Hotfix: Fix Windows Run, Tarfile Path

mobsf/DynamicAnalyzer/views/android/analysis.py

@@ -1,4 +1,3 @@
-# -*- coding: utf_8 -*-
 """Perform Analysis on Dynamic Analysis Data."""
 import io
 import logging
@@ -9,6 +8,7 @@ import tarfile
 from pathlib import Path
 
 from mobsf.MobSF.utils import (
+    clean_filename,
     is_file_exists,
     is_pipe_or_link,
     python_list,
@@ -159,6 +159,13 @@ def get_log_data(apk_dir, package):
             'traffic': traffic}
 
 
+def safe_paths(tar_meta):
+    """Safe filenames in windows."""
+    for fh in tar_meta:
+        fh.name = clean_filename(fh.name)
+        yield fh
+
+
 def get_app_files(apk_dir, md5_hash, package):
     """Get files from device."""
     logger.info('Getting app files')
@@ -173,7 +180,7 @@ def get_app_files(apk_dir, md5_hash, package):
         shutil.rmtree(untar_dir)
     try:
         with tarfile.open(tar_loc, errorlevel=1) as tar:
-            tar.extractall(untar_dir)
+            tar.extractall(untar_dir, members=safe_paths(tar))
     except FileExistsError:
         pass
     except Exception:

mobsf/DynamicAnalyzer/views/android/tests_frida.py

@@ -253,7 +253,8 @@ def apimon_analysis(app_dir):
             to_decode = None
             if (api['class'] == 'android.util.Base64'
                     and (api['method'] == 'encodeToString')):
-                to_decode = api['returnValue'].replace('"', '')
+                if api.get('returnValue'):
+                    to_decode = api['returnValue'].replace('"', '')
             elif (api['class'] == 'android.util.Base64'
                   and api['method'] == 'decode'):
                 to_decode = api['arguments'][0]

mobsf/MobSF/init.py

@@ -10,7 +10,7 @@ from mobsf.install.windows.setup import windows_config_local
 
 logger = logging.getLogger(__name__)
 
-VERSION = '3.4.1'
+VERSION = '3.4.2'
 BANNER = """
   __  __       _    ____  _____         _____ _  _   
  |  \/  | ___ | |__/ ___||  ___| __   _|___ /| || |  

mobsf/MobSF/utils.py

@@ -9,6 +9,7 @@ import platform
 import re
 import shutil
 import signal
+import string
 import subprocess
 import stat
 import sqlite3
@@ -551,3 +552,17 @@ def get_http_tools_url(req):
     scheme = req.scheme
     ip = req.get_host().split(':')[0]
     return f'{scheme}://{ip}:{str(settings.PROXY_PORT)}'
+
+
+def clean_filename(filename, replace=' '):
+    if platform.system() == 'Windows':
+        whitelist = f'-_.() {string.ascii_letters}{string.digits}'
+        # replace spaces
+        for r in replace:
+            filename = filename.replace(r, '_')
+        # keep only valid ascii chars
+        cleaned_filename = unicodedata.normalize(
+            'NFKD', filename).encode('ASCII', 'ignore').decode()
+        # keep only whitelisted chars
+        return ''.join(c for c in cleaned_filename if c in whitelist)
+    return filename

requirements.txt

@@ -24,4 +24,4 @@ androguard==3.3.5
 apkid==2.1.2
 frida==14.2.14
 # For semgrep
-ruamel.yaml>=0.16.0  # pyup: ignore
+ruamel.yaml>=0.16.0<0.17  # pyup: ignore

run.bat

@@ -6,11 +6,12 @@ goto :run
 :usage
 SET conf=0.0.0.0:8000
 :run
+set venv=.\venv\Scripts\activate
 set server=.\venv\Scripts\waitress-serve.exe
 if exist %server% (
   echo Running MobSF on %conf%
+  %venv%
   %server% --listen=%conf% --threads=10 --channel-timeout=3600 mobsf.MobSF.wsgi:application
-  exit /b 0
 ) else (
   echo [ERROR] Incomplete setup. Please ensure that setup.bat completes without any errors.
   pause