[mateofumis]

This PR closes #1163

Description

This PR adds a new MASTG-KNOW for iOS covering App Notifications, and updates the current MASTG-KNOW-0054.

---

For the MASTG-KNOW-0054, this ended up being a larger rewrite rather than a small update because the current content predates the current MASTG Knowledge authoring guidelines and contains some platform behavior that is no longer fully accurate.

The main changes are:

• Moved the KNOW from MASVS-STORAGE to MASVS-PLATFORM to align it with MASWE-0037 and MASTG-TEST-0315, which covers sensitive data exposed via Android notifications.
• Reworked the Joker/Alien malware examples, attacker scenarios, 2FA recommendation, and testing/remediation guidance to align with the current Knowledge authoring guidelines. The underlying platform behavior is still covered: apps with notification access can receive notification content through NotificationListenerService and process or retain it according to their own implementation.
• Updated the NotificationListenerService description to clarify that notification events are delivered through system callbacks after the user grants notification access.
• Added the current lock screen notification visibility controls, including VISIBILITY_PUBLIC, VISIBILITY_PRIVATE, VISIBILITY_SECRET, and setPublicVersion.
• Added the POST_NOTIFICATIONS runtime permission introduced in Android 13 (API level 33).
• Added the Android 15 OTP redaction behavior, which prevents untrusted apps implementing NotificationListenerService from reading unredacted notification content when an OTP is detected.

Regarding WAMR: I think it's a useful real-world example of what access to notification content enables to an attacker, but I intentionally left it out of the KNOW because I think it fits better for a demo.

---

AI Tool Disclosure

Check exactly one option.

• This contribution does not include AI-generated content.
• This contribution includes AI-generated content.

---

Contributor Checklist

• I have read and understood the contributing guidelines.
• I followed the project style guide.
• I validated the technical correctness of my changes and understand the topic.
• This PR adds clear value and is not spam or low-effort content.

[mateofumis]

@cpholguera I think we can link the iOS KNOW file into the MASWE-0037 as I commented in the #1163 so both Android and iOS are mentioned.

[Copilot]

Copilot review overview

🟡 Changes recommended

Address the unresolved iOS authorization and local-notification coverage gaps, along with heading and wording updates.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Replace weak, unidiomatic introductory phrasing · New

What changed in this PR

Updates OWASP MASTG notification guidance for iOS and Android.

Changes:

• Adds iOS notification behavior and privacy controls.
• Rewrites and relocates Android notification guidance.
• Documents permissions, visibility controls, listener access, and OTP redaction.

File	Reviewed change
knowledge/​ios/​MASVS-PLATFORM/​MASTG-KNOW-0x01.md	Adds iOS notification concepts and privacy controls.
knowledge/​android/​MASVS-STORAGE/​MASTG-KNOW-0054.md	Removes the former Android article location.
knowledge/​android/​MASVS-PLATFORM/​MASTG-KNOW-0054.md	Adds the revised Android notification documentation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mateofumis]

I agree with Copilot's suggestion regarding the phrasing in the sentence "privacy implications that can be noted", so I'm applying that change.

Regarding the suggested iOS authorization and local-notification coverage, I don't think they are necessarily "gaps" that need to be addressed as part of this PR.

The mention of "local and remote app notifications" in the iOS KNOW is only intended as introductory context. The scope of this PR comes from #1163, which focuses on limiting the information exposed through notifications when they have a high confidentiality.

Authorization and additional details about local notifications are in fact valid topics, but I would prefer to include them only if they directly contribute to understanding notification content exposure and privacy behavior or implications.

I believe otherwise, expanding into those topics may move the KNOW away from the original scope of the issue.

My guess is that Copilot may see these as gaps because the Android KNOW mentions related topics such as notification permissions and listener access, but that doesn't necessarily mean equivalent coverage is needed on iOS.

[TheDauntless]

Some small comments, but generally looks good!