app-info 3.3.2 → 3.4.0

data/lib/app_info/android/signatures/v3.rb

@@ -30,25 +30,39 @@ module AppInfo
         # V3.1 Signature ID 0x1b93ad61
         V3_1_BLOCK_ID = [0x61, 0xad, 0x93, 0x1b].freeze
 
-        attr_reader :certificates, :digests
+        attr_reader :certificates, :digests, :certificate_lineage
 
         def version
           Version::V3
         end
 
-        def verify
+        def verify(sdk: nil, **_options)
           begin
             signers_block = singers_block(V3_1_BLOCK_ID)
           rescue NotFoundError
             signers_block = singers_block(V3_BLOCK_ID)
           end
 
-          @certificates, @digests = verified_certs(signers_block)
+          @certificates, @digests = verified_certs(signers_block, sdk: sdk)
+          @verified = true
+        rescue SecurityError => e
+          @certificates ||= []
+          @digests ||= {}
+          code = if e.message.include?('content digest')
+                   :content_digest_mismatch
+                 elsif e.message.start_with?('SDK range')
+                   :sdk_range_mismatch
+                 elsif e.message.start_with?('Certificate lineage')
+                   :certificate_lineage_invalid
+                 else
+                   :signature_invalid
+                 end
+          add_verification_error(code, e.message)
         end
 
         private
 
-        def verified_certs(signers_block)
+        def verified_certs(signers_block, sdk: nil)
           unless (signers = length_prefix_block(signers_block))
             raise SecurityError, 'Not found signers'
           end
@@ -56,7 +70,7 @@ module AppInfo
           certificates = []
           content_digests = {}
           loop_length_prefix_io(signers, name: 'Singer', logger: logger) do |signer|
-            signer_certs, signer_digests = extract_signer_data(signer)
+            signer_certs, signer_digests = extract_signer_data(signer, sdk: sdk)
             certificates.concat(signer_certs)
             content_digests.merge!(signer_digests)
           end
@@ -65,13 +79,15 @@ module AppInfo
           [certificates, content_digests]
         end
 
-        def extract_signer_data(signer)
+        def extract_signer_data(signer, sdk: nil)
           # raw data
           signed_data = length_prefix_block(signer)
 
-          # TODO: verify min_sdk and max_sdk
-          min_sdk = signer.read(UINT32_SIZE)
-          max_sdk = signer.read(UINT32_SIZE)
+          min_sdk = signer.read(UINT32_SIZE).unpack1('V')
+          max_sdk = signer.read(UINT32_SIZE).unpack1('V')
+          if min_sdk > max_sdk || (sdk && !sdk.between?(min_sdk, max_sdk))
+            raise SecurityError, "SDK range #{min_sdk}..#{max_sdk} does not include #{sdk}"
+          end
 
           signatures = length_prefix_block(signer)
           public_key = length_prefix_block(signer, raw: true)
@@ -102,12 +118,8 @@ module AppInfo
                   'Signature algorithms don\'t match between digests and signatures records'
           end
 
-          previous_digest = content_digests.fetch(algorithems_digest)
+          verify_content_digest(content_digests, algorithems_digest)
           content_digests[algorithems_digest] = content_digest
-          if previous_digest && previous_digest[:content] != content_digest
-            raise SecurityError,
-                  'Signature algorithms don\'t match between digests and signatures records'
-          end
 
           certificates = length_prefix_block(signed_data)
           certs = signed_data_certs(certificates)
@@ -119,10 +131,139 @@ module AppInfo
           end
 
           additional_attrs = length_prefix_block(signed_data)
-          verify_additional_attrs(additional_attrs, certs)
+          @certificate_lineage = verify_v3_additional_attrs(additional_attrs, certs, pkey)
 
           [certs, content_digests]
         end
+
+        def verify_v3_additional_attrs(attrs, certs, public_key)
+          lineage = nil
+          loop_length_prefix_io(
+            attrs, name: 'Additional Attributes', raw: true, ignore_left_size_precheck: true
+          ) do |raw_attr|
+            if raw_attr.bytesize < UINT32_SIZE
+              raise SecurityError,
+                    'Certificate lineage attribute is malformed'
+            end
+
+            attr = StringIO.new(raw_attr)
+            id = attr.read(UINT32_SIZE).unpack1('V')
+            if id == SIG_STRIPPING_PROTECTION_ATTR_ID.pack('C*').unpack1('V')
+              raise SecurityError,
+                    'V2 signature indicates APK is signed using APK Signature Scheme v3, ' \
+                    'but none was found. Signature stripped?'
+            elsif id == SIG_PROOF_OF_ROTATION_ATTR_ID.pack('C*').unpack1('V')
+              raise SecurityError, 'Certificate lineage attribute is duplicated' if lineage
+
+              lineage = parse_certificate_lineage(attr.read, certs, public_key)
+            end
+          end
+          lineage
+        end
+
+        def parse_certificate_lineage(bytes, certs, public_key)
+          input = StringIO.new(bytes)
+          version = input.read(UINT32_SIZE)&.unpack1('V')
+          raise SecurityError, 'Certificate lineage has an invalid version' unless version == 1
+
+          nodes = []
+          previous_certificate = nil
+          previous_algorithm = nil
+          seen = {}
+          until input.eof?
+            node = parse_lineage_node(input)
+            verify_lineage_node(node, previous_certificate, previous_algorithm, seen)
+            nodes << node
+            previous_certificate = node[:certificate]
+            previous_algorithm = node[:signature_algorithm_id]
+          end
+
+          if nodes.empty? || nodes.last[:certificate].public_key.to_der != public_key.to_der
+            raise SecurityError, 'Certificate lineage does not end at the APK signer'
+          end
+          unless nodes.last[:certificate].to_der == certs.first.to_der
+            raise SecurityError, 'Certificate lineage does not match the APK certificate'
+          end
+
+          nodes
+        rescue AppInfo::Android::Signature::SecurityError
+          raise
+        rescue StandardError => e
+          raise SecurityError, "Certificate lineage is malformed: #{e.message}"
+        end
+
+        def parse_lineage_node(input)
+          node_io = StringIO.new(length_prefix_block(input, raw: true))
+          signed_data = length_prefix_block(node_io, raw: true)
+          flags = node_io.read(UINT32_SIZE)&.unpack1('V')
+          signature_algorithm_id = node_io.read(UINT32_SIZE)&.unpack1('V')
+          signature = length_prefix_block(node_io, raw: true)
+          unless flags && signature_algorithm_id && node_io.eof?
+            raise SecurityError,
+                  'Certificate lineage node is malformed'
+          end
+
+          signed_io = StringIO.new(signed_data)
+          certificate_der = length_prefix_block(signed_io, raw: true)
+          parent_algorithm_id = signed_io.read(UINT32_SIZE)&.unpack1('V')
+          unless parent_algorithm_id && signed_io.eof?
+            raise SecurityError,
+                  'Certificate lineage signed data is malformed'
+          end
+
+          {
+            certificate: AppInfo::Certificate.parse(certificate_der),
+            certificate_der: certificate_der,
+            flags: flags,
+            signature_algorithm_id: signature_algorithm_id,
+            parent_signature_algorithm_id: parent_algorithm_id,
+            signature: signature,
+            signed_data: signed_data
+          }
+        end
+
+        def verify_lineage_node(node, previous_certificate, previous_algorithm, seen)
+          if seen[node[:certificate_der]]
+            raise SecurityError, 'Certificate lineage contains duplicate certificates'
+          end
+
+          parent_algorithm = node[:parent_signature_algorithm_id]
+          if previous_certificate
+            unless parent_algorithm == previous_algorithm
+              raise SecurityError,
+                    'Certificate lineage algorithm chain is invalid'
+            end
+
+            verify_lineage_signature(previous_certificate, parent_algorithm, node[:signature],
+                                     node[:signed_data])
+          elsif parent_algorithm != 0 || !node[:signature].empty?
+            raise SecurityError, 'Certificate lineage first node is invalid'
+          end
+          seen[node[:certificate_der]] = true
+        end
+
+        def verify_lineage_signature(certificate, algorithm_id, signature, signed_data)
+          algorithm = [algorithm_id].pack('V').unpack('C*')
+          digest_name = algorithm_match(algorithm)
+          unless digest_name && algorithm_method(algorithm)
+            raise SecurityError,
+                  "Certificate lineage uses unsupported signature algorithm #{algorithm_id}"
+          end
+
+          options = if algorithm_method(algorithm) == :rsa &&
+                       [SIG_RSA_PSS_WITH_SHA256, SIG_RSA_PSS_WITH_SHA512].include?(algorithm)
+                      { rsa_padding_mode: :pss, rsa_pss_saltlen: OpenSSL::Digest.new(digest_name).digest_length }
+                    else
+                      {}
+                    end
+          verified = certificate.public_key.verify(
+            OpenSSL::Digest.new(digest_name), signature, signed_data, **options
+          )
+          raise SecurityError, 'Certificate lineage signature did not verify' unless verified
+        rescue OpenSSL::PKey::PKeyError => e
+          raise SecurityError,
+                "Certificate lineage signature could not be verified: #{e.message}"
+        end
       end
 
       register(Version::V3, V3)

data/lib/app_info/dsym.rb

@@ -56,7 +56,9 @@ module AppInfo
 
             dest_path = ::File.join(base_path, file_path)
             FileUtils.mkdir_p(::File.dirname(dest_path))
-            entry.extract(dest_path) unless ::File.exist?(dest_path)
+            next if ::File.exist?(dest_path)
+
+            entry.extract(file_path, destination_directory: base_path)
           end
         end
       }.call

data/lib/app_info/hap.rb

@@ -42,6 +42,50 @@ module AppInfo
       @module_info ||= JSON.parse(::File.read(module_info_path))
     end
 
+    alias module_data module_info
+
+    # @return [Hash]
+    def app_info
+      module_info['app'] || {}
+    end
+
+    # @return [Hash]
+    def module_metadata
+      module_info['module'] || {}
+    end
+
+    # @return [String, nil]
+    def main_element
+      module_metadata['mainElement']
+    end
+
+    # @return [Integer, nil]
+    def min_api_version
+      app_info['minAPIVersion']
+    end
+
+    # @return [Integer, nil]
+    def target_api_version
+      app_info['targetAPIVersion']
+    end
+
+    # @return [String, nil]
+    def compile_sdk_version
+      app_info['compileSdkVersion']
+    end
+
+    # @return [String, nil]
+    def api_release_type
+      app_info['apiReleaseType']
+    end
+
+    # @return [Hash]
+    def profiles
+      @profiles ||= profile_paths.to_h do |path|
+        [::File.basename(path, '.json'), JSON.parse(::File.read(path))]
+      end
+    end
+
     # @return [String]
     def module_info_path
       @module_info_path ||= ::File.join(contents, 'module.json')
@@ -49,12 +93,40 @@ module AppInfo
 
     # @return [String]
     def name
-      # TODO: The application display name should be determined by looking up
-      # the value of the variable named in the "label" field of the "module.json"
-      # file within the "resources.index" file.
-      pack_info.bundle_name
+      resource_value(app_info['label']) || pack_info.bundle_name
+    end
+
+    private
+
+    def resource_value(reference)
+      return reference unless reference.is_a?(String) && reference.start_with?('$string:')
+
+      resource_strings[reference.delete_prefix('$string:')]
+    end
+
+    def resource_strings
+      @resource_strings ||= begin
+        values = ::File.binread(resources_index_path).split("\x00")
+        values.each_with_index.filter_map do |value, index|
+          next unless value.match?(/\A[ -~]+\z/)
+
+          key = value
+          value = values[0...index].reverse.find { |candidate| candidate.match?(/\A[ -~]+\z/) }
+          next unless value
+
+          [key, value.force_encoding(Encoding::UTF_8)]
+        end.to_h
+      rescue Errno::ENOENT
+        {}
+      end
+    end
+
+    def resources_index_path
+      ::File.join(contents, 'resources.index')
     end
 
+    public
+
     def clear!
       return unless @contents
 
@@ -69,5 +141,9 @@ module AppInfo
       @icons_path = nil
       @icons = nil
     end
+
+    def profile_paths
+      Dir.glob(::File.join(contents, 'resources', '**', 'profile', '*.json'))
+    end
   end
 end

data/lib/app_info/happ.rb

@@ -3,7 +3,20 @@
 module AppInfo
   # parser for HarmonyOS .APP file
   class HAPP < HarmonyOS
-    def_delegators :default_entry, :icons
+    def_delegators :default_entry, :icons, :module_info, :app_info, :module_metadata,
+                   :main_element, :min_api_version, :target_api_version, :compile_sdk_version,
+                   :api_release_type, :profiles, :permissions, :use_permissions,
+                   :features, :use_features, :device_types, :components, :activities,
+                   :services, :schemes, :deep_links, :architectures, :native_codes
+
+    # @return [Array<HAP>]
+    def modules
+      @modules ||= pack_info.packages.filter_map do |package|
+        path = ::File.join(contents, "#{package['name']}.hap")
+        HAP.new(path) if ::File.file?(path)
+      end
+    end
+
     # @return [HAP]
     def default_entry
       hap_path = ::File.join(contents, "#{default_entry_name}.hap")
@@ -39,8 +52,10 @@ module AppInfo
 
       @default_entry_name = nil
       @default_entry&.clear!
+      @modules&.each(&:clear!)
 
       @default_entry = nil
+      @modules = nil
     end
   end
 end

data/lib/app_info/harmonyos.rb

@@ -9,6 +9,105 @@ module AppInfo
 
     def_delegators :pack_info, :build_version, :release_version, :bundle_id
 
+    alias identifier bundle_id
+    alias bundle_name bundle_id
+
+    # @return [String, nil]
+    def version
+      release_version || build_version
+    end
+
+    # @return [String, nil]
+    def display_name
+      name
+    end
+
+    # @return [Array<String>]
+    def permissions
+      values = module_info.dig('module', 'requestPermissions')
+      values = module_info['requestPermissions'] if values.nil?
+      Array(values).filter_map { |permission| permission_value(permission) }
+    end
+    alias use_permissions permissions
+
+    # @return [Array<String>]
+    def features
+      Array(module_info.dig('module', 'deviceTypes'))
+    end
+    alias use_features features
+
+    # @return [Array<String>]
+    def device_types
+      features
+    end
+
+    # @return [Array<Hash>]
+    def components
+      abilities + extension_abilities
+    end
+
+    # @return [Array<Hash>]
+    def activities
+      abilities.reject { |ability| ability['type'] == 'service' }
+    end
+
+    # @return [Array<Hash>]
+    def services
+      extension_abilities.select { |ability| ability['type'] == 'service' }
+    end
+
+    # @return [Array<String>]
+    def schemes
+      skills.flat_map { |skill| Array(skill['uris']) }.filter_map { |uri| uri['scheme'] }
+    end
+
+    # @return [Array<Hash>]
+    def deep_links
+      skills.flat_map { |skill| Array(skill['uris']) }
+    end
+    alias url_schemes schemes
+
+    # @return [Array<String>]
+    def architectures
+      native_codes
+    end
+
+    # @return [Array<String>]
+    def native_codes
+      Dir.glob(::File.join(contents, '**', 'libs', '*')).filter_map do |path|
+        ::File.basename(path) if ::File.directory?(path)
+      end.uniq
+    end
+
+    # @return [Array<AppInfo::HAP>]
+    def modules
+      [self]
+    end
+
+    def phone?
+      device_types.include?('phone')
+    end
+
+    def tablet?
+      device_types.include?('tablet')
+    end
+
+    def tv?
+      device_types.include?('tv')
+    end
+
+    def wearable?
+      device_types.any? { |type| %w[wearable watch].include?(type) }
+    end
+
+    def car?
+      device_types.include?('car')
+    end
+
+    def two_in_one?
+      device_types.include?('2in1') || device_types.include?('2-in-1')
+    end
+
     # return file size
     # @example Read file size in integer
     #   aab.size                    # => 3618865
@@ -61,5 +160,29 @@ module AppInfo
     def clear!
       not_implemented_error!(__method__)
     end
+
+    private
+
+    def module_info
+      return {} unless respond_to?(:module_data, true)
+
+      module_data
+    end
+
+    def abilities
+      Array(module_info.dig('module', 'abilities'))
+    end
+
+    def extension_abilities
+      Array(module_info.dig('module', 'extensionAbilities'))
+    end
+
+    def skills
+      components.flat_map { |component| Array(component['skills']) }
+    end
+
+    def permission_value(permission)
+      permission.is_a?(Hash) ? permission['name'] : permission
+    end
   end
 end

data/lib/app_info/helper/archive.rb

@@ -19,7 +19,9 @@ module AppInfo::Helper
           zip_file.each do |f|
             f_path = ::File.join(base_path, f.name)
             FileUtils.mkdir_p(::File.dirname(f_path))
-            zip_file.extract(f, f_path) unless ::File.exist?(f_path)
+            next if ::File.exist?(f_path)
+
+            zip_file.extract(f, f.name, destination_directory: base_path)
           end
         end
       end

data/lib/app_info/helper/signatures.rb

@@ -104,6 +104,20 @@ module AppInfo::Helper
       content_digests
     end
 
+    def verify_content_digest(content_digests, digest_name)
+      expected = content_digests[digest_name]&.fetch(:content)
+      unless expected
+        raise AppInfo::Android::Signature::SecurityError,
+              'Signature algorithms don\'t match between digests and signatures records'
+      end
+
+      actual = AppInfo::Android::Signature.compute_content_digest(@parser, digest_name)
+      return if expected.string == actual
+
+      raise AppInfo::Android::Signature::SecurityError,
+            "#{digest_name} content digest did not verify"
+    end
+
     # FIXME: this code not work, need fix.
     def verify_additional_attrs(attrs, _certs)
       loop_length_prefix_io(
@@ -166,12 +180,10 @@ module AppInfo::Helper
     SIG_VERITY_DSA_WITH_SHA256 = [0x25, 0x04, 0x00, 0x00].freeze             # 0x0425
 
     SIG_STRIPPING_PROTECTION_ATTR_ID = [0x0d, 0xf0, 0xef, 0xbe].freeze       # 0xbeeff00d
+    SIG_PROOF_OF_ROTATION_ATTR_ID = [0x8c, 0x6f, 0xa0, 0x3b].freeze # 0x3ba06f8c
 
     def best_algorithem(algorithems)
-      methods = algorithems.map { |algorithem| algorithem[:method] }
-      best_method = methods.max { |a, b| algorithem_priority(a) <=> algorithem_priority(b) }
-      best_method_index = methods.index(best_method)
-      algorithems[best_method_index]
+      algorithems.max_by { |algorithem| algorithem_priority(algorithem[:id]) || -1 }
     end
 
     def compare_algorithem(source, target)

data/lib/app_info/pe.rb

@@ -119,8 +119,8 @@ module AppInfo
 
     # @return [Hash{String => String}] imports imports of libraries
     def imports
-      @imports ||= pe.imports.each_with_object({}) do |import, obj|
-        obj[import.module_name] = import.first_thunk.map(&:name).compact
+      @imports ||= pe.imports.to_h do |import|
+        [import.module_name, import.first_thunk.map(&:name).compact]
       end
     end
 
@@ -188,15 +188,20 @@ module AppInfo
     # @return [String] binary_file path
     def binary_file
       @binary_file ||= lambda {
-        file_io = ::File.open(@file, 'rb')
-        return @file unless file_io.read(100) =~ Helper::FileTypeDetection::ZIP_RETGEX
+        zip_file = ::File.open(@file, 'rb') do |file|
+          file.read(100) =~ Helper::FileTypeDetection::ZIP_RETGEX
+        end
+        return @file unless zip_file
 
         zip_file = Zip::File.open(@file)
         zip_entry = zip_file.glob('*.exe').first
         raise NotFoundError, 'Not found .exe file in archive file' if zip_entry.nil?
 
         exe_file = tempdir(zip_entry.name, prefix: 'pe-exe', system: true)
-        zip_entry.extract(exe_file)
+        zip_entry.extract(
+          ::File.basename(exe_file),
+          destination_directory: ::File.dirname(exe_file)
+        )
         zip_file.close
 
         exe_file
@@ -308,7 +313,7 @@ module AppInfo
         @raw.each do |item|
           next unless item.is_a?(PEdump::VS_VERSIONINFO)
 
-          versions = item[:Children].select { |v| v.is_a?(PEdump::StringFileInfo) }
+          versions = item[:Children].grep(PEdump::StringFileInfo)
           next if versions.empty?
 
           @info = versions[0][:Children][0][:Children]

data/lib/app_info/png_uncrush.rb

@@ -163,9 +163,9 @@ module AppInfo
             newdata[pos] = data[pos, 1]
             pos += 1
             (0...width).each do |_|
-              newdata[pos + 0] = data[pos + 2, 1]
+              newdata[pos] = data[pos + 2, 1]
               newdata[pos + 1] = data[pos + 1, 1]
-              newdata[pos + 2] = data[pos + 0, 1]
+              newdata[pos + 2] = data[pos, 1]
               newdata[pos + 3] = data[pos + 3, 1]
               pos += 4
             end

data/lib/app_info/protobuf/resources.rb

@@ -43,8 +43,8 @@ module AppInfo
       end
 
       def define_packages(doc)
-        @packages = doc.package.each_with_object({}) do |package, obj|
-          obj[package.package_name] = Resources::Package.new(package)
+        @packages = doc.package.to_h do |package|
+          [package.package_name, Resources::Package.new(package)]
         end
       end
 
@@ -158,7 +158,7 @@ module AppInfo
         include Helper::Protobuf
         extend Forwardable
 
-        attr_reader :locale, :config, :original_value, :value, :type
+        attr_reader :config, :original_value, :value, :type
 
         def initialize(doc, package)
           @package = package

data/lib/app_info/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AppInfo
-  VERSION = '3.3.2'
+  VERSION = '3.4.0'
 end