CodeQL documentation

Android sensitive keyboard cache

ID: java/android/sensitive-keyboard-cache
Kind: problem
Severity: warning
Precision: medium
   - security
   - external/cwe/cwe-524
Query suites:
   - java-security-extended.qls
   - java-security-and-quality.qls

Click to see the query in the CodeQL repository

When a user enters information in a text input field on an Android application, their input is saved to a keyboard cache which provides autocomplete suggestions and predictions. There is a risk that sensitive user data, such as passwords or banking information, may be leaked to other applications via the keyboard cache.


For input fields expected to accept sensitive information, use input types such as "textNoSuggestions" (or "textPassword" for a password) to ensure the input does not get stored in the keyboard cache.

Optionally, instead of declaring an input type through XML, you can set the input type in your code using TextView.setInputType().


In the following example, the field labeled BAD allows the password to be saved to the keyboard cache, whereas the field labeled GOOD uses the "textPassword" input type to ensure the password is not cached.

<?xml version="1.0" encoding="utf-8"?>

    <!-- BAD: This password field uses the `text` input type, which allows the input to be saved to the keyboard cache. -->

    <!-- GOOD: This password field uses the `textPassword` input type, which ensures that the input is not saved to the keyboard cache. -->


  • © GitHub, Inc.
  • Terms
  • Privacy