* feat: expose decompiled Android XML files via the view_source REST API
AndroidManifest.xml and other resource XML files are already
decompiled to apktool_out/ during static analysis, but there was no
way to fetch them through the API - only Java/Kotlin/smali sources
were reachable via view_source, and the standalone manifest_view
page is web-only with no API route.
Add an 'xml' type to view_source that points at apktool_out/, and
register it in the API dispatcher's Android type set (it also
covers eclipse/studio/apk/java/smali there; xml needs to be added
explicitly or it falls through to the iOS handler). .xml was
already in the allowed file extension list, so no other validation
changes were needed. Path traversal protection (is_safe_path) is
unchanged and applies to the new type like every other one.
Co-authored-by: alanhasn
* fix: safely support XML across Android scan types
Co-authored-by: Ajin Abraham <[email protected]>
* fix: validate view source API parameters
Co-authored-by: Ajin Abraham <[email protected]>
* Remove ViewSourceXMLTest
Co-authored-by: Ajin Abraham <[email protected]>
* fix: address CodeQL findings on Android view_source
Use validated form cleaned_data for path construction, keep
exception details out of JSON error responses, and annotate
post-validation path checks as known CodeQL false positives.
Co-authored-by: Ajin Abraham <[email protected]>
---------
Co-authored-by: Ajin Abraham <[email protected]>
Co-authored-by: Cursor Agent <[email protected]>
* fix: mitmdump process leaked and respawned on every dynamic analysis run
mobsf_agents_setup() called create_ca() unconditionally on every
dynamic analysis session, spawning a new detached mitmdump process
even when the CA cert already existed. The spawned process was also
never stopped, so it stayed running indefinitely after the session
ended.
create_ca() now waits for the CA cert file to appear and terminates
mitmdump once it's done, and the redundant unconditional call in
mobsf_agents_setup() is removed in favor of the existing
get_ca_file() check (already used by install_mobsf_ca()).
Co-authored-by: alanhasn
* reap mitmdump after CA generation
Co-authored-by: Ajin Abraham <[email protected]>
* Update environment.py
* Fix comment formatting in mobsf_agents_setup
Removed period from comment about installing MITM RootCA.
---------
Co-authored-by: Ajin Abraham <[email protected]>
Co-authored-by: Cursor Agent <[email protected]>
