4.2.0

[ajinabraham]

Describe the Pull Request

• Added malware lookup using SHA2 with VirusTotal, Triage, Hybrid Analysis, and MetaDefender.
• Fixed permissions of extracted files to counter anti-analysis techniques.
• Resolved APK parsing errors in androguard.
• Handled exceptions in string_on_binary.
• Optimized APK ZIP analysis for improved performance.
• Fixed untar permission errors in dynamic analysis.
• Added bypass for SSL pinning in Boye's AbstractVerifier.
• Updated bypass for SSL pinning in Appmattus's CertificateTransparencyInterceptor.
• Introduced SSL pinning detector script.
• Improved Frida intent dumper script.
• Added Frida intent tracer script.
• Introduced timeouts for all HTTP calls.
• Added django-q2-based asynchronous scans for Android and iOS binaries and source code.
• Fixed bug in certificate analysis.
• Enabled asynchronous scans in Docker Compose setup.
• Performed QA for Android and iOS SAST modules.
• Added Frida script for audit-webview.
• Introduced Frida script for trace-javascript-interface.
• Upgraded libsast for improved file reading, multiprocessing, and multithreading.
• Fixed PNG crush issues on Darwin systems.
• Performed QA on the home screen UI.
• Updated httptools and libsast dependencies.

Checklist for PR

• Run MobSF unit tests and lint tox -e lint,test
• Tested Working on Linux, Mac, Windows, and Docker
• Add unit test for any new Web API (Refer: StaticAnalyzer/tests.py)
• Make sure tests are passing on your PR

Additional Comments (if any)

DESCRIBE HERE

[github-actions]

👋 @ajinabraham
Thank you for sending this pull request ❤️.
Please make sure you have followed our contribution guidelines. We will review it as soon as possible

To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. This can be achieved by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root folder. This approach will prevent path traversal attacks by ensuring that the path does not escape the intended directory.

1. Normalize the path using os.path.normpath.
2. Check that the normalized path starts with the intended base directory.
3. If the check fails, raise an exception or handle the error appropriately.

To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We can achieve this by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root folder. This will prevent any path traversal attacks.

1. Normalize the logcat_file path using os.path.normpath.
2. Check that the normalized path starts with the expected base directory (app_dic['app_dir']).
3. If the check fails, raise an exception or handle the error appropriately.

To fix the problem, we need to ensure that the constructed file paths are contained within a safe root directory. This can be achieved by normalizing the path and verifying that it starts with the expected base directory. Specifically, we will:

1. Normalize the app_path using os.path.normpath.
2. Check that the normalized path starts with the expected base directory.

To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We will normalize the path using os.path.normpath to remove any ".." segments and then check that the normalized path starts with the root folder. This will prevent path traversal attacks.

1. Normalize the app_path using os.path.normpath.
2. Check that the normalized app_path starts with the predefined base directory (settings.UPLD_DIR).
3. If the check fails, raise an exception or handle the error appropriately.

To fix the problem, we need to ensure that the constructed file paths are contained within a safe root directory. This can be achieved by normalizing the path using os.path.normpath and then checking that the normalized path starts with the intended base directory. This approach will prevent directory traversal attacks by ensuring that any ".." segments are resolved and the final path is within the allowed directory.

1. Normalize the constructed path using os.path.normpath.
2. Check that the normalized path starts with the base directory.
3. Raise an exception or handle the error if the path is not within the allowed directory.

To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We can achieve this by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root folder. This will prevent any path traversal attempts.

1. Normalize the app_path using os.path.normpath.
2. Check that the normalized app_path starts with the intended root directory (settings.UPLD_DIR).
3. If the check fails, raise an exception or handle the error appropriately.

To fix the problem, we need to ensure that the constructed file paths are contained within a safe root folder. We can achieve this by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root folder. This will prevent any path traversal attacks.

1. Normalize the constructed paths using os.path.normpath.
2. Check that the normalized paths start with the expected root folder.
3. Raise an exception if the paths are not within the expected root folder.

To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We will normalize the path using os.path.normpath and then check that the normalized path starts with the root folder. This will prevent directory traversal attacks and ensure that the file operations are performed within the intended directory.

1. Normalize the app_path using os.path.normpath.
2. Check that the normalized path starts with the expected base directory.
3. If the check fails, raise an exception or handle the error appropriately.

To fix the problem, we need to ensure that the path variable used in the onerror function is validated to prevent path traversal attacks. We can achieve this by normalizing the path and ensuring it is within a predefined safe directory.

1. Normalize the path using os.path.normpath to remove any ".." segments.
2. Check that the normalized path starts with the root directory of the application data.

To fix the problem, we need to validate the tar_loc path before using it to open the tar file. We can achieve this by ensuring that the tar_loc path is contained within a safe root directory. This involves normalizing the path and checking that it starts with the expected base directory.

1. Normalize the tar_loc path using os.path.normpath.
2. Check that the normalized path starts with the expected base directory.
3. Raise an exception if the path is not valid.

To fix the problem, we need to ensure that the untar_dir path is validated before it is used. We can achieve this by normalizing the path and checking that it is within a safe root directory. This approach will prevent directory traversal attacks by ensuring that the constructed path does not escape the intended directory.

1. Normalize the untar_dir path using os.path.normpath.
2. Check that the normalized path starts with the intended root directory.
3. Raise an exception if the path is not within the intended directory.

To fix the problem, we need to ensure that the untar_dir path is validated before it is used. We can achieve this by normalizing the path and ensuring it is contained within a predefined safe directory. This will prevent any path traversal attacks.

1. Normalize the untar_dir path using os.path.normpath.
2. Check that the normalized path starts with a predefined safe directory.
3. Raise an exception if the path is not within the safe directory.

To fix the problem, we need to ensure that the untar_dir path is validated before it is used to create directories or extract files. We can achieve this by normalizing the path and ensuring it is contained within a safe root directory. This approach will prevent directory traversal attacks by ensuring that the constructed path does not escape the intended directory.

1. Normalize the untar_dir path using os.path.normpath.
2. Check that the normalized path starts with the intended root directory.
3. Raise an exception if the path validation fails.

To fix the problem, we need to ensure that the app_path is validated and sanitized before being used in file operations. This can be achieved by normalizing the path and ensuring it is within a predefined safe directory.

1. Normalize the app_path using os.path.normpath to remove any ".." segments.
2. Check that the normalized path starts with the expected base directory.
3. If the path is not valid, raise an exception or handle the error appropriately.

To fix the problem, we need to validate the src parameter to ensure it does not contain any malicious input that could lead to path traversal vulnerabilities. The best way to do this is to normalize the path using os.path.normpath and then check that the normalized path starts with a predefined safe root directory. This ensures that the path is contained within a safe directory and does not traverse outside of it.

1. Normalize the src path using os.path.normpath.
2. Check that the normalized path starts with a predefined safe root directory.
3. Raise an exception if the path is not within the safe root directory.

To fix the problem, we need to validate the paths constructed from user-controlled data before using them to access files. We will normalize the path using os.path.normpath and ensure that the resulting path is within a safe root directory. This will prevent directory traversal attacks and ensure that only intended files are accessed.

1. Normalize the bin_path using os.path.normpath.
2. Check that the normalized bin_path starts with the expected root directory.
3. Apply similar validation to the icon_file path before using it.

To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We can achieve this by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root folder. This will prevent any path traversal attacks and ensure that the file operations are performed within the intended directory.

1. Normalize the outfile path using os.path.normpath.
2. Check that the normalized path starts with the settings.DWD_DIR directory.
3. If the check fails, raise an exception or handle the error appropriately.

To fix the problem, we need to ensure that the constructed file paths are validated before being used. We can achieve this by normalizing the paths and ensuring they are within a safe root directory. Specifically, we will:

1. Normalize the bin_path and icon_file paths using os.path.normpath.
2. Ensure that the normalized paths start with the expected root directory (bin_dir).

To fix the problem, we need to ensure that the constructed file path is safe and does not allow path traversal or access to unintended files. We can achieve this by normalizing the path and verifying that it is contained within a safe root directory.

1. Normalize the outfile path using os.path.normpath to remove any ".." segments.
2. Check that the normalized path starts with the root directory (settings.DWD_DIR).
3. If the path is not within the root directory, raise an exception or handle the error appropriately.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[ajinabraham]

LGTM, CodeQL findings are false positives.