqGFu7&o5ciz)!q#b)IZT+ZUB1&YB9?yoGU^8*xRg{mG_GK%mAok
zYALY>NHArgS2Ow&KUE1i6}BHDaQLT(B9fy;&6SfduLU4Ji^&bKBB{J0R#BW|GV|j%
zg+ALq!$B6s4KTQBLo>elrOyJ2JUk--CUkwhhCKMOF1v(JSYn4IbbY{bnc(o}TF{r?
zS$IzM03$X7?vSyZY~^KEA8RPey0!5Xk#dCPGok40b95CEdC5SgB^?sXve2
zt+)+0k?Z4j4Kxd|uYc1d>&V}y>NZ$)+&hc)5|vmRXtA8C9kM!tR7hg8E{|r^XJ_^A
zMmW6qHy7DG0iDmj^m17&+Z}{M*eq-xzO@;Z#&a7E_Kh+l|!-}#jN)B=$_WFt22
ztO>(~ioV%ZqbzSJ5JiJf6{N`X8r?W&pSixx$Ml=iHRLz2zL6M?^1ymT-|Itjj`FMu
zw8tFRro{YXmg=mE;~i^E}8*}q=+yeTzH`eg78-O*n6rU?B}I*ZGO(g-tH*y<27?2izt0KT2|J6&-CIso5ue)>=2S9@FW{~}c3{647OYVz&5F!3+Q
z7(00Wf^Jq8ICrk#D6ld&7Fa=7k$>QgmWLY{8)Kq>^NCYT5KOPx=fNMakzQ-pZ@+v*%W+bDgL_g~8b7ojFzH913Q{=pB%&|0W|-l(WV=
zduaaFV9WB_6YF$R?GivRrp95@OaP$J+3V6{+xmG&z+_P}OeMg@R6KxPGN&LXXuikg
z5}jue&@<2E()sla?~2JjK>%7kyZmW_F|tzl@$X?=imBV
z9j8-F8XiUYge^km*x|=}dpxO6@1|9=W&eKR60m1NO?U}>u#BfKHgV4ah00%Kv2}u+
zY^gcDJa9iY7QTzf)>Oovr^|ycS6w$UznkS@3&!DU#L$*^}&
z{$O*kdqb7C*Fx(>kl!g|KfNnWf90c_8wIx-QU_Y@0jwG}=MRT$$)|C={o$`gL~H7<
zA>USljMtCSZwHeno0!)`5&I-3?553=-!j6T45_%a9j7xHDJhl!@bgUe0r3HpYiGjJ
zqXi%8S#4ut&S7t?D>LqQTs6#jh)T^HcKf3eYJ$nLE~;H7R0ZYeNdM;vjVGHQBkR4R
zgBr|SNInNBFDzOBsc4T4Sr5IP5h_E^>D2aaRq`j4qd3FHXFUw9dur}oN391?%d}o{
z-k&Msv*}8#+vItdrUh;mn#T2WIao*gG7rQ|2+~Qk&LdZCd~YE8N|F0KC*D2pj?LEA
zAZ7FVx>@~<4YWLDoQt~qft;F6Hej5Na$}<4r~k}!uxU?2@NJt(F8MV8bvtDB5$JAX
zdG-9NN$1O>AYO%Uk3`wif3qLW3P3~)CN*4`DFk#mRNZ;s7IJ!;5NdCNfbAw|c=9`h
zQmrjHht@>iR78cH6dv{2VBJJ{SGsbidi$o`Vz?3v2j%FDm;tq2Di7T-_HF!T;7Xh{
zF2+zjqJlgo4?SvtntCzmwzdGAeEP?W)uc%uDP8WMj|xEq2ah8Vl~aaoRmtTB_G6vu
zvrS&*vtdxjlai5Hn^e=fxsz>1S^pCYAL@{9`ux9NLNs~J*4WgFxy%+g_%tZRFcva@eu+0T0QR+Z_6Q@ro`V@pKzy|&Q{;f|yX5Hx-S-+ESNdd_8Z1B&W|eKntRiK0=w
zzXPu71NU-)*l)eVnY5x3$yDn{>Ct$BN
zie32YPmt3oPh?WRq_%X*xtsUP>!&E->M`xSrh7AYGh$!UUoLUA>a^H9r;Q{82jq=)CqZJwPIUCoJWSk~cH90-NH`exIYnw)acUku0>
zXZ5wvMadm)hhzP!eah8-~Gu2!8dwR7~7?zF;U2eU+S2`ij;R
zG}G`b@cf`?wqDSrPU{LEeHFKcHcf~D;BQ1TNh<-tb8}wp@WK5|YmNPs2
z{wC6gO15CVFEurV6#)9A0YK?xyI$UwT3<_qB9lx5>J}ZKWwGELYS}VJ!kXF|$$#d(
z`xe!N)Ek&~6h^^^sT#j^~IyWNu+#>5ZbdD-q
zAD!EOLww6VY!}mcCoAc+tGA^4RM|cyWYJ7Vh@#|=IwQ5@rt-pJ;px~{aGPuZfpfhd
z^+Qy|+VpK-k61TKyoOlD0FVq#m4=a{0G(i2BW}NEJP^J@S7QdxT8-ar0Pv_qujLE6
zXA^r3Rn0FKn|Cw63_;wF_%I_^m)}aoAb}XZ?6WGLloZMBg2aIyS-HR>5xb*}-pLm70W3vntN
zT#c0}>Ph52HDW#gI}Y?r=7&vmmG4DELPFz9x$l;dLV?j}Im@3x7@lyJZqs-k4_fTCeNt*Rcj*claancYF5!XyKojf18gdeV_
z9*gsd74ECMRYy0!$7;USNPPOHVJ?_dI`J33VX|I?!_}Ih^T8~@y(GrbpD#sfGW2AB?FM?KdA>*Sqs+na0
z2koR&g2(e7L(dV#VJx7=lM6qp{;`dL0m1!R-@}zAn;4mu?xNWf=ec@yL-PPp@&opE5FjrEmW@=DQ2>X_7_UqNzuz>MIq<0BX7qZ-ZN*QqI
z7PRhYj?%aI?bB5aE<7Ftn76^sazc^K7eB=bnEu({6rYHVW)k0NCuQXo9GjRZ+@zCT
z)Ps{js?G6nGpEF2HX!Wqex3VzZ)ooV2#ac&HB5&cZ)`JfW|uPoTT3(?wH#O1
zT7myOD@te-c%fh_yEyt{*)!jo&6R3T&>f#ecZ{xMqxY=~6k0O5CJ2M#TF-h$TfOKV
zFyoPXY?s;x6gOz`JX^SM!)BlINxn;zb6;fbAAUpGN4s~&Z1$*hdg
zY?QT%VgY;EnTyiQSYChFmnuBP8nmS8xgT_fR>dMGD<{H)VQJ^>mTK
zy8irFxmmsX4iAbO?3~*@JP?OQb(M^(wM4JJXVQk@`zhRez2?V#=3?1jM#Ja!8cpd;
zk1U<%8-EPVXfPLf`dM`7et*NQ$
z|Kn%p`@WCS897__IN%XDY{9%G|3IVF3$QR`(QWhgvj|C+G~W9`X!4j=QfXY@w*zdx
z378$}CZxcX%J%-WXR!Xe=(7sUpo6GAU>^5s8&o6Z&HYl&iu+RP9H(I(*DYAA74T*K
za*D?UaKtK&)0UzO!!@moieKN4wKnF$CyWvhTRj%_z4ZAq2M937gI3TqcEWpSn3%Gh
zAS?L00m^$zZ%=3WgU<6)?MCtxajn%uIMk+>0HGbINYTy)jKdVO#4-t%8{T6#=e^;wy~kY)#?5@HcF4v^ZiZYH_zR6Sxhr6pmgI
zC5)L4A8vI{arNMge`6L@O1f>{`RZo@4As81-Vwca8AYsn-m*C58h{?~D>gLa4u&wi
zZ$R2UYz*75c~an2BNv7T)ru-c>2?i@J-xXpI1Kr9jFi16lXQvXEvH)EPh5>_Slx}d
z^z(#Ujb7c9z&^D{hZfBK$?NfeMP=r79^pI|MB71Oi&w{nP_qZheWVgn($Zern}F&s
zWOQPtKD*OTWoI`FA@I7~r$=F|AYX*YS2N$-Wt<$w&hHVs+am7F5sU83a~5v7bVrco
zP{#t;#B(Yb{+fA_aG6U}>Hg?ugVRjj5O|qP{nWBEDqRY9GIokTYt^JPa}D0;PuCUa
z=n?}i$OK)54XC4~;`UmxE~ba5qaGpBG3w(@9vnuT2YL0hX|nQerQ9@FIfeszIvKDJ}kon>v4Ee9Pf-mIo_A@S6#yA=6xb)3&C
z7I^5s6im7!3qEJTwMTe73&MCtGfNxHH2|lW94EIT7Kf(P#TQDXLAdfJloKIvKydSg
zO?x}$DI_YCQd{4eoMo@(Jw{=h6M|DSGo`TOy=r5P1Tm+#)g8jk-;97&0IKd4x*g3Y
z{#%w|&+8W1r%b^?V_q(8tKKa&@4uj@gU-xQ#tANs+e)$*dN@mo1kXc7*2yn)CMAFK
zLKoVvglM(BtjscU20j2Z?c=dK^RI7#?t7kp`|J&^^l~fP2r}IXNp3
ztT&xw2ncdYer|M?l`gDyBw?)G2_l`yiL8ir3z(I}EmqYoqP-Cwi!B(eaF8~^FAF;Zmw$c1;HmJ&5d2q7x)e!5M!SP9kG~M+v>#bf
zoUOC>P_W_J-nPwg;r;o;)e`3?OPTS!d>OYfYhI_-hC=`Y^v(w1d!u1;=j|-}#$~uT
z?6$rkVf?^hoHyty;Hr>XQ{u<>{_uMoo}*ckQhU=@UKh!!$VeazEY
z0Y*IAoO!Y(l(GAZ(>mplixXSVecajhvHAI2D0f}+5umM-^=c`srFVE+n4mVyzAahEW)fxGoCKZwRd7p6U8oh=aeUf;4w4KpWi7WKfk|@M`EughUxdg
zmtob&YQXW8dwX=8uBMzK;A*kFZZjufQV^THAEYT@76d)Gh@j@)377h<#{#~5>Wp{?
zzMaDZ0X4ZW%uydR8RxF|6!*?K1A$X`>~n87=A&}y{arUid3B4@gaZ`ReqS|3$eA~P
z+0p#MVf#zA^YnL1OdsH?Zcq-n+hlXKzf(SeKp?c>L2Qxi+5Utyy+a=`b&cZ2^d2Mt
z{M!RgUZ?o=!D$olE1mEpN36`Kvg{6n95FGLkmh~suQi@5wbS^t#Lp$Uz|Upy4>QVd
zYZ#~hq^&nX7XcJL2*Tm5jUMi?O|V3k@##(
zB|u~BT>Ez=h|a5+P`{tWW$Wv@hi%Z-#|})NDr}BOS7-&mvPm>@0vz1evpmuQf|~J#
zriU8~uVZ@x+Vm5bLQTg_2fC(DX&d5^-y2xLR?AszF5m)JjPl3WVbvt6J)ny}0b#KiT>R1!G71geL?=
zoo79>JX6IxE@X;vlV?QAL=VXhRlrbIX?5UsA4M{5K=$keXzRbc2jAZ_
z#c`*2?@z!F93D=m^PUPNdH09nw!BJ(gE%rcD
z(C#wkyq(nU*H-)_Xx@*f*Faqb(lcGj3v^l(S)n~R1C@5j~*`q*aeXx}*bx4h$@b(1^mM^z0?t-K}pyTyz&8<)u
zJ*d;i)eU1{mGOt(BtFalh3DzxeQw}^4hUyz}naL_+P
zEKXlCMG)$B$DYx`LYtJwMmj#zeIv>&GvgrVSQ$)sijW}Xf?AG@(SFcSz?-?oRrFjy
zGg#$a1IQF162|Nwt`zfd#&fQgDx)&w!vw^(FrKU*?|S*8Ynz$Eq)zT&iI{jeGY7U8
zikz64sh!D;e%iF$$%JWC9#|ID5`FtOIs}$Wi>>X=&-qkGLqJQ(9yQn8Pt{waei%IX
zAxc?+g7t?=p}wGzwgv892nU56pNa;15e?q}(wy)h&;u
zEz#pWQeGR+vPG;iG}51%hV9p@&f8c`XlHE44W+3_L;4DOS{}lZ=&Z6iuzZg2UH=(L
zSe=ZNgyTj1o8xi^hkq!d;t*J5@`or6?P4%1+v@@i`QhppgjK+oX9G3RN~oTbD#_pc>GW%Pb*b^5F66v`TRm%h6=&i(qUaR{
ztuU%p@?gy}Jin|UMh=A>ULFr6%Uux^TKpO0Q?=PU44H7t+lJ^F(g~_z8rXXM+#3jZ
z({FP-t9FP_(Bo9NT9D$=gf35nV#2fcua4=wbp-Qfx@82A;!a!I*q~)+V2~q1BvuZy
z^-YK&z)j_mTSp|V|87KA!1$ghS2Y
z&i6Tb=j}a83g6++mMF|I@!3eGPxjV_h(B0>M=W2{xq85M0`6>-3%g(HahAo{J>QK<
z97_9vP0vnVA-}cn%h6yWMi-vCzHD=l_0%d)DC4<4-9Sbe72)zgrx$RBuqACL%B8v-
zVN%gD?)5aSKz`^h1sn`gip%y}X7Q7w?i_mJK6g5pI#uihFq$)l7w8+m;_5jiwdk~>d>+l$
zeU#;|FvmvNomwi{%7HnlhR+xMUCY7hY!pG6eYM-mH%fJ07y~X^6I%C|D5J`*~FZ7mJ>J{KhOr<^~nJ{
z9Xfs}pk-=$?(DhGjVEvc3`@R^!79YD0Q_e;ql|--v7r*CrSk~_i%=bS*yjKoYTH7g
zoHIOD9wPK=5`O=Vm8lpU)SzIMlR3ZK2VY?~q?j|Y@)yG)#mFesqQ{VIKp^ElY~Rew
z)00LH;I_ia95k-Y_}n3BQ2NXSw+065yhV3r0(TBO5K#=GJ1Ism_d*bXLL1?c!~7_k
zg9Hsb4eY6Ok#raIBr@?g*m$f8oSZ-jv?kdQzqIpfCsR58cC}VZGYg)
zA57B`Tm#KluuZWxt~72ippw0W7tIE~$5R)2m^Y)GfsS^kc?(PbNTa6ALsd*UIN^dM
z!FEiAbiRisX@JRcsC4;3--g8ZKAX8@C|%mBygfKU?aL8*{^IdN`8?}w0wlyk_({eO`lw`0|1bQCv0atHkMravwG*m^Mfyy&HCz598ncRRC?mbr6
z=}N4W4wgMy32oS4i^=uyZx)oF)~g>2t3_x&^xw)Y9HR3(
zEKK#hnmqms2GGD6QC22e-+|Ih2>xz?<1Sus$yespDeytHr3%UU0!#xBK>mF~)LA0HoF__j
ztj)knXlzj|D=ItnapwEC0ht^9)A|sZKvvvX7O_`HX)WO*-9~y)4j0GF8}sz1Ral~E
z%OQJ?o`cuMJbNqyb`pN0hm|Q86~gwPzR)T7e?(n%Sd(qrM^O-IQF^2jBHb}iDUlW_
zX-4lln*qV?j(|M5AE)~Pc{_}<`=yc86^)QNm+wTM+RDpiQVhdni=
zbsNM<@@g>TgTeF1o5uxG=u;_|7o<1j=_hnjqqUye0E&f2HZy!2O9z^Vo|PVNd;~9v
zTG!SN;g`qbIuz@)DwVa~eOYkyLe^+z>~a2J04%;Gh5gXfd@erS`_g+@;@;cg`rG4m
zlA!c!h?~Wd&pErduW$QdJQ-D@VRdwyLT}lwZYWxHRf19bC|tP@B#w%lr#i{+>N+87
z+6x>Q@3wpn>@RK|ruE#mi=Bq1@+D3*J(t_DCnhJq?22F0*c*DRp!u+6A4enJTl)@?
zT08aU($M8^xKI1%-NzNbv>N$HB5fC->eCAjpp}z@mcs=~v~RkA3v$)IJ6ZKRh
zQH{#bnv6z`raan~a!XMG%z+w;+TeN))Wj5F
zrEGvJk)5-p%!`mH7yMkssaBIdP?KP~I-^`KeS=3<6nG{ew^X+6tDw={>p^&RATKvp
z&hDKmsoMWoXsT&+2C!YImOsTg@r%N1s+G&V#E>QQrDC#>TnMcO%}bA~q(iA}WpQ<}
z`<~1Y>fe@X`P;D)LJj2uorDt9^ZNGRMo}nNWb4vhuIc-~1qg{ojO8R}awfA$=pB}G=glaB;<+gBv!L;cam68xzj~u=yo*UcdAAZ)_Y-ivR
z{A0-}0v6JKI_1wbVjj#}63&B__xnZN_De+W0H?Y#p*j*zt2fJDuP#Op@0Y^&P-Cyr
z2s7uZKV_lSj|rbDPeR1dz+7TzhyJKFY;opSV?xuHYtKvd+l_TiD&chw2}$WO(eoue
zKi3icWWJ`mi72mdip+br8N6nXo%(8fyB^7nLspRUT}$Iy`nD>~x0JWU_D_o)e|oi=
z#HA@@x=+UT_ARqmaoSD}mCG$sZTl8a_w_*?G<7THs+R7jd>7Qg#mJumcGhXF4|F)%
zDttkpetZbIc-Am#ws$RfcPin0w;lvx^|@OKp~cY`6T4_!ZNR=;&WU*`CrjgDVwALW
zw_n#Tx^%`P2@&4VLTi6{)e5}`WwFxkFtUVrVW0!O*MQE>!2v{c-vTP}{jWgbcYWDv
z3tb$`mH%tk?R1>qWGZ>>Qe17UFO8`wOH4jHd498&FJWmRH2vq*gG&DqVoudY^n*2S
zNE&RN_DYk)be1H9*3})#qvD6J`X9i7ZVqYuiT6abzr8ug)?95S=~-rjpcTAI_}N-D
zf^=Xw&S*)mZu9XGynlz{pwwI2Yd;lN&g;Ah`f)*jt{v_MS5Ke;N1@XB#7pe+1Ih3E
zp`G_@bBdl8XP&@nkyOj;ksW;W2P|NdXMlhWa^Q+_d)boYEaY0jrQ@Lv^f%PJ`-@(U
zdt9l{Hb1*oUALvZ)T=RBGvvPM=e2Pbvv2_M6R!`GRwWl|_BNx8WwvAJ@ig`)jgM^=
zjdqQ8WJ|5~Zk;RHK=TSZe|6sFNf@}X$n}Ss+SiN8ZrBe{DYF3ZIB3jC&u9nzxUy|-
zowv!_1IwBp^5M&|lPz!U+3fA1nX20Z$SD4ss+rM>+|$bdLe_MHw|}+NjFbZB+u$?L
zoVAB%p`DQhHNflTvD(|C(})3(xK_A{T|WBcuSw`R2i-vip6JRQ5Kc=q+OYs0O*y@~au
zmQMz^A!YoZ?yx88XFnXKG&q
zhS5<(NwvDdzQKX=18;1eH%)lqx-x;|G6g{4bw?-anX_imy9UuCOTXfucWLgkE^E~Z
zCN52tM%i}WuOz^i^dvpo)*-`V2@r8Db7WOMQ@)@(rrS-4uin{wKh*nU9HCCF__mi{5SiF7U&HD^f+GWTA`Yxz%u9^MR3pBwpNp;8}Ib)ZI>B9GWP4O9#(l
z$6+hJ7qCMopFVU6n`dNKAUYmok1LBdSMTpk7M-;P5DF}C!qEclyW2fKzu!Kn*?di;
z*j*RNRhaU9?%&f2-Px2FueH4uf?JyxbGP5Y}YMj3z?XjgLK{*JR5k+!)*
zwR9sRY1?`LJec%-%0V&
z$Z2*@?P*Sfq<$}SW08bi_?<}x(0R5ZWJ}&Ysif|ps!;}?YGVLsRHx2|9n^d>qD#j!
z)`FO~E^ai?E}9m&aLS?3YjubdaBI+L-hn3YGV?*|MaR%r5@4FoE0?)DqPuG%Ba*k?brEFivk6E^wgP4R-5wt@qSfv
zTY70SGTT@bNX%GNbn7t4}-
zwmW=sHBaD$%o$mKacFyGq}Xw}`0+~EIE=H2NWY>RwSl>dZQ^}CoTB3iW{opw1Gw!~
zpvm6nZNN^7U4yoHs=hC=)-Vn%=+|u3BOItRQ4QK!U?gNi=
zTGCo|fk4Cn@9+f8lw+Ze$d&I;RdLMQlfS|)CpqZ3^dIT;gdk$pmaM8u+9pRi(g1GP
zso=@r1&xwlaQ)-JBlyX6_MGjhieDvWuSUZM&d3`D|BLdhxrHldiRjb*Zcgi!;E1aj
zA2W+c)yow57n9!r*O64&xMq8KUK%Z#RQkG^kRjv`hUg%SSxp_(5*9a@I}x;eJ8TvV0v!%#hnuS{j?WLMvmg;+LZ9M@V~Sbn)yw7*>r+v1YU#
zUQA!;Ashx9)@+_K?^={gEY3eUo0BIT-chd1$k%Aj90u|kEa@~!aoRYBSkB1Qsh>iC
zu9K}aqB_`$X|cl}a7;vIHboN(pGo-IBGB}=LbA+uYs8wW_BTjJa}J$Ix@;-h**Db6
zU9Bby*T^}Gar8Blk_+qqumbL-n-dYPhvJ={N
zsLT-BPi}6uS)*vayyK5e!(zGnWb=p~n{4=KbaXT`NJ9mY^msTH9aa~1N+x*8u2ZYv
zw&0>^nS@>w`F|*)(?*hgNn=^#eoJFvOWds2hJw$TyusA%`F#Gc-~LInzWzmJKj(DD
z{kp-aReGTRVH~HA_JPpuUi*IVOUrSybF!Ty7)`#O8@vAFZM12QYuD{-_N;f(izMDyR$tc9%zfrkN>zI3=CMCICYpqk`X;o^>ZRqv@^9vCn(?x%2BOqT
zeRQYG9^y%zd09tv_2%%4l~ewq--(SjxhcCM)K9
zO?Mv}SiK61}`v+Vo+
z{A(z9wytZS-<+0RuBrOH`0A&XJWgFGn%nU~Q*+ZQMs(03`jZGsb-&y=?JBc4@m8}z
z$`UPA9kr`VXQmIqlHsO-%{#I9yQxwk^6QIhf*glMby7*|wI1QE`=
z8!vn}1Crk~jLP|Iq9|i({j9#WYupAUcuTq6?V$Z?xz6W3uP*t!Op>TiJa{-NF~G%^SD0
zGMvTT21}=W`9PE5M#0U9DxjOJXe^H5l1D=7(&QaADLO&;
z4fW$E-p!RSQ^-PThVaVX_-y1TTFc%}4w84?w$GT@r18>lYrYDu_2@i=XMLcRa0q6K
zq*jW`Q9h^Ha5H4E
zFh-Gqv8&a5vTgElV!JMboaJ*HyFmKuSCtzQu&e?U9xGvdGpS
zQE6|C$LwA%y&SGNUpS4wEnR;|jkcp|oh=!)$s*8kj=QwpBhYSHwWA>;NkofQ3T-EC
zsc{NAU+21HD`>9sT>5YJ5qB58GTA?K{^nU<$#<~cxn2(zXcR#=5~kzhDY%UTm4x=|
zp|*FUCLkOpFV1P2t`&+WJMi0U*n8Z!=-9_YG{q`%T
zvc@~l+u=yx8BU+Q!jq*-js@pie38vPH#}EO>fPzhgcqVG1FLV_ZqPA<6I?P8xJJ{}
z@BOAKcaNE>MHFhjHiC*$#}P{GjddKn`ZpZwWF0xTX7bUUf)K3|&$eC;Jn?YrTfoCB
z0&2Srl^~;=Gjf`Bu|m?ohDZZ#jdxS&x8C9ix_&c<{ve3x4+eIFRyhezl=SUjC+_Jy
zI$(EDQ2S#D?j>j~Q3-+V+H!Q#!4Eh}ncw*m4;<
zE=4#-qYVRQMc_evtNJyLKJ_zLqjH)+iCq#pi#Rz5`M@#%^Q%t^F7s8(OOcxb|j>EPq`+U$NhBhIx3SUHKRBY2rRm2#~4u&2Dgn583iE
zFOk6WzYO|iu=;A|z6Mm%6I(PbqrJ6JuTgRTB~4BeEqX@A^F(3(6?1H#C&ZxLAVx
zfyRWuO`m8JyXQmA(P^}sJ{D)4K$?SFrgNe9Xe1!v<|Wb?a-z?Di8A5)eP@FwDbrt)
z#bdc@f+oQ-DIb|SqI1xhNYw0cLaX2LAE;>_Khbhj4kA)i11)XLFMfNBi`JP+&>_DU
z@xobjQQ*V9)m%NzGX0VSeNWXe(l}+VtN1$V@zb<9(f#^nJ9PH|RCSz6Og7?CZ0Y4X
z=b3rNO)T1;)ULBJNE9;4T0Bob-$~m{&;M)N-`|woe{zHPE2aqS=4;-5PPiL1$IgjV
z%TpLd^MSLxThzGkb+a7W;Vdv4PF^_O6&|Uzh3BE21@jAS9i0@8rsemy;}Z936UC-GQybS+x|2s5@P%(49eqy_$5L_@vft!b#
zc^Qc?UloOK^XJDb7%hw{RSJiLcbJtaL9e`Lkn8(5jn`+Ki%v!HQg%RQwfFnKUwz7n
zq^@p-Wbm-EH#ZdN_}#UUO!@w-4d=i9R$WpgKWsZwjL26|s8gijRzTX??vy4MO9;Eh
z`+JEsM$ndYx`BC@%Y2Xc7b>^-Id_QqjOCIcKlkIyD`^zs8;C_(^&>8>E7jHZ?o2PA
zZNC8~O688)$RgY(5WDtu#0XA1|3m$ix>4UD};U1Q_pp>-=`(a|X}0s76JM#JeqNQV78$
zU#LINGH2X*eXzZDT7JvjqSgG=Tq$|p#ukfFT%5+q*F{){^ts`FoMu+e+OMT!`<9yL
zb@R@+SxT$jHFb;bBt9qCP+uBiV*jnJEdkL^6)r0)E1NVT^EBb^ng9?w>U&{_z`~;y
z!IKtsHJsd0FSR8jox?^JmzBXPKqyU6^0y`bLqF`$(9mSbPbPQ-b2PJX`;mo8;&3YE
z>~t5H#hr2Orn9EqQZ>Ql{--AT7h&JwXJq-4s@X+F52z(nBNLyn`Adi}J+wSJ658_u
zw1O%124`@|>)N3N)MX_Jwa+sjs1g$w6qTLFxn8*yM1g-%m-%nYeTwkZgB@o*n~wc4
z1Rkw*xkG#Nia)sdXbjG7X0uQL*}{ZgkC=|j1c+onb5k6DW}&*z<8a0UhauabZjt2A
zLw&pz1Yb`+mqEu?=%?zQNq;hKcFI_3(EN-JEEnF1;$RroWKgB6*vu@8lLphje*JoD
z;{NVI&k73%M~~M*>+aPhYkumt^rR$6hP0HF;aHbksmruqBaLH)+252+%MWg9>$|XcC@wLevY75UEMwO
z97DIQiHYROZgvF6_JxZEx|wTSUdBu3ibe&Nl=X
z)6`237#OlPqG$ljk){}LslD2~_u0dNhO}OtEX?AnWPNQuZyx1qD;3vvG4D7|edCw>
z!KCnLRR9(2b07XO1=3fxX@!w@wr|EEhfqqaYl_&te%W7@_<3S7JFj$+vi02`XChE#
z&tmzi93-07dt&>oZS%|u%9H4$|b8eM6h@Z-Lf9r2*nj~>mOo0A><)M
z%8%A61anRpb!j&^xu%m`=6e=Z`k;ejpuwNU$hySl%pQ}X10AKvbEP_eH-;DCZ-m$l
zlL#g5o`m%EDS7I!-8C~9CRGikehUn2t17^FYiCCz;_~rCX9Ep1mP#`eleyaM7rs3_
z2MgUD4U-+BmF0_)rB=UXe-&wY%z4A0ah-#vh@WH6ricA}&R%SZ{>oUokN4RU=Q5>>
zVOD(aN(9ikJ|`3OpaKM`VPj+HI^12Bx{x-vkn{8NYoW_vsVN8a@I7oOBYAFPcX`?E
z>))9^4ldm>x_Dk*QWw!oAJ2=ujnNg3=@O2K7UdGjhu|($UY!EL-#FB
z_BKK)KUQB~F1;P+XrptfRTl3%g<2+QXtm+{5n
z*Y!Sv3~yN-FHJR_-TJ!$xftRX>o-h#U@&*O*9z?nx?{$=(OgM<9DMtoWC)J?q80Oo
zfQUHS?evFSRC;xP(lezb3Jt7ppOvU{B$Ir)Zaxh76QzgtC()_!$nve@G=Au1P~jm8
zjF>ZHS4HPX7Hdh)-iN%+$uqLcSai1-AkrNX#AW1d{N*Pj66|^q?sR3cnm&%TI;Jb^
z)$|T~aY^mz+4oivBFpm&a$WA1xQ~;994cG?%>rz*Y$ZX`3%{Gywrz|#vJzm_SNbuT
zogyKNmN;7rti%W>5kw^7n7bz7cEv#<&`}HkNr2vKQ#po6brkX*6fzl*vKV0q9FE1KzJR0(S%23upytGUFMKxlnb*C`2LB}aXP;$9
zC6KW<-V*Z!FI(s5e^!f5SeSxL&t0|6@&07({udOwJ>Jcse=PDN3{%1*m5=^{fB=J>
zrVHOcMeP>vkvD*nUQBW@2J^CAvNteMf&
zuUz`-qf8J;0NdG8^<%LL4^|GUO9YZcb!;|?{BYDzLS}WZ;z>Si12^5(?Ntg#rdHHDT@cTMBoxHLPe)yDM*wWFD*!W<_V
zbokg;R8gtrYsy6b`eDL`TYG2zIeKiaK>d??mBDvzGFA#X4a%h;aAFcM0kd?$x!!l5
z;~#R(KaZ}7^}vYGQu0J%=9elg%u)jdTzqYUgTL9#?SzmaO?vP%BmGuK
zF%4n8*XC@$_3t|(ficbFw##WBUR0Su^Gm7FrtuF=bQn_(nGhep`aK92Grn>8M!R=!
zlrg6kn}B>IC-L~?WV9+j<2m~ynvl+n%zOfTXmRPTyX|NelWo3miC*KB%kpQx@o>sT
zp93JZgm2Ry_>x97&@id1s}>k0rz3bfzpeP&?QS4xkotT0lE2J92SL-Mr-$)1&s?&!
zq(>H~`IojUJ)dtJkfdKGPso)=yUn+1i-|(GCDxeFR?UJchz#S@c=_K`@UAU25-zVq
zz{?wXs#w-W>y%GR8N|1hh=EQII~_gktM->Q!Ghgk_bu5qQ`!cH!3
z@mq0)YiWINhz)$s)Y}}BfXVTyk`X=W+@xtDxj}qU<~BAqF``%Bx(_f~F{Px|fD~ZX
z83W%B^=D4WXHxdMQ!Yl$M?yMI6xi=r@;Oq@QsGtUrGf;Lg`%thue4x>$wVwTe9{l~Mu9C&{uh^JH~^9T_uzONSjJD%Nu
zrhGu#JT2(bZD~A53$L)SuztN(=QjQl{YrbIMVAvBM5PI8%YS=QiBL$U!+_=Cd5*&^=r*@u~5zK>UwlzGxbL7JaRLjloxd6oRfb^J8*7tB-(a>
zK}_tS?CQ<)qrcy9!QhMX3YF+X@3cp&I87O{u;{Jf8OxT}!>P4oS_nWJ{SM;nRPvcz9SV{|ehAKZ+wGdlj
ze$ADjX&a*@WN3AI24#|AWMX(2V!dX+Rp#*q4RQ!-@S>C
z84c~=8)Fv*{>3$_{)nS3Ar18q*z}&P=O;WRxk%Yh&X0cYP?ne7JaUcI=!eJ61stS3
zDFIJCw`iGG3s<9eRSlgE8C`jmE(h{+UTOLR(2?=#aj{Cn-fbe+GwpFLKFPHkoXIQG
zTWJafMXWg=Ps!6R{?Gu=^+qQ;U9Laq2M9ZopOoIS+cn&36o09rba8R1<+%=G^NNj7Lz4VBq8=TxfJ7vXI<3-?+A0QG_sGwU%WTHK70}Zuck?2L;kUa!xkN$!e;8{)A_Z6%k>ue3JQws->S~4
zde@xOiC-3yv$+Afu2v<5KC7DY7upQh`gKIgzP3J^T;%aS9)DLn>x1^OU$1M0zwRJs
zf`5!egr$WXZ9^orS`QLu8|Y~TjqYvGeY_IfGz~2^#Smdt*PBNg2V%j5b%6Fw2|%ZE
z?&Nz$C1iUlcXuj(w~a1PV(M%~92Lw#^9+8LuhYHUKVClQ$&kTWL<~P;>}Ea4&}y|O
zvtO5TXZwQPdcP2%)oiBNwypfY@MyOTgdU8HjF@P~m*sVCS5REgRSImZFzt_zsujK8
zzwF%sxMN5N24IH>z~$`h>_&J~rDSA`kGtgDFAd5bE!S)S0$R-qZQtXR@MXjL4<$GaeRiCK;MC6TJ|ykBER9Fur#3qwcZ
zwUjXVF2A>2<>+b7sns#on1_+{0cwAaGE|$J)C-xmJgL#+CAERIyA=#-I@(-=;;h5R
zjqU^8_h6brOdq`>;Bg32UXz^JPju<_H7(KT$|i4rxRib~_dT&a+a$H#WOb{fmbwnK
zU%8=WFhF{ycg+!
z!;SsHT=}DWyZZn{%qo@r1yI0dK2W_#^Knfxt?vbW0YTNvttg26)gX?(H2q34pAxQ0KC0Te}(@uTv0c8ez4#PcV5&<8fUuNLG|
z*1I&Ni@6E9YzXkD23V3MfqL~vFYHc@CZ~VFGoWGc7k$4$-ZQYpku|&r{>`9vi`gwM
zu1bsvf=B!`nPi>RR2{zwYk)_LIzHT_nc44(pRXk{ehR@)b$z$vbHvWJsry5xUYs(P
zn`;8)e9^NSB`WBx8CpZDbj|!G3_xWEE}Blz@k-{TvEC!yL{*M4L_Z_B0b1xRZ)<+W
zyS+Z^lt}j?U}Y^dTAIpD80blJyJ?LQp-Nrb*vM4NUxqzldE$73FIiqzMSgXLD+Ygv
z5gQx7T;jG!pk+6Q)=QG@$pr-t@jvP50mQG?K(OIwBqWE^tzwXG-c)tV56Ma-Jxr5Ba>z;S&Uf-R16;u*Y@?~>|u(pF&mBAIOQ^zB!*AK+FB^Bha*2$
zHHLy;!@4!6e7$2&GN}b&Cno5$jxxcp~}!wZ&af4~pW8-A-{a`jDU#~uZBi!G
zchMev@8c)seEKJ2tDxXRI1my3tDg|(C@#KfUVLjT*ILE2(d~fdbe9v2ktz`6Ouvub
z%||^hl0Dx~+=}un`*M0^JUz_A!*jT|l+km!8RWL3@(V1GY@Y5(smB8i^w9yxwW=xM
zxCboO*&E>D8bJ|x%WiaBzG#K0fSoF7p5m(zlmF3kJ(iqOGMK{1I`>mLvBwE>B=Db=
zbm1M2sxEIH>s>0?43pN$dmaBG>+xK=p!zg#hu&-BK(vk!csLJy##i<%O)*z
z&3cWXo(XRC2~@a?WTV$XP^9a4`vVM2Y`iu$&X#a_bA!2JBx+|8*Y7?f-(h#Kj!%9w
z*y!SL+05`yU!RPth6Tb$N?Lk#;7`oA*P?cNT2fMv+*seBoG?vm1?{LkQF|1hz1oun
z*bnJq&@l5w%Xy5(5^D_!&GoQs#i2cJbV9;(>PnLDWthQgx8EJDV`Ww6n6GS}C8e*x
z?!#77U)T0wA_|Jd!r}|SVdP)A!D=`7RUSQuh?092r^&;_8}lcL%H8}cg{^bxsp&?g
z-R!6u~S}0NmI7rjD3yz*684gR8%Vu5g
z0!Ec;f=Xu6H>%Tm1jbhxMsItza{M7aazq9vS^t(7J0cS0h^;++HV9VXr?$`BiNf5!$
zhyd#1qucfV8($gA`jJZ@QaL4s2^vn!t!2qtRCV?r#!{w5V-4(Mq&ka(&yx
z)jO?~{A1~X+doVx0Z(Du7(D!u>ysxf0XJpJgp6X4tI6-3jTV0VPHen=c{$}2c{aKBfd|t**)-;XpAEE
zHdtF~MpS!MSLzfy%lJ9wB=E&`-A-JaR6&0>^%FEt<~_hIuu3>Sg-P
zTz2z9#kvh+_6^cuWJZfM)AUSCJ@yTM!SL0w@WrHQYZughdZjZ`yzNIEn`E-0dDr2J
z&~9-dOR6I&nzsg&$|@$zW@Dqv4bq*&?<#S8G+#NR+%9A30mVO*NS#E)1vWPZjKDRU
z3OaBD9DC}0p}#H0Y5ibNOHP6P-fK$DC+Ub!Z+aaS?)q?u$M`01s3S9$HzPr0V%od0
z@Ld3hjV$J`6y-agNf*=mU)7t}A2iK@+)u7S-Hc{j>G1%V+EE?9}I<@i_zF?&ZxhU>Pu3nk~SI>?6zGcGE^=B7lkLB71cz4fn=1F%
ziWWbFA+KzQ!~3<$boy(Bx@X@PQ@O{@`ezC|Ckk;ib~C=YF0qenYi^-2@k;LZ^gC+H
zO_ldDmJO?Dp?~YW;hH++`s-r8lrb~lJ+eG1zGT~b(y^9+0fyugm|^69Mo7lgD6>TA{>kk-{_nAyU$2v_gW
zkMt>$$ikUlwtM(2*K5wyEBP%#c{0D;C%9R>uk#_z^tPH7!-@ReXbsdzbi-Ghc`SLl
zD^$HF;KDMZlMMSY-1Xl;m%P5k$A5kf;FEUIfYSjFkkZ!QZ
zsEcthd4((N$7#$+I%TA`K@4J=E{+>MvNk+WKX_&=yskAfM{3Th%0oFYs}Qc9Ty4Gz
z9?hvOx##0fe}exdu-rxuhoCB2Xx+Q_+Pu{@b+tA=&CEQymMxthoJw4g%GV#EwFKpW
zZFJGSk^$N;w*PmPccSvlPbJ}U1cJAa}CimLOc
z?7yCVdFou0&Q2kT19PFJj*Lu3LtxV<@Xuwm)-dGRAkTXpt9dAa!r=Kv5o@rkXxP(#
zCNf$gzl)hsqK2&&z0S7MpeiqMmfF}Nxnaq12DSU7&(+z$
zRT`A4Al5IUkMd#(r!lOU4*X}kW)WCxOus=_+r(`mi*QV^
z0$xQ+b1KixH-6G@$Ikk%cN2+?_%JL*H6*RPeOF0SNTx*Ncq<=vanlFVt>a;`($H(H
zTqMt8exf+S_}(fSR~5-^6e$bQT(q~|!$;_bfj=Vow?=$ssXPN-BmlGD7g+n!**$L2
zLchohX4{S6(!iP@j=5}vgSmD)bH%v^voXVd%(TCg`g;MUmb*Tm%I}&*G-I?;!`cLT
z{Oz?Vt>1s3AnH-)f;FgAK3*g3uHZDRF~4I8AE%4ZqqmctFFi@5Hx@JY$^H%3qT5NN
z+^Hu%P9)Wsk3wNX&eC9b+?eHc`Qd+z$~bALz;XSF^j0^?YCekOUXn3$ReH2N^?>7^
zpc77NwUGMm6Ej_GO6pZt>M%*bwIm4&{$oMh?8$&<{u!j5HLW?V`9XO=0NNi64Hc;m
zYc%bT?2F?j$O%D4Jp--{Jgk6#HiFCd$^n+3+A~M2fRd)!bRLcnZM{Fv4q@_h*hc1n
zRj`%vP~hn8UZn1zZq$zCZ$g))n_A|;U%NZ6m;Bzps=L~lp*jYaSE>X?1tDirj$8ep
zl=&V_u`_XJwR;qGw;DqgbBhBH7Kaxx{x@y985b|Z_s8Jz^mK#C58wKB9HfE`#q|<+
z-c$3u3Peq4e=5d%T2;#)@Zh}f*|RL5dIFRzXj*HE>A`SMD#VmyLeAon@L`zk9@0CqMzH|7(LYjd;oUND^3GFAbf
zKc>^QWgR_xAhSf4(KfQaiI$4qk7vFpthRSD-~X8|u6$XV7N9rLB(s&_!X1S+$!c2F
zVtw(hqcC4QFIse5G^3=zb`%CAvp04WEY-^)wwvWqreo1x4v2XoS5yX>iHG9reqwtDRnrSkM|%%P{ExfzEyg>
zh&CYTt#8jk?Dj9#-9fCl3jicCsok*K`~`aTAuxT~4cBf2f#P>%A*N5>AH8~PSR+98
zz3ZuSRi-yoh)ICB(J;GcpAR2O)@cgS)&t2XI_8MUR8$6FaeCv7a>tY6|q>qch
zbC77c?UIHP&b#6_k)uX%)x;#uS`_t^=+JB9C5Z|g%jWXpFzy1FW-sUvu8%ozpW3q+
z#YTCC7Sn!lOHObr6z^iznp%ewtV2JaE7wDcO|OqeT?{SEo-?gWWdn`=TX>>}3&
z0WV&eyk()lgDBt81NF%MD9^3i5V>d&^Gmkf=&_m)+YrHwqpDb_c^?LHa}T5vS}NdY
zKi&*~>@q;aU)9;Gr2^+Ymkv-_nv=LD2lR2f_2H?axq6pSZf{&TPX1LgpY@N+MtLvC
zH&e`0cQ~+*y3K)8!?dfuKc@$gk^}Kv4ipvQ%hC3AK-czu`rT-X~*D|KQMYxA0G0C9t=2uB~
z1h>pKf`w7RGwJ)*!`x1tZc;DbC}ENi*_giBX?QIr0Il*0#Ri-eelpM!08It~Dq%?P`7UIAoEl2`yKKxV
zaTYPe9C4Sd`hGkRVUsGzs)R6C{8Bv>=|Ww61tm&@O7vuv0~G64#{+je&%<1rEjEmZ
z;8PRz{0UbrnC5$Bi8(wRf_V$g$;K9bdIJCX(#+d=#cEN}QFytVZGBQvJUD>^kFygG
zrSv>z4idqJ)=QZ{?tu0$WoC9WypO2s7$@CkBrKcbfQAy}J3|d!>}EMau_WJ|3utx4
zpd(U<$f=_Q_@}xu9gux}ph=iAu&_4G=}Ro4mghZPT3L^&7uM52M<`KbVi4l90UkXY
z`!mfKU7~vy*KPkE6zr4AEBe%#3OsB3re%r6`Q6n2!
z8uRw~cs_vuu^w5(3~pa#6n`e9FcTuo0An??7rH5)m@baMJ))u&t)Wkdf#F5NWaqU0U^DFv4q#Q_EC_BwT
zUP#+GKPsi1^%WJwcw1CvRqlrP2Wt=$Yfy7^S4pSXl<{mq&03N&<#t^@2-f!%F>1U^
z(4>sj6m`~15MgvaiXbX{d=&TS9F;oV=^i2(s_DeZ?1HKKrT36$*RCb6azT%J@Ehi%mj!8-
z%AnRE;d7aYk#>+xJq|!j>AEBdTx1OpNzFk~A*y;-iRRQqL?#FrPe|%c40USVdbPk|
zF!&EyASVRj`N%@K)IJILhGzU2G_nYeQvDC`m*Cio|9*T$a^b$Dv_x5h*=amvMZZ8t
zm9agB-|AduBQG@)ge*Y*X?{KREAHc)G0tRunV@l{9|#c^0Ku4N2$GGe>L3zv_}t2?
zw7szlK~uLsmA=8oDloF_Kx1RO6+t1YA`D|jW>Dm8IJ6*-dMVznnzyvet%$~0d6}hZ
zi1pBm*{kS=Y|a0#_&y&=9kBU4ISrchZ^oE6=dADz`mB^T_=sS4(sd868qXhcCIid{
zDDHhIw}&OGcO~XZ#h|i}2Jr@I@~^BynasY{BO{Npoy3wsVj4ceGz&I;J5N4A>G(oW
z6YdP&aNEP%QsJg&FT0T=h4d{Sv-dN~K<^NpzN1W^QSSb
zkvq?TIU~b`ayIx25v5c(2@A5J8?Z+XaFh*db$1qmP^`K&c3gc0+0X2T)@|U=?Pade
zT&+*dM)BAH^;&B)fqFNgEds#9JFJRow|OBGu6oyrHebnuYCp<701rnJ_ninj=^?m>
z)c%g2tls)AAwh4>XP`ud8P3q9P5en4W`G|iDckwqGoM9t
z3p(KNuC!0^nR+f{`tgYbwtJSnNuZFaKr0_KZh0$Eas@My#P|w0DcHci2(#F1WBi|Gv{clVWbLjl}a|pGZ_E3*r}2<`5K}d
z5^4Z;%5xC}xOG(84UBY&ns1gJ8Szbt6wa?|@vyW2Jja!0{qE(IME3PafEWafJ=+et
z`HenM-gaoN=X_XDl_xaxGpmUGa?ZNk{4F|TPH=5mj9Q{cq&8%BHtFBEz7(!A2Vier
zRfY5zfANLw{r_g1Fk$N>SP241tV;O+zYV{2=(RX3ar4WSDn?GJKAR`;JrBp^*AE%M
zPtg3BiuQwsLLKJp$^m?(fY-I28~~ZI8LGR;0CW^8m}H0Tm6;f1_m&+OK=nW*d^O9T
zO5c+MD_7?-=Iq=1!nvFvPer-mMDSocKY^m6!$OT)~817
z!jTlK@$Jhqqt9$YK7J@GC>Xt<;O!!miNoaOod}2#WA|2kfHerG_4Sxu?WEVQ0>*D^Z%V-b3
z0$9}2IYZ?O!y|?}iE@7QA^=bsV@JO5L0rWO;gb>kfaOq|+1CH>J`+DrO(Xo=4th4b
zyUXoT7kJ6>+9R4*?$!)6dGV-uu_sLH2Ji!;Dt-&(1PJL}v;Eq{Ih
z+Zf~N4fym0K#pEPKhQfC0B*YpUf}V^?`l3Zsjcp*{S?=k8(fd}msKU)dR2%Ms4%1~
zIMC7cg&t6h|`ToOK@O^{pyc0BbCJ-e*PJK>mU~$@hJ7qy@k_X5&Q-JmIIQkEAfRUa|zDQFSQt_0g;-
zHTBNp6ncbb6B0=Q-~oPO;1&=ijj2RLJwuSMZbjL$UZJ{v=XZ!PmitAqYJ?=TKagA$^F{XUBdnHqQrfx~`*Qp)S
zVv8vl->00{H#_&=zG)9$_C&u~QC+OEIw&bwiRO^xlo8R63S3A``x%KFqQssy((K5o
zXh{8bx${44H+))8C3Ie8VoFWLKVn;xEKksHwbJ=@v7p~}9ZG_k*;{X{e6bj`j0C)GdHje5xF-#7`1RVe0ey}gr|LH}guITJ5lywGo}33)BBV}(w_
zT2k5mB-91gT58^B(opx8py1xY*)r(;KdfMUjv`QqiJn&uW;H<^nxqo&HsQIKYFfic%@_I&Ld?uAM)|8)@!t++4Df&MT
z^pT!{;b>|#yvl`GW~1l79w-9o8}2`Mz*Sy2TfNegoouzo8rR`SP8MHfwV_<{k1a$E
z%06xF0JAz;2H~&|Iokni{hGw|``4^GCo7HB*?hd**3;i7^onfuSpWG!@JuE6>$x^z
z5cnZ@AqABp|K992c7qGnel8}IfI--D5BuN$&iANz-rqCJ-)OI{GJ!Dq->U~GtEw7;
ze<>sv9~Kw`FY6@he}1*d(P(3hDIaeYk@f#_9ekGgQ22EYni>nq5&t!D&`PGK{g9I#
z89o2_4AsBy(D}7)9nr-{R0&X#Wf=rYcHzIqQ{A?7=Qzm8fJOiN=l}gAPVIka$NvGJ
zf4uX5hsJ4|{16KYo&`4=lm6e!@EHzTY_$9C8P~}F&#)e~WZ=X|GC}wQ@5|ct8SkUu)X{WfktM?a!
zf|Ane%)-V%{Li?!Z)F%_WrtF6g?>~Ha3MJdYrxnwM?a!
zFlMW{8XQo3D-L=DBG2jQ>7TN(v6;-SF>80{WftW}ckFy?_y)6?Z9BmcpkSc3z}Q_f
zL*7hq!~~7OVg3CdyN6a+Rj1sYgF5i9-
zB!C5tB?)?Fte2IsyVz8u^!9$p$jXZAlTCcu8f70D8yjL-REuJoV2{EnQ|?VcP96s4
z8NQ&Ur3Rb1*-0Ms;05`C&w#O(C|H80^1+^uZkMrqTRKAUVui@R+L7nm>8Ta^!3f+5
zis!2WHfh`hR7J;0rdmh7jE;`Nr%M_99Zsc!$;ilv$;!%}pgKo1-JNSO>NSzAc85!-
zs1PK%Z^TYw=8ELz~|`nn8#`iGAnI}%+N%)vot
z<)&Eh!gYUCtTeFE4c3gLl+-)$HD%@HBe_bi%6GGqeMs7pIJd{LvFe<62pt-suM@iI
zwP7lj%g$oDotD+s%U6#n!U=FH30>?eK7$se{$%0B$=Xs-O(<|N=co<_QCQ9+Aff1Y
zeSZcn-a1oh*-lRH{;|eJl%;kJ_w?_Gh=matIj!F0RlDecjEwx7)d2DO;$SfYmM$Jn
zLGF+UrBCS2Yjn2zf0_ghn4|^Fv=0RW@hGc6exDOahdVAqs+I{`R{8d
zZmJc>gh<;CftrS9V4X$+y2RppCCwl{?o>VRLi!X9?JnAU|7Y3Q*qHtKw5ieIQtO|=
zL2*Sz+?CZ;1vRyxygYhyi%~h@J5EN98gx=_^os>gmWYUme&>UR6WMs)@NJpQv3pb{
zaRN$8mWks0d`rWx`?NA~UvF={z}lf^U_b-M4Mmz*Y=Is#`QqA-iF{mtt)b62P|_vB
z#cgbuJx>4nb##b|N=T$9U8>Osrjld3?^8~KuwfaE9
z8@zJUA(w_Ku;zY5MSTTW{hd;nf=Jhm>i%lT*AUF>Wg;{*t8u7
zxOf4KSno-QiBWNL6N0*5;x`U2Oa|ft;6>fm8#g1Pn>2IXpw9m(STbCLZ#K!cr~)N#
zZ2*K&f{y4`XP6E+c?-6ZZkDT(&O}zbO~wS5Wurm;8@rhEISC`wBNVn
z6)o+DW}fV*DEv9_QDQbjQOPqfOKGaW9{m~nBXBQRV6hH3OGh)dwgsTYJM+I1@wV^*
z6}q&)6v%n)Anxw&5R!*hC3W>+5H>GfP*>&`6;&06hK6$Z+L)P{MQ6K%rPI
z^YjHf`{=F2l0TLZ@i8|CJ3BTWo<9H?N&tlKCa%tBZFPh#|A+05)$i^vnyVYX{FQTY
z;ob+%4uUlvOY^NmdB^bFf7x3@L*qA(Ed_JU(wCIpSAbt%?-ZkcRy|lV+d6OuvB>8n
zesRfE_(ns1T|`i|w6wJ5py`IyVeL=K%)w+K>HT4l@N*_64BMtF6M5&h+?PWV(q#Fl
zlwPcBzG?_>ot!vj6L^=aKT7M>i;CWt_|tp`ZvULg7EE^<$gt<>tUqYlaf_Udnr6SP
zU4`;n`91+BX^{alkOP4$(5M?q#msj^*!f`Gevd9?a>JU8;Hf}Vq8tbpHsMbrz-
z15|JHaF(3?C@0rlSiNAe@LUxTZvaYDRo0|%vH?0+GBPu%`1wiiuFpiOZRT%n(lepI
zs6YgiHp?|~ZpYx6;^P79Bbdu_G6e*9iEs)rO-+*H<6~Bne&Uk@|37~uZ?9p^;yOAy
z@d?-UwZ-$%-0sJpoc3l2Ao6;8;ox)sMa=+(kylX(DAK71U6ISb!7S(4Oi=wc!5B13AlmXQVT*yR~I$7UpV0r
z|4xh`GlmT)51azkyX>_A3&mOM#ixN6TN6H!@WwI2R}Bo1SUnjM?(PaBEj1mYP*zrc
z&diLtwYBx9xA#4$dX{~&jt?*e0$K3bVQSv1KCP4%UBlw%ZIf(x_lV@-^Q#A+`;+AO
zhb4BnLEW}`MWHa?v{4)2B1zoWsj?
zMKhsNk+k3tmuDLe*49k-=he+`Tp*xIl7yx46xU=hA!Mhh9ux50VNMLkjsDh)Mc;4?
zQtpaRe-Yg8X7+%aeD1=m38L`$