MALWARE_DB_URL pointed at malwaredomainlist.com, a service that has
been defunct for years, and nothing in the codebase ever fetched or
refreshed it - the only "data" behind malware_check() was a static
snapshot bundled in the repo whose newest entries date back to 2009.
That check ran on every scan against 16+ year old data without
anyone noticing, while maltrail_check() (which does self-update from
a live source) was the only domain check actually doing real work.
Removes malware_check(), its now-unused get_netloc() helper, the
stale bundled data file, and the unused MALWARE_DB_URL setting.
maltrail_check() is unaffected and remains the sole domain check.
Co-authored-by: alanhasn
Co-authored-by: Ajin Abraham <[email protected]>
* Fix DNS rebinding SSRF with pinned safe HTTP requests.
Add shared SSRF-safe request helpers that resolve once, connect to validated public IPs while preserving Host/SNI, reject redirects and internal addresses, and fail closed when upstream proxies would bypass pinning. Migrate assetlinks, Firebase, APK downloader, malware geolocation, and httptools shutdown to the hardened paths.
Co-authored-by: Cursor <[email protected]>
* remove test file
* Address SSRF hardening review feedback
Co-authored-by: Cursor <[email protected]>
* Avoid reassigning stop_httptools url parameter.
Use a dedicated proxy_kill_url so SonarCloud no longer flags
parameter reassignment before the initial value is used.
Co-authored-by: Cursor <[email protected]>
* bump version + deps
---------
Co-authored-by: Cursor <[email protected]>
* String extraction from APK, Source, AAR, JAR, SO
* Strings sections to show source of strings extracted
* Strings Refactor
* Support for independent .SO scan
* Android SCA rules update
* Entropies scan support for strings
* URLs/Email extraction refactor
* Bug Fixes
* iOS Source Report Fix
* Frida APK Patcher (WIP)
* Dynamic Analyzer identifier not available
* Settings env var not working fix for enabled by default features
* AppSec Score fix
* Recent `scan not completed` fix for iOS zip
