id: exported-broadcast-receivers

info:
  name: Android Exported Broadcast Receivers in AndroidManifest.xml - Detect
  author: 7h3b4dger
  severity: info
  description: Detect exported Broadcast Receivers in AndroidManifest.xml (excluding disabled receivers and Google/Jetpack libraries)
  tags: android,file,exportedcomponents

file:
  - extensions:
      - xml

    matchers:
      - type: xpath
        part: body
        xpath:
          - "//receiver[@android:exported='true']"
          - "//receiver[@android:enabled!='false']"
        condition: and

    extractors:
      - type: xpath
        part: body
        attribute: android:name
        xpath:
          - "//receiver[@android:exported='true'and not(contains(@android:name, 'androidx')) and not(contains(@android:name, 'google'))]"
# digest: 4b0a00483046022100ea0a6074ea4f80d449daef641113ac85735df72bc419255d35f14c94c24ed1d6022100a063cee8432cd71af136b73f1f6cb7e4f1f8121f9699358d61dec8e3c0a76c3e:922c64590222798bb761d5b6d8e72950