Dangerous API

ID

kotlin.dangerous_api

Severity

low

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Other

Language

Kotlin

Tags

ASVS50:v15.1.1, CWE:676, NIST.SP.800-53, OWASP-ESAPI

Description

Reports calls to method names that the project has declared off-limits via the configurable forbidden list. Each entry is a dotted identifier such as Runtime.exec or File.createTempFile, and the rule fires when a call site matches either the bare method name or the Type.method form.

This is the Kotlin counterpart of java.dangerous_api, but implemented with a simpler string-match mechanism instead of the curated BAN001..BAN022 catalogue. The default list captures the BAN codes that translate cleanly to Kotlin / Android and are not already detected by another Kotlin rule.

Rationale

Many APIs are technically callable but discouraged for security reasons: temp file races (File.createTempFile), URL encoding round-trips that leak structure (URLEncoder/URLDecoder), unscoped property reading (Properties.*), and blocking system commands (Runtime.exec). Centralising the ban list replaces ad-hoc code review with a mechanical check that survives team turnover.

fun cleanup() {
    Runtime.getRuntime().exec("ls")             // FLAW — Runtime.exec banned
    val tmp = File.createTempFile("a", "b")     // FLAW — temp file race
}

Remediation

Replace the call with the approved alternative for your project (typically documented next to the forbidden entry in the team coding guide). If the call is legitimate at this specific site, remove the entry from the forbidden list rather than annotating the call.

The default ban list covers Thread.run, Runtime.exec, File.createTempFile, URLEncoder.encode, URLDecoder.decode, Properties.getProperty, and Properties.load. Codes that have a dedicated Kotlin rule are omitted (System.out.println is covered by kotlin.println_in_production, Throwable.printStackTrace by kotlin.print_stack_trace, Math.random / java.util.Random by kotlin.insecure_randomness, weak crypto by kotlin.weak_encryption_algorithm and kotlin.weak_hash_algorithm, java.sql.Statement by kotlin.sql_injection, and explicit GC by kotlin.explicit_gc_call). Customise the forbidden property to add or remove entries.

References