rules-xamarin

RISK: Java.Interop bypasses Xamarin.Android's managed memory model — incorrect JNI references can cause native crashes or memory corruption. FIX: prefer Xamarin.Android's typed binding classes over raw JNI; if JNI is required, document the globalref/localref lifecycle carefully.

RISK: Accepting all TLS certificates disables server identity verification — any self-signed or expired certificate passes, enabling man-in-the-middle attacks on every HTTPS call from the app (CWE-295). FIX: implement proper certificate pinning via ServicePointManager or use a custom X509Chain validator that checks against a pinned leaf/CA hash.

RISK: Enabling cleartext (HTTP) traffic in the Android network security config transmits all data unencrypted — credentials, session tokens, and PII are visible on the network (CWE-319). FIX: disable cleartext globally; if a specific legacy endpoint requires HTTP, list only that domain in <domain-config> with an expiry plan to migrate to HTTPS.

RISK: android:debuggable=true in the Android manifest enables USB debugging on release builds — attackers with physical or ADB access can attach a debugger, dump memory, and extract credentials at runtime (CWE-489). FIX: remove the attribute from the manifest; the Xamarin/MAUI Debug configuration sets it automatically for debug builds only.

RISK: Hardcoded credentials in Xamarin C#/XAML source are committed to version control and embedded in the compiled APK/IPA — they can be extracted by decompiling the app with dotPeek or jadx (CWE-798). FIX: read secrets from secure platform storage (Android Keystore / iOS Keychain via Xamarin.Essentials SecureStorage), not from code.

RISK: Storing sensitive values (passwords, tokens, API keys) in Xamarin.Essentials Preferences or Application.Current.Properties writes them to SharedPreferences (Android) or NSUserDefaults (iOS) — both are accessible to other apps on rooted/jailbroken devices and backed up by default. FIX: use SecureStorage.SetAsync() which stores values in the platform secure enclave (Android Keystore / iOS Keychain).

RISK: Constructing SQLite queries by string concatenation ("SELECT * FROM t WHERE id = " + userId) is SQL injection (CWE-89) — any user-controlled value can terminate the query and append arbitrary SQL. FIX: use parameterized queries with SQLiteCommand.Parameters.AddWithValue('@id', userId) or the SQLite-net ORM's LINQ queries.

Xamarin.Forms.Init() is the Xamarin.Forms 2/3/4/5 bootstrapper. Xamarin.Forms reached end-of-life in May 2024. FIX: migrate to .NET MAUI (MauiApp.CreateBuilder / MAUI handlers) which receives ongoing security updates.