Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[4.2.8] Multiple APK Analysis improvements, general Code QA & bug fixes #2470

Merged
merged 7 commits into from
Nov 29, 2024

Conversation

ajinabraham
Copy link
Member

@ajinabraham ajinabraham commented Nov 28, 2024

Describe the Pull Request

  • Dockerfile QA
  • Add sdk-build-tools to Docker image
  • Replace biplist with plistlib std lib
  • Fixed a bug in iOS pbxproj parsing
  • Added support for APK parsing with aapt2/aapt
  • Use aapt/aapt2 as a fallback for APK parsing, files listing and string extraction
  • Added "started at" to Scan task queue model [FEATURE] Add test start time to task list API #2463
  • Tasks List API to return string status In the tasks list json the status field has different formats #2464
  • Replaced all minidom calls with defusedxml.minidom
  • Code QA on android manifest data extraction and parsing
  • Improved android file analysis
  • Improved android manifest data extraction
  • Improved android icon file extraction
  • Improved android app name extraction
  • Improved android appstore package details extraction
  • Android string extraction to fallback on aapt2 strings
  • APK analysis arguments refactor
  • Handle packed APKs, refactor unzip to handle malformed APK files
  • Handle reserved filename conflict during ZIP extraction
  • Explicit Zipslip handling during ZIP extraction
  • Graceful files extraction on unzip failure
  • Removed bail out and continue analysis
  • Moved androguard parsing to the start of static analysis
  • AndroidManifest.xml fallback from apktool to androguard during extraction and parsing
  • Updated Tasks UI to show started at

Checklist for PR

  • Run MobSF unit tests and lint tox -e lint,test
  • Tested Working on Linux, Mac, Windows, and Docker
  • Add unit test for any new Web API (Refer: StaticAnalyzer/tests.py)
  • Make sure tests are passing on your PR MobSF tests

Additional Comments (if any)

DESCRIBE HERE

Copy link

👋 @ajinabraham
Thank you for sending this pull request ❤️.
Please make sure you have followed our contribution guidelines. We will review it as soon as possible

mobsf/StaticAnalyzer/views/android/aapt.py Dismissed Show dismissed Hide dismissed
mobsf/StaticAnalyzer/views/android/converter.py Dismissed Show dismissed Hide dismissed
@ajinabraham ajinabraham merged commit 5ce7e23 into master Nov 29, 2024
9 checks passed
@ajinabraham ajinabraham deleted the handle_packed branch November 29, 2024 01:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant