[cpholguera]

This PR adds a new dynamic test for sensitive data exposed through Android accessibility services, and reworks the existing text input masking test around a new knowledge item.

New: Runtime Exposure of Sensitive Data Through Accessibility Services

• @MASTG-TEST-0x01 (tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0x01.md, MASWE-0040, [dynamic, logs, manual], L2): verifies what a running app actually exposes to an enabled AccessibilityService, rather than inferring it from the UI implementation. The tester installs a test service that declares canRetrieveWindowContent="true" and isAccessibilityTool="false", exercises the sensitive input flows with a known marker value, and records the observed AccessibilityEvent and AccessibilityNodeInfo properties (getText(), getContentDescription(), getHintText(), getStateDescription(), isPassword(), and isAccessibilityDataSensitive() on API 34+).

  Because it observes the accessibility representation, the test applies to Android Views, Jetpack Compose, and cross-platform frameworks alike. The evaluation section deliberately treats isPassword() as supporting information only, does not fail TextObfuscationMode.RevealLastTyped by itself, and accounts for accessibilityDataSensitive nodes being withheld from non-tool services on Android 14+.

• @MASTG-KNOW-0x02 — Accessibility Services (knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0x02.md): background on accessibility events and nodes, canRetrieveWindowContent, the isAccessibilityTool classification (API 31+), accessibility data sensitivity (API 34+), Compose password semantics and how isPasswordObfuscated relates to (and is separate from) visual masking, the distinction between UiAutomation/UI Automator and an app-provided AccessibilityService, and how cross-platform frameworks map onto Android accessibility APIs.

• @MASTG-DEMO-0x01 — Password Exposed Through Accessibility Metadata (kind: fail): a victim app with a visually masked password field whose accessibility delegate copies the plaintext into the node's content description.

• @MASTG-DEMO-0x02 — Accessibility Service Reading Sensitive Input (kind: attack): the attacker app implementing a non-tool AccessibilityService that observes the MASTestApp package and logs the exposed accessibility metadata, plus run.sh to collect the logcat output.

Updated: Text Input Field Masking

• @MASTG-TEST-0316 is retitled from "App Exposing User Authentication Data in Text Input Fields" to "References to APIs Hiding Sensitive Data in Text Input Fields" and is now linked to the new @MASTG-KNOW-0x01. The API-specific prose and code snippets move out of the test into the knowledge item, so the test focuses on observation and evaluation. The evaluation criteria are broadened beyond Compose to also cover Android View input types and transformations, Compose TextField with PasswordVisualTransformation, and masking configuration changed programmatically without an intentional user action.

• @MASTG-KNOW-0x01 — Text Input Field Masking in Android (knowledge/android/MASVS-PLATFORM/MASTG-KNOW-0x01.md): the Android View InputType password variations and PasswordTransformationMethod, Compose secure text fields and TextObfuscationMode, PasswordVisualTransformation, and the recent behavioral changes — the Default → System rename and the BasicSecureTextField default change in Compose Foundation 1.12.0-beta01/1.12.0, and the Material 3 1.5.0-alpha28 switch from RevealLastTyped to System.

  This is the reason the old test text was inaccurate: it stated that SecureTextField defaults to RevealLastTyped, which is no longer the case.

Open items before merge

• Assign final IDs for the placeholders MASTG-TEST-0x01, MASTG-KNOW-0x01, MASTG-KNOW-0x02, MASTG-DEMO-0x01, and MASTG-DEMO-0x02 (and update the cross-references in the test, demo, and knowledge files accordingly).
• demos/android/MASVS-PLATFORM/MASTG-DEMO-0x02/output.txt is still a placeholder and must be replaced with a real adb logcat -s MASTG-A11Y:I capture from a device/emulator run, recording the Android version, IDE version, and device used.
• The attacker service's AccessibilityServiceInfo metadata resource is currently smuggled in through filepaths.xml, reusing the only resource file the demo build automation supports replacing. The build automation should be extended with a dedicated accessibility_service_config.xml instead; this workaround is documented inline in the demo.
  -[ ] Align with https://github.com/OWASP/mastg/pull/3679/changes

---

AI Tool Disclosure

Check exactly one option.

• This contribution does not include AI-generated content.
• This contribution includes AI-generated content.

If AI tools were used to generate or substantially modify code or text, complete the following.

• AI tools used: Claude Code.
• Models and versions: Claude Opus 5.