HOTFIX: Android min SDK check on janus vulnerability detection (#2159)

* Android min SDK  check on janus check

* Update README.md

README.md

@@ -37,6 +37,14 @@ If you liked MobSF and find it useful, please consider donating.
 *It's easy to build open source, try maintaining a project once. Long live open source!*
 
 ## Documentation
+
+Quick setup
+
+```
+docker pull opensecurity/mobile-security-framework-mobsf:latest
+docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
+```
+
 [![See MobSF Documentation](https://user-images.githubusercontent.com/4301109/70686099-3855f780-1c79-11ea-8141-899e39459da2.png)](https://mobsf.github.io/docs)
 [![See MobSF Documentation in Chinese](https://user-images.githubusercontent.com/4301109/117404947-b09d0880-aebf-11eb-9db8-3d7360f47914.png)](https://mobsf.github.io/docs/#/zh-cn/)
 [![See MobSF Documentation in Japanese](https://user-images.githubusercontent.com/4301109/148662149-7ee671b4-66a2-4232-9522-276b8e88d924.png)](https://mobsf.github.io/docs/#/ja-jp/)
@@ -69,15 +77,6 @@ If you liked MobSF and find it useful, please consider donating.
 * For Project updates and announcements, follow [@ajinabraham](https://twitter.com/ajinabraham) or [@OpenSecurity_IN](https://twitter.com/OpenSecurity_IN).
 * Github Issues are only for tracking bugs and feature requests. Do not post support or help queries there. We have a slack channel for that.
 
-### Launching MobSF Rewards
-
-Contributed to MobSF? Here is a big thank you from our community to you. Claim your badge, a soulbound NFT and showcase them with pride. Let us inspire more folks !
-
-![MobSF Badges](https://aviyel.com/assets/uploads/rewards/share/project/7/512/share.png)
-
-[Claim Now!](https://aviyel.com/projects/7/mobile-security-framework/rewards)
-
-
 ### Static Analysis - Android
 
 ![mobsf_android_static_analysis](https://user-images.githubusercontent.com/4301109/95506503-f9b6c980-097d-11eb-803a-f88321e1feb7.gif)

mobsf/StaticAnalyzer/views/android/cert_analysis.py

@@ -18,6 +18,7 @@ from django.utils.html import escape
 
 logger = logging.getLogger(__name__)
 logging.getLogger('androguard').setLevel(logging.ERROR)
+ANDROID_8_1_LEVEL = 27
 
 
 def get_hardcoded_cert_keystore(files):
@@ -46,7 +47,7 @@ def get_hardcoded_cert_keystore(files):
         logger.exception('Getting Hardcoded Certificates/Keystores')
 
 
-def cert_info(app_dir, app_file):
+def cert_info(app_dir, app_file, man_dict):
     """Return certificate information."""
     try:
         logger.info('Reading Code Signing Certificate')
@@ -128,7 +129,9 @@ def cert_info(app_dir, app_file):
                 'Missing Code Signing certificate'))
         if a.is_signed_v1():
             status = 'high'
-            if a.is_signed_v2() or a.is_signed_v3():
+            api_level = int(man_dict['min_sdk'])
+            if ((a.is_signed_v2() or a.is_signed_v3())
+                    and api_level < ANDROID_8_1_LEVEL):
                 status = 'warning'
             findings.append((
                 status,

mobsf/StaticAnalyzer/views/android/static_analyzer.py

@@ -197,7 +197,8 @@ def static_analyzer(request, api=False):
                     elf_dict = elf_analysis(app_dic['app_dir'])
                     cert_dic = cert_info(
                         app_dic['app_dir'],
-                        app_dic['app_file'])
+                        app_dic['app_file'],
+                        man_data_dic)
                     apkid_results = apkid_analysis(app_dic[
                         'app_dir'], app_dic['app_path'], app_dic['app_name'])
                     tracker = Trackers.Trackers(