@guardbee/mcp-reverse-shield 0.1.1 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +39 -9
- package/TR.md +39 -9
- package/ZH.md +8 -3
- package/dist/__tests__/baseline.test.d.ts +2 -0
- package/dist/__tests__/baseline.test.d.ts.map +1 -0
- package/dist/__tests__/baseline.test.js +130 -0
- package/dist/__tests__/baseline.test.js.map +1 -0
- package/dist/__tests__/fixes.test.d.ts +2 -0
- package/dist/__tests__/fixes.test.d.ts.map +1 -0
- package/dist/__tests__/fixes.test.js +163 -0
- package/dist/__tests__/fixes.test.js.map +1 -0
- package/dist/__tests__/platforms.test.d.ts +2 -0
- package/dist/__tests__/platforms.test.d.ts.map +1 -0
- package/dist/__tests__/platforms.test.js +207 -0
- package/dist/__tests__/platforms.test.js.map +1 -0
- package/dist/__tests__/testFixtures.d.ts +16 -0
- package/dist/__tests__/testFixtures.d.ts.map +1 -1
- package/dist/__tests__/testFixtures.js +71 -0
- package/dist/__tests__/testFixtures.js.map +1 -1
- package/dist/apk.d.ts +1 -0
- package/dist/apk.d.ts.map +1 -1
- package/dist/apk.js +44 -10
- package/dist/apk.js.map +1 -1
- package/dist/baseline.d.ts +36 -0
- package/dist/baseline.d.ts.map +1 -0
- package/dist/baseline.js +87 -0
- package/dist/baseline.js.map +1 -0
- package/dist/cli.js +85 -37
- package/dist/cli.js.map +1 -1
- package/dist/config.d.ts +2 -0
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +6 -0
- package/dist/config.js.map +1 -1
- package/dist/fixes.d.ts +29 -0
- package/dist/fixes.d.ts.map +1 -0
- package/dist/fixes.js +396 -0
- package/dist/fixes.js.map +1 -0
- package/dist/frameworks.d.ts +19 -0
- package/dist/frameworks.d.ts.map +1 -0
- package/dist/frameworks.js +148 -0
- package/dist/frameworks.js.map +1 -0
- package/dist/index.d.ts +4 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/ios.d.ts +24 -0
- package/dist/ios.d.ts.map +1 -0
- package/dist/ios.js +170 -0
- package/dist/ios.js.map +1 -0
- package/dist/native.d.ts.map +1 -1
- package/dist/native.js +3 -0
- package/dist/native.js.map +1 -1
- package/dist/plist.d.ts +7 -0
- package/dist/plist.d.ts.map +1 -0
- package/dist/plist.js +156 -0
- package/dist/plist.js.map +1 -0
- package/dist/protoxml.d.ts +14 -0
- package/dist/protoxml.d.ts.map +1 -0
- package/dist/protoxml.js +96 -0
- package/dist/protoxml.js.map +1 -0
- package/dist/rules.d.ts +1 -1
- package/dist/rules.d.ts.map +1 -1
- package/dist/rules.js +65 -0
- package/dist/rules.js.map +1 -1
- package/dist/sarif.d.ts +2 -1
- package/dist/sarif.d.ts.map +1 -1
- package/dist/sarif.js +4 -1
- package/dist/sarif.js.map +1 -1
- package/dist/scanner.d.ts.map +1 -1
- package/dist/scanner.js +47 -7
- package/dist/scanner.js.map +1 -1
- package/dist/server.d.ts +2 -1
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +28 -5
- package/dist/server.js.map +1 -1
- package/package.json +5 -2
package/dist/protoxml.js
ADDED
|
@@ -0,0 +1,96 @@
|
|
|
1
|
+
function readVarint(buf, p) {
|
|
2
|
+
let value = 0;
|
|
3
|
+
let mul = 1;
|
|
4
|
+
for (let i = 0; i < 10; i++) {
|
|
5
|
+
if (p >= buf.length)
|
|
6
|
+
throw new Error("truncated varint");
|
|
7
|
+
const b = buf[p++];
|
|
8
|
+
value += (b & 0x7f) * mul;
|
|
9
|
+
if (!(b & 0x80))
|
|
10
|
+
return { value, next: p };
|
|
11
|
+
mul *= 128;
|
|
12
|
+
}
|
|
13
|
+
throw new Error("varint too long");
|
|
14
|
+
}
|
|
15
|
+
export function readFields(buf) {
|
|
16
|
+
const fields = [];
|
|
17
|
+
let p = 0;
|
|
18
|
+
while (p < buf.length) {
|
|
19
|
+
const key = readVarint(buf, p);
|
|
20
|
+
p = key.next;
|
|
21
|
+
const no = Math.floor(key.value / 8);
|
|
22
|
+
const wire = key.value & 7;
|
|
23
|
+
if (wire === 0) {
|
|
24
|
+
const v = readVarint(buf, p);
|
|
25
|
+
fields.push({ no, wire, num: v.value });
|
|
26
|
+
p = v.next;
|
|
27
|
+
}
|
|
28
|
+
else if (wire === 2) {
|
|
29
|
+
const len = readVarint(buf, p);
|
|
30
|
+
p = len.next;
|
|
31
|
+
if (p + len.value > buf.length)
|
|
32
|
+
throw new Error("truncated field");
|
|
33
|
+
fields.push({ no, wire, bytes: buf.subarray(p, p + len.value) });
|
|
34
|
+
p += len.value;
|
|
35
|
+
}
|
|
36
|
+
else if (wire === 5) {
|
|
37
|
+
p += 4;
|
|
38
|
+
}
|
|
39
|
+
else if (wire === 1) {
|
|
40
|
+
p += 8;
|
|
41
|
+
}
|
|
42
|
+
else {
|
|
43
|
+
throw new Error(`unsupported wire type ${wire}`);
|
|
44
|
+
}
|
|
45
|
+
}
|
|
46
|
+
return fields;
|
|
47
|
+
}
|
|
48
|
+
function parseAttribute(buf) {
|
|
49
|
+
let name = "";
|
|
50
|
+
let raw = "";
|
|
51
|
+
let resourceId = null;
|
|
52
|
+
for (const f of readFields(buf)) {
|
|
53
|
+
if (f.no === 2 && f.bytes)
|
|
54
|
+
name = f.bytes.toString("utf8");
|
|
55
|
+
else if (f.no === 3 && f.bytes)
|
|
56
|
+
raw = f.bytes.toString("utf8");
|
|
57
|
+
else if (f.no === 5 && f.num !== undefined)
|
|
58
|
+
resourceId = f.num;
|
|
59
|
+
}
|
|
60
|
+
const value = raw === "true" ? true : raw === "false" ? false : raw;
|
|
61
|
+
return { name, resourceId, value };
|
|
62
|
+
}
|
|
63
|
+
/** Elements in document order, the same shape parseAxml returns; null when the bytes are not an XmlNode. */
|
|
64
|
+
export function parseProtoXml(buf) {
|
|
65
|
+
const out = [];
|
|
66
|
+
const visitNode = (node, depth) => {
|
|
67
|
+
if (depth > 64)
|
|
68
|
+
return;
|
|
69
|
+
for (const f of readFields(node)) {
|
|
70
|
+
if (f.no !== 1 || !f.bytes)
|
|
71
|
+
continue;
|
|
72
|
+
let name = "";
|
|
73
|
+
const attributes = [];
|
|
74
|
+
const children = [];
|
|
75
|
+
for (const e of readFields(f.bytes)) {
|
|
76
|
+
if (e.no === 3 && e.bytes)
|
|
77
|
+
name = e.bytes.toString("utf8");
|
|
78
|
+
else if (e.no === 4 && e.bytes)
|
|
79
|
+
attributes.push(parseAttribute(e.bytes));
|
|
80
|
+
else if (e.no === 5 && e.bytes)
|
|
81
|
+
children.push(e.bytes);
|
|
82
|
+
}
|
|
83
|
+
out.push({ name, attributes });
|
|
84
|
+
for (const c of children)
|
|
85
|
+
visitNode(c, depth + 1);
|
|
86
|
+
}
|
|
87
|
+
};
|
|
88
|
+
try {
|
|
89
|
+
visitNode(buf, 0);
|
|
90
|
+
}
|
|
91
|
+
catch {
|
|
92
|
+
return null;
|
|
93
|
+
}
|
|
94
|
+
return out.length > 0 && out[0].name === "manifest" ? out : null;
|
|
95
|
+
}
|
|
96
|
+
//# sourceMappingURL=protoxml.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"protoxml.js","sourceRoot":"","sources":["../src/protoxml.ts"],"names":[],"mappings":"AAkBA,SAAS,UAAU,CAAC,GAAW,EAAE,CAAS;IACxC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACnB,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAC1B,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3C,GAAG,IAAI,GAAG,CAAC;IACb,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;QACb,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACxC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACb,CAAC;aAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/B,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;YACb,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK;YAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACtD,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK;YAAE,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC1D,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;YAAE,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC;IACjE,CAAC;IACD,MAAM,KAAK,GAA2B,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5F,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAQ,EAAE;QACtD,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO;QACvB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,SAAS;YACrC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,MAAM,UAAU,GAAoB,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK;oBAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;qBACtD,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK;oBAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;qBACpE,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,SAAS,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC"}
|
package/dist/rules.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
export type Severity = "critical" | "high" | "medium" | "low";
|
|
2
2
|
export type RuleCategory = "source-exposure" | "obfuscation" | "debug-surface" | "tamper-resistance" | "binary-hardening" | "secrets-in-artifact";
|
|
3
|
-
export type TargetKind = "web" | "electron" | "android" | "native" | "dotnet";
|
|
3
|
+
export type TargetKind = "web" | "electron" | "android" | "ios" | "native" | "dotnet" | "framework";
|
|
4
4
|
export interface Rule {
|
|
5
5
|
id: string;
|
|
6
6
|
name: string;
|
package/dist/rules.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,YAAY,GACpB,iBAAiB,GACjB,aAAa,GACb,eAAe,GACf,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;
|
|
1
|
+
{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,YAAY,GACpB,iBAAiB,GACjB,aAAa,GACb,eAAe,GACf,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpG,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,KAAK,EAAE,IAAI,EA0ZvB,CAAC;AAIF,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAIxC"}
|
package/dist/rules.js
CHANGED
|
@@ -215,6 +215,34 @@ export const RULES = [
|
|
|
215
215
|
exposes: "A test build left in a distributed package; such builds usually carry other debug affordances too.",
|
|
216
216
|
recommendation: "Distribute release builds only; testOnly is set by the IDE for run configurations.",
|
|
217
217
|
},
|
|
218
|
+
// ── iOS ───────────────────────────────────────────────────────────────────
|
|
219
|
+
{
|
|
220
|
+
id: "ios_debug_build",
|
|
221
|
+
name: "iOS app built with the Debug configuration",
|
|
222
|
+
target: "ios",
|
|
223
|
+
category: "debug-surface",
|
|
224
|
+
severity: "high",
|
|
225
|
+
exposes: "Unoptimised code in <App>.debug.dylib with full symbols and SwiftUI preview stubs: the closest thing to source a binary can be.",
|
|
226
|
+
recommendation: "Archive with the Release configuration (Product > Archive, or xcodebuild -configuration Release) before distributing.",
|
|
227
|
+
},
|
|
228
|
+
{
|
|
229
|
+
id: "ios_js_bundle_plaintext",
|
|
230
|
+
name: "React Native bundle shipped as plain JavaScript (iOS)",
|
|
231
|
+
target: "ios",
|
|
232
|
+
category: "source-exposure",
|
|
233
|
+
severity: "high",
|
|
234
|
+
exposes: "main.jsbundle is readable JavaScript containing the app's business logic.",
|
|
235
|
+
recommendation: "Enable Hermes for iOS (the default in recent React Native) so the bundle ships as bytecode.",
|
|
236
|
+
},
|
|
237
|
+
{
|
|
238
|
+
id: "ios_development_profile",
|
|
239
|
+
name: "IPA signed with a development provisioning profile",
|
|
240
|
+
target: "ios",
|
|
241
|
+
category: "debug-surface",
|
|
242
|
+
severity: "medium",
|
|
243
|
+
exposes: "get-task-allow in the embedded profile: on registered devices the app can be attached to with a debugger.",
|
|
244
|
+
recommendation: "Export with an App Store, Ad Hoc or Enterprise distribution profile; development profiles are for local testing.",
|
|
245
|
+
},
|
|
218
246
|
// ── Native binaries (ELF, Mach-O, PE) ──────────────────────────────────────
|
|
219
247
|
{
|
|
220
248
|
id: "native_debug_info",
|
|
@@ -324,6 +352,43 @@ export const RULES = [
|
|
|
324
352
|
exposes: "Stack buffer overflows overwrite return addresses without detection.",
|
|
325
353
|
recommendation: "Compile with -fstack-protector-strong.",
|
|
326
354
|
},
|
|
355
|
+
// ── Frameworks ────────────────────────────────────────────────────────────
|
|
356
|
+
{
|
|
357
|
+
id: "unity_il2cpp_metadata",
|
|
358
|
+
name: "Unity IL2CPP metadata shipped in the clear",
|
|
359
|
+
target: "framework",
|
|
360
|
+
category: "source-exposure",
|
|
361
|
+
severity: "high",
|
|
362
|
+
exposes: "Il2CppDumper turns global-metadata.dat plus the native binary into every class, method, field and string literal of the game, with addresses.",
|
|
363
|
+
recommendation: "Protect the metadata (encrypt global-metadata.dat with a Unity protection tool or a custom loader) and strip the IL2CPP binary; treat client logic as visible regardless.",
|
|
364
|
+
},
|
|
365
|
+
{
|
|
366
|
+
id: "unity_mono_assemblies",
|
|
367
|
+
name: "Unity game logic shipped as plain .NET assemblies",
|
|
368
|
+
target: "framework",
|
|
369
|
+
category: "obfuscation",
|
|
370
|
+
severity: "high",
|
|
371
|
+
exposes: "Assembly-CSharp.dll decompiles to the game's C# scripts with dnSpy/ILSpy, names included, and can be patched and repacked.",
|
|
372
|
+
recommendation: "Switch the scripting backend to IL2CPP for release builds, or run an obfuscator over Assembly-CSharp.dll.",
|
|
373
|
+
},
|
|
374
|
+
{
|
|
375
|
+
id: "python_pyinstaller_bundle",
|
|
376
|
+
name: "Python app packaged with PyInstaller",
|
|
377
|
+
target: "framework",
|
|
378
|
+
category: "source-exposure",
|
|
379
|
+
severity: "high",
|
|
380
|
+
exposes: "The bundled .pyc files extract with pyinstxtractor and decompile back to Python source.",
|
|
381
|
+
recommendation: "Compile the code instead (Nuitka, Cython for sensitive modules) or protect it (PyArmor) before packaging; keep secrets server-side.",
|
|
382
|
+
},
|
|
383
|
+
{
|
|
384
|
+
id: "java_not_obfuscated",
|
|
385
|
+
name: "Java application classes are not obfuscated",
|
|
386
|
+
target: "framework",
|
|
387
|
+
category: "obfuscation",
|
|
388
|
+
severity: "high",
|
|
389
|
+
exposes: "Any Java decompiler (CFR, Fernflower) gives back the classes with their original names.",
|
|
390
|
+
recommendation: "Run ProGuard (or another obfuscator) in the release build and keep -keep rules to what reflection and frameworks need.",
|
|
391
|
+
},
|
|
327
392
|
// ── .NET ──────────────────────────────────────────────────────────────────
|
|
328
393
|
{
|
|
329
394
|
id: "dotnet_not_obfuscated",
|
package/dist/rules.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAuBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B,8EAA8E;IAC9E;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,sGAAsG;QAC/G,cAAc,EAAE,6MAA6M;KAC9N;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4GAA4G;QACrH,cAAc,EAAE,gHAAgH;KACjI;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,0CAA0C;QAChD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kFAAkF;QAC3F,cAAc,EAAE,wHAAwH;KACzI;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,gGAAgG;QACzG,cAAc,EAAE,mFAAmF;KACpG;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE,qCAAqC;QAC3C,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,qEAAqE;QAC9E,cAAc,EAAE,kFAAkF;KACnG;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,gHAAgH;QACzH,cAAc,EAAE,uFAAuF;KACxG;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,iFAAiF;QAC1F,cAAc,EAAE,mLAAmL;KACpM;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,wFAAwF;QACjG,cAAc,EAAE,2HAA2H;KAC5I;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qCAAqC;QAC3C,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+GAA+G;QACxH,cAAc,EAAE,8HAA8H;KAC/I;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,qDAAqD;QAC3D,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,0HAA0H;QACnI,cAAc,EAAE,mHAAmH;KACpI;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,0CAA0C;QAChD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kFAAkF;QAC3F,cAAc,EAAE,yJAAyJ;KAC1K;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+IAA+I;QACxJ,cAAc,EAAE,2FAA2F;KAC5G;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iIAAiI;QAC1I,cAAc,EAAE,kDAAkD;KACnE;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,4FAA4F;QACrG,cAAc,EAAE,yDAAyD;KAC1E;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,oFAAoF;QAC7F,cAAc,EAAE,kIAAkI;KACnJ;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,sGAAsG;QAC/G,cAAc,EAAE,sCAAsC;KACvD;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,uGAAuG;QAChH,cAAc,EAAE,wGAAwG;KACzH;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6FAA6F;QACtG,cAAc,EAAE,mIAAmI;KACpJ;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yFAAyF;QAClG,cAAc,EAAE,+DAA+D;KAChF;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4FAA4F;QACrG,cAAc,EAAE,qGAAqG;KACtH;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,sCAAsC;QAC5C,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0HAA0H;QACnI,cAAc,EAAE,iGAAiG;KAClH;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,+GAA+G;QACxH,cAAc,EAAE,kHAAkH;KACnI;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oGAAoG;QAC7G,cAAc,EAAE,oFAAoF;KACrG;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,sGAAsG;QAC/G,cAAc,EAAE,wKAAwK;KACzL;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,2GAA2G;QACpH,cAAc,EAAE,4HAA4H;KAC7I;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,IAAI,EAAE,oCAAoC;QAC1C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6FAA6F;QACtG,cAAc,EAAE,8FAA8F;KAC/G;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,+CAA+C;QACrD,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,oFAAoF;QAC7F,cAAc,EAAE,iJAAiJ;KAClK;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE,0CAA0C;QAChD,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,4GAA4G;QACrH,cAAc,EAAE,kGAAkG;KACnH;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0DAA0D;QACnE,cAAc,EAAE,8EAA8E;KAC/F;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,sFAAsF;QAC/F,cAAc,EAAE,oDAAoD;KACrE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,0FAA0F;QACnG,cAAc,EAAE,+FAA+F;KAChH;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,gGAAgG;QACzG,cAAc,EAAE,iFAAiF;KAClG;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,sCAAsC;QAC5C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,sDAAsD;QAC/D,cAAc,EAAE,wDAAwD;KACzE;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,yFAAyF;QAClG,cAAc,EAAE,gCAAgC;KACjD;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,sEAAsE;QAC/E,cAAc,EAAE,wCAAwC;KACzD;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+EAA+E;QACxF,cAAc,EAAE,oJAAoJ;KACrK;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6GAA6G;QACtH,cAAc,EAAE,gHAAgH;KACjI;CACF,CAAC;AAEF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAExD,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
1
|
+
{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAuBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B,8EAA8E;IAC9E;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,sGAAsG;QAC/G,cAAc,EAAE,6MAA6M;KAC9N;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4GAA4G;QACrH,cAAc,EAAE,gHAAgH;KACjI;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,0CAA0C;QAChD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kFAAkF;QAC3F,cAAc,EAAE,wHAAwH;KACzI;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,mCAAmC;QACzC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,gGAAgG;QACzG,cAAc,EAAE,mFAAmF;KACpG;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE,qCAAqC;QAC3C,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,qEAAqE;QAC9E,cAAc,EAAE,kFAAkF;KACnG;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,gHAAgH;QACzH,cAAc,EAAE,uFAAuF;KACxG;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,iFAAiF;QAC1F,cAAc,EAAE,mLAAmL;KACpM;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,wFAAwF;QACjG,cAAc,EAAE,2HAA2H;KAC5I;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qCAAqC;QAC3C,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+GAA+G;QACxH,cAAc,EAAE,8HAA8H;KAC/I;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,qDAAqD;QAC3D,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,0HAA0H;QACnI,cAAc,EAAE,mHAAmH;KACpI;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,0CAA0C;QAChD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,kFAAkF;QAC3F,cAAc,EAAE,yJAAyJ;KAC1K;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+IAA+I;QACxJ,cAAc,EAAE,2FAA2F;KAC5G;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iIAAiI;QAC1I,cAAc,EAAE,kDAAkD;KACnE;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,4FAA4F;QACrG,cAAc,EAAE,yDAAyD;KAC1E;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,oFAAoF;QAC7F,cAAc,EAAE,kIAAkI;KACnJ;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,sGAAsG;QAC/G,cAAc,EAAE,sCAAsC;KACvD;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,uGAAuG;QAChH,cAAc,EAAE,wGAAwG;KACzH;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6FAA6F;QACtG,cAAc,EAAE,mIAAmI;KACpJ;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,iDAAiD;QACvD,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yFAAyF;QAClG,cAAc,EAAE,+DAA+D;KAChF;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4FAA4F;QACrG,cAAc,EAAE,qGAAqG;KACtH;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,sCAAsC;QAC5C,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0HAA0H;QACnI,cAAc,EAAE,iGAAiG;KAClH;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,+GAA+G;QACxH,cAAc,EAAE,kHAAkH;KACnI;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oGAAoG;QAC7G,cAAc,EAAE,oFAAoF;KACrG;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,4CAA4C;QAClD,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iIAAiI;QAC1I,cAAc,EAAE,uHAAuH;KACxI;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,uDAAuD;QAC7D,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,2EAA2E;QACpF,cAAc,EAAE,6FAA6F;KAC9G;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,oDAAoD;QAC1D,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,2GAA2G;QACpH,cAAc,EAAE,kHAAkH;KACnI;IAED,8EAA8E;IAC9E;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,sGAAsG;QAC/G,cAAc,EAAE,wKAAwK;KACzL;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,2GAA2G;QACpH,cAAc,EAAE,4HAA4H;KAC7I;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,IAAI,EAAE,oCAAoC;QAC1C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6FAA6F;QACtG,cAAc,EAAE,8FAA8F;KAC/G;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,+CAA+C;QACrD,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,oFAAoF;QAC7F,cAAc,EAAE,iJAAiJ;KAClK;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE,0CAA0C;QAChD,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,4GAA4G;QACrH,cAAc,EAAE,kGAAkG;KACnH;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0DAA0D;QACnE,cAAc,EAAE,8EAA8E;KAC/F;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,sFAAsF;QAC/F,cAAc,EAAE,oDAAoD;KACrE;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,0FAA0F;QACnG,cAAc,EAAE,+FAA+F;KAChH;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,gGAAgG;QACzG,cAAc,EAAE,iFAAiF;KAClG;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,sCAAsC;QAC5C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,sDAAsD;QAC/D,cAAc,EAAE,wDAAwD;KACzE;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,yFAAyF;QAClG,cAAc,EAAE,gCAAgC;KACjD;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,sEAAsE;QAC/E,cAAc,EAAE,wCAAwC;KACzD;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,4CAA4C;QAClD,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+IAA+I;QACxJ,cAAc,EAAE,2KAA2K;KAC5L;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,mDAAmD;QACzD,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4HAA4H;QACrI,cAAc,EAAE,2GAA2G;KAC5H;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,sCAAsC;QAC5C,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yFAAyF;QAClG,cAAc,EAAE,qIAAqI;KACtJ;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,6CAA6C;QACnD,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yFAAyF;QAClG,cAAc,EAAE,wHAAwH;KACzI;IAED,6EAA6E;IAC7E;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,iCAAiC;QACvC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+EAA+E;QACxF,cAAc,EAAE,oJAAoJ;KACrK;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6GAA6G;QACtH,cAAc,EAAE,gHAAgH;KACjI;CACF,CAAC;AAEF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAExD,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/dist/sarif.d.ts
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
1
|
import type { Finding } from "./finding.js";
|
|
2
|
-
|
|
2
|
+
/** With `unchanged` (findings already in the baseline), each result carries SARIF's baselineState. */
|
|
3
|
+
export declare function buildSarif(toolVersion: string, findings: Finding[], unchanged?: Set<Finding>): object;
|
|
3
4
|
//# sourceMappingURL=sarif.d.ts.map
|
package/dist/sarif.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AA8B5C,sGAAsG;AACtG,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,CAyDrG"}
|
package/dist/sarif.js
CHANGED
|
@@ -5,7 +5,8 @@ function severityToLevel(sev) {
|
|
|
5
5
|
return "warning";
|
|
6
6
|
return "note";
|
|
7
7
|
}
|
|
8
|
-
|
|
8
|
+
/** With `unchanged` (findings already in the baseline), each result carries SARIF's baselineState. */
|
|
9
|
+
export function buildSarif(toolVersion, findings, unchanged) {
|
|
9
10
|
const rulesMap = new Map();
|
|
10
11
|
const results = [];
|
|
11
12
|
for (const f of findings) {
|
|
@@ -27,6 +28,8 @@ export function buildSarif(toolVersion, findings) {
|
|
|
27
28
|
level: severityToLevel(f.severity),
|
|
28
29
|
message: { text: f.match ? `${f.patternName} — ${f.match} — ${f.recommendation}` : `${f.patternName} — ${f.recommendation}` },
|
|
29
30
|
};
|
|
31
|
+
if (unchanged)
|
|
32
|
+
result.baselineState = unchanged.has(f) ? "unchanged" : "new";
|
|
30
33
|
if (f.file) {
|
|
31
34
|
result.locations = [
|
|
32
35
|
{
|
package/dist/sarif.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAwBA,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACzD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,UAAU,CAAC,WAAmB,EAAE,QAAmB,EAAE,SAAwB;IAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE;gBACxB,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBAChD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;gBACzC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE;gBAC3C,OAAO,EAAE,yCAAyC;gBAClD,UAAU,EAAE;oBACV,kBAAkB,EAAE,CAAC,CAAC,QAAQ;oBAC9B,IAAI,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;iBAChE;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,cAAc,EAAE,EAAE;SAC9H,CAAC;QACF,IAAI,SAAS;YAAE,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;QAE7E,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACX,MAAM,CAAC,SAAS,GAAG;gBACjB;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;wBACzD,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;qBACrD;iBACF;aACF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,gGAAgG;QACzG,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,8BAA8B;wBACpC,OAAO,EAAE,WAAW;wBACpB,cAAc,EAAE,qBAAqB;wBACrC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;qBACrC;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC"}
|
package/dist/scanner.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,sGAAsG;IACtG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAsKD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,UAAU,CA2B9E"}
|
package/dist/scanner.js
CHANGED
|
@@ -1,8 +1,10 @@
|
|
|
1
1
|
import { existsSync, readFileSync, readdirSync, statSync } from "fs";
|
|
2
2
|
import { basename, join, relative, sep } from "path";
|
|
3
|
-
import { analyzeApk, isApk } from "./apk.js";
|
|
3
|
+
import { analyzeApk, isAab, isApk } from "./apk.js";
|
|
4
4
|
import { readAsar } from "./asar.js";
|
|
5
5
|
import { analyzeElectron, detectElectron } from "./electron.js";
|
|
6
|
+
import { analyzeJar, frameworkChecks, isJar, pyinstallerCheck } from "./frameworks.js";
|
|
7
|
+
import { analyzeIosAppDir, analyzeIpa, isIosAppDir, isIpa } from "./ios.js";
|
|
6
8
|
import { bySeverity, grade } from "./finding.js";
|
|
7
9
|
import { readPrefix, walkFiles } from "./fsutil.js";
|
|
8
10
|
import { analyzeNative, detectNativeFormat } from "./native.js";
|
|
@@ -37,12 +39,18 @@ function analyzeNativeFile(path, c) {
|
|
|
37
39
|
c.notes.push(`${path}: ${format} binary larger than ${MAX_NATIVE_BYTES / 1024 / 1024} MiB, not parsed`);
|
|
38
40
|
return true;
|
|
39
41
|
}
|
|
40
|
-
const
|
|
42
|
+
const buf = readFileSync(path);
|
|
43
|
+
const result = analyzeNative(buf, path);
|
|
41
44
|
if (!result)
|
|
42
45
|
return false;
|
|
43
46
|
c.scannedFiles++;
|
|
44
47
|
c.notes.push(...result.notes);
|
|
45
48
|
c.add(result.findings, result.flavor === "dotnet" ? "dotnet" : "native");
|
|
49
|
+
if (result.flavor !== "dotnet") {
|
|
50
|
+
const py = pyinstallerCheck(buf, path);
|
|
51
|
+
c.notes.push(...py.notes);
|
|
52
|
+
c.add(py.findings);
|
|
53
|
+
}
|
|
46
54
|
return true;
|
|
47
55
|
}
|
|
48
56
|
function macMainExecutables(appDir) {
|
|
@@ -55,6 +63,13 @@ function macMainExecutables(appDir) {
|
|
|
55
63
|
}
|
|
56
64
|
}
|
|
57
65
|
function scanAppBundle(dir, c, maxFiles) {
|
|
66
|
+
if (isIosAppDir(dir)) {
|
|
67
|
+
const result = analyzeIosAppDir(dir, maxFiles);
|
|
68
|
+
c.scannedFiles += result.scannedFiles;
|
|
69
|
+
c.notes.push(...result.notes);
|
|
70
|
+
c.add(result.findings, "ios");
|
|
71
|
+
return;
|
|
72
|
+
}
|
|
58
73
|
const electron = detectElectron(dir);
|
|
59
74
|
if (electron) {
|
|
60
75
|
const result = analyzeElectron(electron, maxFiles);
|
|
@@ -67,10 +82,28 @@ function scanAppBundle(dir, c, maxFiles) {
|
|
|
67
82
|
analyzeNativeFile(exe, c);
|
|
68
83
|
}
|
|
69
84
|
function scanFile(path, c) {
|
|
70
|
-
if (
|
|
85
|
+
if (isJar(path)) {
|
|
86
|
+
const result = analyzeJar(path);
|
|
87
|
+
c.scannedFiles += result.scannedFiles;
|
|
88
|
+
c.notes.push(...result.notes);
|
|
89
|
+
c.add(result.findings);
|
|
90
|
+
return;
|
|
91
|
+
}
|
|
92
|
+
if (isIpa(path)) {
|
|
93
|
+
const result = analyzeIpa(path);
|
|
94
|
+
if (!result) {
|
|
95
|
+
c.notes.push(`${path}: no Payload/*.app inside, not an IPA`);
|
|
96
|
+
return;
|
|
97
|
+
}
|
|
98
|
+
c.scannedFiles += result.scannedFiles;
|
|
99
|
+
c.notes.push(...result.notes);
|
|
100
|
+
c.add(result.findings, "ios");
|
|
101
|
+
return;
|
|
102
|
+
}
|
|
103
|
+
if (isApk(path) || isAab(path)) {
|
|
71
104
|
const result = analyzeApk(path);
|
|
72
105
|
if (!result) {
|
|
73
|
-
c.notes.push(`${path}: no AndroidManifest.xml, not an APK`);
|
|
106
|
+
c.notes.push(`${path}: no AndroidManifest.xml, not an APK or App Bundle`);
|
|
74
107
|
return;
|
|
75
108
|
}
|
|
76
109
|
c.scannedFiles += result.scannedFiles;
|
|
@@ -95,7 +128,7 @@ function scanFile(path, c) {
|
|
|
95
128
|
return;
|
|
96
129
|
}
|
|
97
130
|
if (!analyzeNativeFile(path, c))
|
|
98
|
-
c.notes.push(`${path}: not a recognised artifact (APK, ASAR, JavaScript, source map, ELF, Mach-O or PE)`);
|
|
131
|
+
c.notes.push(`${path}: not a recognised artifact (APK, AAB, IPA, JAR, ASAR, JavaScript, source map, ELF, Mach-O or PE)`);
|
|
99
132
|
}
|
|
100
133
|
function scanDir(root, c, options, maxFiles) {
|
|
101
134
|
if (root.endsWith(".app") || detectElectron(root)) {
|
|
@@ -103,6 +136,7 @@ function scanDir(root, c, options, maxFiles) {
|
|
|
103
136
|
return;
|
|
104
137
|
}
|
|
105
138
|
const web = [];
|
|
139
|
+
const all = [];
|
|
106
140
|
const { truncated } = walkFiles(root, {
|
|
107
141
|
maxFiles,
|
|
108
142
|
include: options.include,
|
|
@@ -116,10 +150,11 @@ function scanDir(root, c, options, maxFiles) {
|
|
|
116
150
|
},
|
|
117
151
|
}, (full) => {
|
|
118
152
|
const key = relative(root, full).split(sep).join("/");
|
|
153
|
+
all.push({ key, display: full, size: statSync(full).size, read: () => readFileSync(full) });
|
|
119
154
|
if (isWebAsset(key)) {
|
|
120
155
|
web.push({ key, display: full, size: statSync(full).size, read: () => readFileSync(full) });
|
|
121
156
|
}
|
|
122
|
-
else if (isApk(full) || /\.asar$/i.test(full)) {
|
|
157
|
+
else if (isApk(full) || isAab(full) || isIpa(full) || isJar(full) || /\.asar$/i.test(full)) {
|
|
123
158
|
scanFile(full, c);
|
|
124
159
|
}
|
|
125
160
|
else {
|
|
@@ -131,6 +166,9 @@ function scanDir(root, c, options, maxFiles) {
|
|
|
131
166
|
c.scannedFiles += web.length;
|
|
132
167
|
c.add(analyzeWebFiles(web), "web");
|
|
133
168
|
}
|
|
169
|
+
const engine = frameworkChecks(all);
|
|
170
|
+
c.notes.push(...engine.notes);
|
|
171
|
+
c.add(engine.findings);
|
|
134
172
|
}
|
|
135
173
|
/**
|
|
136
174
|
* Scans a build artifact for what it gives away to a reverse engineer: a file
|
|
@@ -153,7 +191,9 @@ export function scanPath(target, options = {}) {
|
|
|
153
191
|
scanFile(path, c);
|
|
154
192
|
if (c.truncated)
|
|
155
193
|
c.notes.push(`Stopped after ${maxFiles} files; raise maxFiles to scan the rest.`);
|
|
156
|
-
|
|
194
|
+
// Unity's Assembly-CSharp.dll gets the engine-specific finding; drop the generic .NET one for the same file.
|
|
195
|
+
const unityDlls = new Set(c.findings.filter((f) => f.patternId === "unity_mono_assemblies").map((f) => f.file));
|
|
196
|
+
const findings = c.findings.filter((f) => !(f.patternId === "dotnet_not_obfuscated" && unityDlls.has(f.file))).sort(bySeverity);
|
|
157
197
|
return {
|
|
158
198
|
target,
|
|
159
199
|
kinds: [...c.kinds],
|
package/dist/scanner.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAuBvD,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3I,MAAM,SAAS;IACb,QAAQ,GAAc,EAAE,CAAC;IACzB,KAAK,GAAa,EAAE,CAAC;IACrB,KAAK,GAAG,IAAI,GAAG,EAAc,CAAC;IAC9B,YAAY,GAAG,CAAC,CAAC;IACjB,SAAS,GAAG,KAAK,CAAC;IAElB,GAAG,CAAC,QAAmB,EAAE,IAAiB;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAChC,IAAI,IAAI;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,CAAY;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAC5B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM,uBAAuB,gBAAgB,GAAG,IAAI,GAAG,IAAI,kBAAkB,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,CAAC,CAAC,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,CAAY,EAAE,QAAgB;IAChE,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACtC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACtC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,gGAAgG;IAChG,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC;QAAE,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,CAAY;IAC1C,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACtC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACtC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,oDAAoD,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACtC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/B,CAAC,CAAC,YAAY,EAAE,CAAC;QACjB,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnI,OAAO;IACT,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;QAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,mGAAmG,CAAC,CAAC;AAC5J,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,CAAY,EAAE,OAAoB,EAAE,QAAgB;IACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,CAC7B,IAAI,EACJ;QACE,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChE,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;KACF,EACD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5F,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7F,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CACF,CAAC;IACF,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC;IACxB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,UAAuB,EAAE;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAEvD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACtE,yEAAyE;IACzE,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;;QACjE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvB,IAAI,CAAC,CAAC,SAAS;QAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,0CAA0C,CAAC,CAAC;IACnG,6GAA6G;IAC7G,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,uBAAuB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChI,OAAO;QACL,MAAM;QACN,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QACnB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,QAAQ;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC"}
|
package/dist/server.d.ts
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
|
|
2
|
+
import type { BaselineDiff } from "./baseline.js";
|
|
2
3
|
import type { ScanResult } from "./scanner.js";
|
|
3
|
-
export declare function formatResult(result: ScanResult): string;
|
|
4
|
+
export declare function formatResult(result: ScanResult, diff?: BaselineDiff): string;
|
|
4
5
|
export declare function startServer(): Promise<void>;
|
|
5
6
|
/** The package's tools, also served by @guardbee/security-suite under its own prefix. */
|
|
6
7
|
export declare function registerTools(server: McpServer): void;
|
package/dist/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,MAAM,CA8B5E;AAED,wBAAsB,WAAW,kBAShC;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwErD"}
|
package/dist/server.js
CHANGED
|
@@ -2,11 +2,19 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
|
|
|
2
2
|
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
|
|
3
3
|
import { instrumentServer } from "@guardbee/mcp-telemetry";
|
|
4
4
|
import { z } from "zod";
|
|
5
|
+
import { applyIgnores, compareToBaseline, readBaseline } from "./baseline.js";
|
|
6
|
+
import { formatFixReport, suggestFixes } from "./fixes.js";
|
|
5
7
|
import { scanUrl } from "./live.js";
|
|
6
8
|
import { RULES } from "./rules.js";
|
|
7
9
|
import { scanPath } from "./scanner.js";
|
|
8
|
-
export function formatResult(result) {
|
|
10
|
+
export function formatResult(result, diff) {
|
|
9
11
|
const lines = [];
|
|
12
|
+
if (diff) {
|
|
13
|
+
lines.push(`Compared to baseline (grade ${diff.previousGrade} → ${result.grade}): ${diff.added.length} new, ${diff.fixed.length} fixed, ${diff.unchanged.length} unchanged`);
|
|
14
|
+
for (const fp of diff.fixed)
|
|
15
|
+
lines.push(` fixed: ${fp.split("|").slice(0, 2).join(" ")}`);
|
|
16
|
+
lines.push("");
|
|
17
|
+
}
|
|
10
18
|
const kinds = result.kinds.length > 0 ? result.kinds.join(", ") : "nothing recognised";
|
|
11
19
|
if (result.findings.length === 0) {
|
|
12
20
|
lines.push(`✅ Grade ${result.grade} — nothing handed to a reverse engineer for free. ${result.scannedFiles} file(s) checked (${kinds}) in ${result.durationMs}ms.`);
|
|
@@ -53,9 +61,14 @@ export function registerTools(server) {
|
|
|
53
61
|
maxFiles: z.number().int().positive().optional().describe("Maximum number of files to check in a directory (default: 5000)"),
|
|
54
62
|
include: z.array(z.string()).optional().describe("Only check files whose path contains one of these strings"),
|
|
55
63
|
exclude: z.array(z.string()).optional().describe("Skip files/dirs whose path contains one of these strings"),
|
|
56
|
-
|
|
64
|
+
ignore: z.array(z.string()).optional().describe("Accepted findings to leave out: a rule id, or rule:path-substring (e.g. bundle_secret:firebase-config.js)"),
|
|
65
|
+
baseline: z.string().optional().describe("Path to a baseline written by `guardbee-reverse-shield scan --update-baseline`; the report then lists new and fixed findings"),
|
|
66
|
+
}, async ({ path, maxFiles, include, exclude, ignore, baseline }) => {
|
|
57
67
|
try {
|
|
58
|
-
|
|
68
|
+
const result = scanPath(path, { maxFiles, include, exclude });
|
|
69
|
+
applyIgnores(result, ignore ?? []);
|
|
70
|
+
const diff = baseline ? compareToBaseline(result, readBaseline(baseline)) : undefined;
|
|
71
|
+
return { content: [{ type: "text", text: formatResult(result, diff) }] };
|
|
59
72
|
}
|
|
60
73
|
catch (err) {
|
|
61
74
|
return { isError: true, content: [{ type: "text", text: err.message }] };
|
|
@@ -72,9 +85,19 @@ export function registerTools(server) {
|
|
|
72
85
|
return { isError: true, content: [{ type: "text", text: err.message }] };
|
|
73
86
|
}
|
|
74
87
|
});
|
|
75
|
-
server.tool("
|
|
88
|
+
server.tool("suggest_fixes", "Read a project's build configuration (Vite, webpack, Next.js, Angular, Create React App, Android Gradle and manifest, React Native, electron-builder / Forge, .NET project files, Flutter) and propose the changes that close what scan_artifact reports: hidden source maps, minification, R8, debuggable and backup flags, Hermes, Electron fuses and ASAR, no embedded PDB. Returns unified diffs to review and apply (git apply); it never modifies files.", {
|
|
89
|
+
projectPath: z.string().describe("Project source directory (not the build output)"),
|
|
90
|
+
}, async ({ projectPath }) => {
|
|
91
|
+
try {
|
|
92
|
+
return { content: [{ type: "text", text: formatFixReport(suggestFixes(projectPath)) }] };
|
|
93
|
+
}
|
|
94
|
+
catch (err) {
|
|
95
|
+
return { isError: true, content: [{ type: "text", text: err.message }] };
|
|
96
|
+
}
|
|
97
|
+
});
|
|
98
|
+
server.tool("list_checks", "List every reverse-engineering resistance check, grouped by target (web, electron, android, ios, native, dotnet, framework), with what each finding gives away and how to fix it", {}, async () => {
|
|
76
99
|
const lines = ["Reverse-engineering resistance checks:\n"];
|
|
77
|
-
for (const target of ["web", "electron", "android", "native", "dotnet"]) {
|
|
100
|
+
for (const target of ["web", "electron", "android", "ios", "native", "dotnet", "framework"]) {
|
|
78
101
|
lines.push(`[${target}]`);
|
|
79
102
|
for (const r of RULES.filter((rule) => rule.target === target)) {
|
|
80
103
|
lines.push(` • ${r.id} (${r.severity}, ${r.category}) — ${r.name}`);
|
package/dist/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,MAAM,UAAU,YAAY,CAAC,MAAkB;
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,IAAmB;IAClE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,aAAa,MAAM,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,YAAY,CAAC,CAAC;QAC7K,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACvF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,KAAK,qDAAqD,MAAM,CAAC,YAAY,qBAAqB,KAAK,QAAQ,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC;IACtK,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;YAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,8CAA8C,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,kBAAkB,MAAM,CAAC,YAAY,aAAa,KAAK,KAAK,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC;QACrL,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,QAAQ,WAAW,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,MAAM,UAAU,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9G,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IACH,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,MAAM,CAAC,IAAI,CACT,eAAe,EACf,2oBAA2oB,EAC3oB;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;QAC5H,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;QAC7G,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;QAC5G,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2GAA2G,CAAC;QAC5J,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8HAA8H,CAAC;KACzK,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9D,YAAY,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,UAAU,EACV,4YAA4Y,EAC5Y;QACE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC1D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;KACnI,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,gcAAgc,EAChc;QACE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;KACpF,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,aAAa,EACb,kLAAkL,EAClL,EAAE,EACF,KAAK,IAAI,EAAE;QACT,MAAM,KAAK,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAC3D,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAU,EAAE,CAAC;YACrG,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACjE,CAAC,CACF,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardbee/mcp-reverse-shield",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.2.0",
|
|
4
4
|
"mcpName": "io.github.GuardBee/reverse-shield",
|
|
5
|
-
"description": "MCP server that audits shipped apps for how easily they can be reverse engineered — exposed source maps, missing minification/R8/.NET obfuscation, debug info and unstripped symbols, debuggable flags, Electron fuses, unsigned binaries and embedded secrets across web bundles, Electron, Android
|
|
5
|
+
"description": "MCP server that audits shipped apps for how easily they can be reverse engineered — exposed source maps, missing minification/R8/.NET obfuscation, debug info and unstripped symbols, debuggable flags, Electron fuses, unsigned binaries and embedded secrets across web bundles, Electron, Android APK/AAB, iOS IPA, Unity, PyInstaller, Java and native/.NET binaries — with baselines for CI and build-config fix suggestions",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"bin": {
|
|
8
8
|
"guardbee-reverse-shield": "./dist/cli.js"
|
|
@@ -37,6 +37,9 @@
|
|
|
37
37
|
"source-maps",
|
|
38
38
|
"electron",
|
|
39
39
|
"android",
|
|
40
|
+
"ios",
|
|
41
|
+
"unity",
|
|
42
|
+
"pyinstaller",
|
|
40
43
|
"guardbee",
|
|
41
44
|
"devtools"
|
|
42
45
|
],
|