From 324448d33e7777a5f6f47ff331e38caae1dfa597 Mon Sep 17 00:00:00 2001
From: Ajin Abraham <ajin25@gmail.com>
Date: Thu, 22 Apr 2021 17:45:52 -0700
Subject: [PATCH] Hotfix: Fix Windows Run, Tarfile Path

---
 mobsf/DynamicAnalyzer/views/android/analysis.py   | 11 +++++++++--
 .../DynamicAnalyzer/views/android/tests_frida.py  |  3 ++-
 mobsf/MobSF/init.py                               |  2 +-
 mobsf/MobSF/utils.py                              | 15 +++++++++++++++
 requirements.txt                                  |  2 +-
 run.bat                                           |  3 ++-
 6 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/mobsf/DynamicAnalyzer/views/android/analysis.py b/mobsf/DynamicAnalyzer/views/android/analysis.py
index 2584ee37..2c14e60e 100644
--- a/mobsf/DynamicAnalyzer/views/android/analysis.py
+++ b/mobsf/DynamicAnalyzer/views/android/analysis.py
@@ -1,4 +1,3 @@
-# -*- coding: utf_8 -*-
 """Perform Analysis on Dynamic Analysis Data."""
 import io
 import logging
@@ -9,6 +8,7 @@ import tarfile
 from pathlib import Path
 
 from mobsf.MobSF.utils import (
+    clean_filename,
     is_file_exists,
     is_pipe_or_link,
     python_list,
@@ -159,6 +159,13 @@ def get_log_data(apk_dir, package):
             'traffic': traffic}
 
 
+def safe_paths(tar_meta):
+    """Safe filenames in windows."""
+    for fh in tar_meta:
+        fh.name = clean_filename(fh.name)
+        yield fh
+
+
 def get_app_files(apk_dir, md5_hash, package):
     """Get files from device."""
     logger.info('Getting app files')
@@ -173,7 +180,7 @@ def get_app_files(apk_dir, md5_hash, package):
         shutil.rmtree(untar_dir)
     try:
         with tarfile.open(tar_loc, errorlevel=1) as tar:
-            tar.extractall(untar_dir)
+            tar.extractall(untar_dir, members=safe_paths(tar))
     except FileExistsError:
         pass
     except Exception:
diff --git a/mobsf/DynamicAnalyzer/views/android/tests_frida.py b/mobsf/DynamicAnalyzer/views/android/tests_frida.py
index 55d9d17e..67f28588 100644
--- a/mobsf/DynamicAnalyzer/views/android/tests_frida.py
+++ b/mobsf/DynamicAnalyzer/views/android/tests_frida.py
@@ -253,7 +253,8 @@ def apimon_analysis(app_dir):
             to_decode = None
             if (api['class'] == 'android.util.Base64'
                     and (api['method'] == 'encodeToString')):
-                to_decode = api['returnValue'].replace('"', '')
+                if api.get('returnValue'):
+                    to_decode = api['returnValue'].replace('"', '')
             elif (api['class'] == 'android.util.Base64'
                   and api['method'] == 'decode'):
                 to_decode = api['arguments'][0]
diff --git a/mobsf/MobSF/init.py b/mobsf/MobSF/init.py
index 6ed895a3..df1c3af9 100644
--- a/mobsf/MobSF/init.py
+++ b/mobsf/MobSF/init.py
@@ -10,7 +10,7 @@ from mobsf.install.windows.setup import windows_config_local
 
 logger = logging.getLogger(__name__)
 
-VERSION = '3.4.1'
+VERSION = '3.4.2'
 BANNER = """
   __  __       _    ____  _____         _____ _  _   
  |  \/  | ___ | |__/ ___||  ___| __   _|___ /| || |  
diff --git a/mobsf/MobSF/utils.py b/mobsf/MobSF/utils.py
index 64c3a845..22e1f14c 100755
--- a/mobsf/MobSF/utils.py
+++ b/mobsf/MobSF/utils.py
@@ -9,6 +9,7 @@ import platform
 import re
 import shutil
 import signal
+import string
 import subprocess
 import stat
 import sqlite3
@@ -551,3 +552,17 @@ def get_http_tools_url(req):
     scheme = req.scheme
     ip = req.get_host().split(':')[0]
     return f'{scheme}://{ip}:{str(settings.PROXY_PORT)}'
+
+
+def clean_filename(filename, replace=' '):
+    if platform.system() == 'Windows':
+        whitelist = f'-_.() {string.ascii_letters}{string.digits}'
+        # replace spaces
+        for r in replace:
+            filename = filename.replace(r, '_')
+        # keep only valid ascii chars
+        cleaned_filename = unicodedata.normalize(
+            'NFKD', filename).encode('ASCII', 'ignore').decode()
+        # keep only whitelisted chars
+        return ''.join(c for c in cleaned_filename if c in whitelist)
+    return filename
diff --git a/requirements.txt b/requirements.txt
index 603fe580..5a561982 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -24,4 +24,4 @@ androguard==3.3.5
 apkid==2.1.2
 frida==14.2.14
 # For semgrep
-ruamel.yaml>=0.16.0  # pyup: ignore
+ruamel.yaml>=0.16.0<0.17  # pyup: ignore
diff --git a/run.bat b/run.bat
index 96cbf58b..30f66c9b 100644
--- a/run.bat
+++ b/run.bat
@@ -6,11 +6,12 @@ goto :run
 :usage
 SET conf=0.0.0.0:8000
 :run
+set venv=.\venv\Scripts\activate
 set server=.\venv\Scripts\waitress-serve.exe
 if exist %server% (
   echo Running MobSF on %conf%
+  %venv%
   %server% --listen=%conf% --threads=10 --channel-timeout=3600 mobsf.MobSF.wsgi:application
-  exit /b 0
 ) else (
   echo [ERROR] Incomplete setup. Please ensure that setup.bat completes without any errors.
   pause