diff --git a/mobsf/MobSF/utils.py b/mobsf/MobSF/utils.py index b6a4f5320..d24e4367a 100755 --- a/mobsf/MobSF/utils.py +++ b/mobsf/MobSF/utils.py @@ -98,6 +98,17 @@ def upstream_proxy(flaw_type): return proxies, verify +def get_system_resources(): + """Get CPU and Memory Available.""" + # Get number of physical cores + physical_cores = psutil.cpu_count(logical=False) + # Get number of logical processors (threads) + logical_processors = psutil.cpu_count(logical=True) + # Get total RAM + total_ram = psutil.virtual_memory().total / (1024 ** 3) # Convert bytes to GB + return physical_cores, logical_processors, total_ram + + def print_version(): """Print MobSF Version.""" logger.info(settings.BANNER) @@ -122,6 +133,8 @@ def print_version(): dst_str = f' ({dist}) ' env_str = f'OS Environment: {os}{dst_str}{pltfm}' logger.info(env_str) + cores, threads, ram = get_system_resources() + logger.info('CPU Cores: %s, Threads: %s, RAM: %.2f GB', cores, threads, ram) find_java_binary() check_basic_env() thread = threading.Thread(target=check_update, name='check_update') diff --git a/mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py b/mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py index de314edb0..72df3199c 100644 --- a/mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py +++ b/mobsf/StaticAnalyzer/views/android/kb/android_manifest_desc.py @@ -219,12 +219,12 @@ 'name': 'Data SMS Receiver Set on Port: %s Found. [android:port]', }, 'high_intent_priority_found': { - 'title': 'High Intent Priority (%s)
[android:priority]', + 'title': 'High Intent Priority (%s) - {%s} Hit(s)
[android:priority]', 'level': 'warning', 'description': ('By setting an intent priority higher than another' ' intent, the app effectively overrides ' 'other requests.'), - 'name': 'High Intent Priority (%s). [android:priority]', + 'name': 'High Intent Priority (%s) - {%s} Hit(s) [android:priority]', }, 'high_action_priority_found': { 'title': 'High Action Priority (%s)
[android:priority] ', diff --git a/mobsf/StaticAnalyzer/views/android/manifest_analysis.py b/mobsf/StaticAnalyzer/views/android/manifest_analysis.py index b0081b14b..2d9a56f94 100755 --- a/mobsf/StaticAnalyzer/views/android/manifest_analysis.py +++ b/mobsf/StaticAnalyzer/views/android/manifest_analysis.py @@ -761,12 +761,18 @@ def manifest_analysis(app_dic, man_data_dic): dataport = data.getAttribute(f'{ns}:port') ret_list.append(('sms_receiver_port_found', (dataport,), ())) # INTENTS + processed_priorities = {} for intent in intents: if intent.getAttribute(f'{ns}:priority').isdigit(): value = intent.getAttribute(f'{ns}:priority') if int(value) > 100: - ret_list.append( - ('high_intent_priority_found', (value,), ())) + if value not in processed_priorities: + processed_priorities[value] = 1 + else: + processed_priorities[value] += 1 + for priority, count in processed_priorities.items(): + ret_list.append( + ('high_intent_priority_found', (priority, count,), ())) # ACTIONS for action in actions: if action.getAttribute(f'{ns}:priority').isdigit(): diff --git a/mobsf/StaticAnalyzer/views/common/appsec.py b/mobsf/StaticAnalyzer/views/common/appsec.py index b94e106bc..cb89fe56d 100644 --- a/mobsf/StaticAnalyzer/views/common/appsec.py +++ b/mobsf/StaticAnalyzer/views/common/appsec.py @@ -38,9 +38,20 @@ def common_fields(findings, data): sev = cd['metadata']['severity'] desc = cd['metadata']['description'] ref = cd['metadata'].get('ref', '') + + files_dict = cd.get('files', {}) + files_lines = [f'{file}, line(s) {lines}' + for file, lines in files_dict.items()] + all_files_str = '\n'.join(files_lines) + + if files_dict: + fdesc = f'{desc}\n{ref}\n\nFiles:\n{all_files_str}' + else: + fdesc = f'{desc}\n{ref}' + findings[sev].append({ 'title': cd['metadata']['description'], - 'description': f'{desc}\n{ref}', + 'description': fdesc, 'section': 'code', }) # Permissions diff --git a/poetry.lock b/poetry.lock index 46261efab..335a9c51d 100644 --- a/poetry.lock +++ b/poetry.lock @@ -146,19 +146,19 @@ files = [ [[package]] name = "attrs" -version = "24.2.0" +version = "24.3.0" description = "Classes Without Boilerplate" optional = false -python-versions = ">=3.7" +python-versions = ">=3.8" files = [ - {file = "attrs-24.2.0-py3-none-any.whl", hash = "sha256:81921eb96de3191c8258c199618104dd27ac608d9366f5e35d011eae1867ede2"}, - {file = "attrs-24.2.0.tar.gz", hash = "sha256:5cfb1b9148b5b086569baec03f20d7b6bf3bcacc9a42bebf87ffaaca362f6346"}, + {file = "attrs-24.3.0-py3-none-any.whl", hash = "sha256:ac96cd038792094f438ad1f6ff80837353805ac950cd2aa0e0625ef19850c308"}, + {file = "attrs-24.3.0.tar.gz", hash = "sha256:8f5c07333d543103541ba7be0e2ce16eeee8130cb0b3f9238ab904ce1e85baff"}, ] [package.extras] benchmark = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pympler", "pytest (>=4.3.0)", "pytest-codspeed", "pytest-mypy-plugins", "pytest-xdist[psutil]"] cov = ["cloudpickle", "coverage[toml] (>=5.3)", "hypothesis", "mypy (>=1.11.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"] -dev = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pre-commit", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"] +dev = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pre-commit-uv", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"] docs = ["cogapp", "furo", "myst-parser", "sphinx", "sphinx-notfound-page", "sphinxcontrib-towncrier", "towncrier (<24.7)"] tests = ["cloudpickle", "hypothesis", "mypy (>=1.11.1)", "pympler", "pytest (>=4.3.0)", "pytest-mypy-plugins", "pytest-xdist[psutil]"] tests-mypy = ["mypy (>=1.11.1)", "pytest-mypy-plugins"] @@ -348,13 +348,13 @@ beautifulsoup4 = "*" [[package]] name = "certifi" -version = "2024.8.30" +version = "2024.12.14" description = "Python package for providing Mozilla's CA Bundle." optional = false python-versions = ">=3.6" files = [ - {file = "certifi-2024.8.30-py3-none-any.whl", hash = "sha256:922820b53db7a7257ffbda3f597266d435245903d80737e34f8a45ff3e3230d8"}, - {file = "certifi-2024.8.30.tar.gz", hash = "sha256:bec941d2aa8195e248a60b31ff9f0558284cf01a52591ceda73ea9afffd69fd9"}, + {file = "certifi-2024.12.14-py3-none-any.whl", hash = "sha256:1275f7a45be9464efc1173084eaa30f866fe2e47d389406136d332ed4967ec56"}, + {file = "certifi-2024.12.14.tar.gz", hash = "sha256:b650d30f370c2b724812bee08008be0c4163b163ddaec3f2546c1caf65f191db"}, ] [[package]]