mirror of
https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
synced 2026-10-12 02:06:59 +00:00
f57a3c997c
* feat: expose decompiled Android XML files via the view_source REST API AndroidManifest.xml and other resource XML files are already decompiled to apktool_out/ during static analysis, but there was no way to fetch them through the API - only Java/Kotlin/smali sources were reachable via view_source, and the standalone manifest_view page is web-only with no API route. Add an 'xml' type to view_source that points at apktool_out/, and register it in the API dispatcher's Android type set (it also covers eclipse/studio/apk/java/smali there; xml needs to be added explicitly or it falls through to the iOS handler). .xml was already in the allowed file extension list, so no other validation changes were needed. Path traversal protection (is_safe_path) is unchanged and applies to the new type like every other one. Co-authored-by: alanhasn * fix: safely support XML across Android scan types Co-authored-by: Ajin Abraham <[email protected]> * fix: validate view source API parameters Co-authored-by: Ajin Abraham <[email protected]> * Remove ViewSourceXMLTest Co-authored-by: Ajin Abraham <[email protected]> * fix: address CodeQL findings on Android view_source Use validated form cleaned_data for path construction, keep exception details out of JSON error responses, and annotate post-validation path checks as known CodeQL false positives. Co-authored-by: Ajin Abraham <[email protected]> --------- Co-authored-by: Ajin Abraham <[email protected]> Co-authored-by: Cursor Agent <[email protected]>