mirror of
https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
synced 2026-10-11 22:50:09 +00:00
Ajin AbrahamandCursor
6592454800
* Harden path traversal checks for Windows root-relative escapes. Reject POSIX/Windows absolute paths in is_path_traversal and require post-join containment at icon, network-config, and archive extraction sinks. Co-authored-by: Cursor <[email protected]> * Restrict network security config names to a basename. CodeQL flagged the manifest-derived join; reduce the resource name first so path construction cannot escape xml_dir. Co-authored-by: Cursor <[email protected]> * Use os.path.basename for CodeQL-recognized path sanitization. Path.name did not clear py/path-injection taint; basename plus existing containment checks keep the network-config read inside xml_dir. Co-authored-by: Cursor <[email protected]> * Drop CodeQL-appeasement basename sanitization from network config reads. is_safe_path after join already rejects traversal, absolute, and Windows root-relative names; CodeQL py/path-injection is a false positive. Co-authored-by: Cursor <[email protected]> * Bound androguard ZIP member decompression Use the configured per-file ZIP limit for apkinspector reads and cap actual raw-DEFLATE output. Keep decompression-limit failures out of the tampered-entry fallback so malicious compressed data cannot be treated as stored bytes. Co-authored-by: Cursor <[email protected]> * Reject inactive SAML users before ACS group updates. Existing accounts mapped from a valid IdP assertion should not have groups replaced or be passed to login() when is_active is False. Co-authored-by: Cursor <[email protected]> * Return the ACS error page for inactive users instead of raising Exception. Co-authored-by: Cursor <[email protected]> * Fix iOS plist-derived path traversal Select and validate one contained IPA app bundle, reject unsafe plist executable values, and guard icon and Mach-O inputs before access. Harden equivalent source icon, plist, library, and dynamic icon paths. Co-authored-by: Cursor <[email protected]> * correct version * fix CSRF in dynamic analysis actions Co-authored-by: Ajin Abraham <[email protected]> * document HTTPTools host header SSRF advisory Co-authored-by: Ajin Abraham <[email protected]> * prepare 4.5.3 dependency release Co-authored-by: Ajin Abraham <[email protected]> * support LIEF 0.17 Mach-O symbol types Co-authored-by: Ajin Abraham <[email protected]> * pin GitHub Actions to immutable commits Co-authored-by: Ajin Abraham <[email protected]> --------- Co-authored-by: Cursor <[email protected]>
69 lines
2.1 KiB
TOML
69 lines
2.1 KiB
TOML
[tool.poetry]
|
|
name = "mobsf"
|
|
version = "4.5.3"
|
|
description = "Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis."
|
|
keywords = ["mobsf", "mobile security framework", "mobile security", "security tool", "static analysis", "dynamic analysis", "malware analysis"]
|
|
authors = ["Ajin Abraham <[email protected]>"]
|
|
license = "GPL-3.0-only"
|
|
readme = "README.md"
|
|
repository = "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
|
|
documentation = "https://mobsf.github.io/docs/"
|
|
packages = [{ include = "mobsf", format = ["sdist", "wheel"]}]
|
|
classifiers = [
|
|
"Development Status :: 5 - Production/Stable",
|
|
"Intended Audience :: Developers",
|
|
"Topic :: Security",
|
|
"Topic :: Software Development :: Quality Assurance",
|
|
]
|
|
|
|
[tool.poetry.urls]
|
|
"Bug Tracker" = "https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues"
|
|
|
|
[tool.poetry.scripts]
|
|
mobsf = "mobsf.__main__:main"
|
|
|
|
[tool.poetry.dependencies]
|
|
python = "^3.12"
|
|
django = ">=3.1.5"
|
|
rsa = ">=4.7"
|
|
requests = ">=2.25.1"
|
|
bs4 = ">=0.0.1"
|
|
colorlog = ">=4.7.2"
|
|
macholib = ">=1.14"
|
|
whitenoise = ">=6.8.2"
|
|
waitress = {version = ">=3.0.1", markers = "sys_platform == 'win32'"}
|
|
gunicorn = {version = ">=20.0.4", markers = "sys_platform != 'win32'"}
|
|
psutil = ">=5.8.0"
|
|
shelljob = ">=0.6.2"
|
|
asn1crypto = ">=1.4.0"
|
|
distro = ">=1.5.0"
|
|
ip2location = "^8.10.4"
|
|
pdfkit = ">=0.6.1"
|
|
google-play-scraper = ">=0.1.2"
|
|
apkid = "^3.0.0"
|
|
frida = ">=17.0.0"
|
|
frida-tools = "^14.3.0"
|
|
tldextract = ">=5.1.3"
|
|
openstep-parser = ">=2.0.1"
|
|
svgutils = ">=0.3.4"
|
|
arpy = ">=2.3.0"
|
|
apksigtool = "^0.1.0"
|
|
tzdata = "^2023.3"
|
|
http-tools = ">=6.0.0"
|
|
libsast = "^3.1.8"
|
|
paramiko = "^3.3.1"
|
|
six = ">=1.16.0"
|
|
python3-saml = "^1.16.0"
|
|
psycopg2-binary = "^2.9.10"
|
|
lief = ">=0.16.6,<0.18.0"
|
|
packaging = ">=24.2"
|
|
django-ratelimit = "^4.1.0"
|
|
django-q2 = "^1.7.4"
|
|
defusedxml = "^0.7.1"
|
|
bleach = "^6.2.0"
|
|
bcrypt = "4.0.1" # Pinned to avoid warnings with mitmproxy 12
|
|
|
|
[build-system]
|
|
requires = ["poetry-core"]
|
|
build-backend = "poetry.core.masonry.api"
|