Port MASTG-TEST-0030 (PendingIntent) to v2 format

[Copilot]

This PR closes #3073

Description

Ports MASTG-TEST-0030 (Testing for Vulnerable Implementation of PendingIntent) to MASTG v2 format.

New v2 test: tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0313.md

• Maps to MASWE-0066 (Insecure Intents)
• Static analysis test for PendingIntent API usage
• Covers mutability issues (FLAG_IMMUTABLE vs FLAG_MUTABLE) and implicit intent vulnerabilities
• References existing knowledge article @MASTG-KNOW-0024

New demo: demos/android/MASVS-PLATFORM/MASTG-DEMO-0076/

• Kotlin sample code demonstrating 4 PendingIntent scenarios (3 insecure, 1 secure)
• Reversed Java code for semgrep analysis
• New semgrep rule rules/mastg-android-pendingintent-mutable.yml to detect PendingIntent API usage
• Run script and sample output

Deprecated v1 test: Added deprecation metadata to tests/android/MASVS-PLATFORM/MASTG-TEST-0030.md

• status: deprecated
• covered_by: [MASTG-TEST-0313]

---

[x] I have read the contributing guidelines.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>MASTG v1->v2 MASTG-TEST-0030: Testing for Vulnerable Implementation of PendingIntent (android)</issue_title>
<issue_description>
Create a new MASTG v2 test covering for":

• Title: Testing for Vulnerable Implementation of PendingIntent
• ID: MASTG-TEST-0030
• Link: https://mas.owasp.org/MASTG/tests/android/MASVS-PLATFORM/MASTG-TEST-0030/
• Platform: android
• MASVS v1: ['MSTG-PLATFORM-4']
• MASVS v2: ['MASVS-PLATFORM-1']

Follow the guidelines
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes MASTG v1->v2 MASTG-TEST-0030: Testing for Vulnerable Implementation of PendingIntent (android) #2986

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[cpholguera]

@copilot please create a demo in demos/ for this test

[Copilot]

@copilot please create a demo in demos/ for this test

Created demo MASTG-DEMO-0076 with:

• Kotlin sample code demonstrating 4 PendingIntent scenarios (3 insecure, 1 secure)
• Reversed Java code for semgrep analysis
• New semgrep rule mastg-android-pendingintent-mutable.yml to detect PendingIntent API usage
• Run script and output

Commit: 0f7fe56

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• semgrep.dev
  • Triggering command: /home/REDACTED/.local/bin/pysemgrep osemgrep -c ../../../../rules/mastg-android-pendingintent-mutable.yml ./MastgTest_reversed.java (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)