supplier-meesho.webflow 1.0.0

package/MobSF/.github/CONTRIBUTING.md

@@ -0,0 +1,131 @@
+# Contributing to this project
+
+Please take a moment to review this document in order to make the contribution
+process easy and effective for everyone involved.
+
+Following these guidelines helps to communicate that you respect the time of
+the developers managing and developing this open source project. In return,
+they should reciprocate that respect in addressing your issue or assessing
+patches and features.
+
+
+## Using the issue tracker
+
+The issue tracker is the preferred channel for [bug reports](#bugs),
+[features requests](#features) and [submitting pull
+requests](#pull-requests), but please respect the following restrictions:
+
+* Please **do not** use the issue tracker for personal support requests (use [MobSF Slack channel](https://mobsf.slack.com/join/shared_invite/enQtNzM2NTAyNzA1MjgxLTdjMzkzNDc3ZjdiMjkwZTZhMmFhNDlkZmMwZDhjNDNmYTAzYWE5NGZlMDIzYzliNTdiMDQ2MTRlYjU1MjkyNGM) or 
+  [Stack Overflow](https://stackoverflow.com/search?q=mobsf)).
+
+* Please **do not** derail or troll issues. Keep the discussion on topic and
+  respect the opinions of others.
+
+
+<a name="bugs"></a>
+## Bug reports
+
+A bug is a _demonstrable problem_ that is caused by the code in the repository.
+Good bug reports are extremely helpful - thank you!
+
+Guidelines for bug reports:
+
+1. **Use the GitHub issue search** &mdash; check if the issue has already been
+   reported.
+
+2. **Check if the issue has been fixed** &mdash; try to reproduce it using the
+   latest `master` branch in the repository.
+
+3. **Isolate the problem** &mdash; create a [reduced test
+   case](http://css-tricks.com/reduced-test-cases/) and a live example.
+
+4. **Add Log file** &mdash; Please add the log file `mobsf/debug.log` while opening bugs.
+
+5. **Timely Response** &mdash; Once you open a bug, you should also provide additional information if requested. Failure to do so in 10 days will result in closure of the bug without further communication. 
+
+A good bug report shouldn't leave others needing to chase you up for more
+information. Please try to be as detailed as possible in your report. What is
+your environment? What steps will reproduce the issue? What browser(s) and OS
+experience the problem? Are you using MobSF shipped VM or a different one?
+What would you expect to be the outcome? All these details will help people
+to fix any potential bugs.
+
+Example:
+
+> Short and descriptive example bug report title
+>
+> A summary of the issue and the browser/OS environment in which it occurs. If
+> suitable, include the steps required to reproduce the bug.
+>
+> 1. This is the first step
+> 2. This is the second step
+> 3. Further steps, etc.
+> 4. Log information from `mobsf/debug.log`
+> 
+> `<url>` - a link to the reduced test case
+>
+> Any other information you want to share that is relevant to the issue being
+> reported. This might include the lines of code that you have identified as
+> causing the bug, and potential solutions (and your opinions on their
+> merits).
+
+[Open Bugs here](https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues)
+
+<a name="features"></a>
+## Feature requests
+
+Feature requests are welcome. But take a moment to find out whether your idea
+fits with the scope and aims of the project. It's up to *you* to make a strong
+case to convince the project's developers of the merits of this feature. Please
+provide as much detail and context as possible.
+
+
+<a name="pull-requests"></a>
+## Pull requests
+
+Good pull requests - patches, improvements, new features - are a fantastic
+help. They should remain focused in scope and avoid containing unrelated
+commits.
+
+**Please ask first** before embarking on any significant pull request (e.g.
+implementing features, refactoring code, porting to a different language),
+otherwise you risk spending a lot of time working on something that the
+project's developers might not want to merge into the project.
+
+Please adhere to the coding conventions used throughout a project (indentation,
+accurate comments, etc.) and any other requirements (such as test coverage).
+
+Follow this process if you'd like your work considered for inclusion in the
+project:
+
+1. [Fork](http://help.github.com/fork-a-repo/) the project, clone your fork,
+   and configure the remotes:
+
+   ```bash
+   # Clone your fork of the repo into the current directory
+   git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
+   # Navigate to the newly cloned directory
+   cd Mobile-Security-Framework-MobSF
+   # Assign the original repo to a remote called "upstream"
+   git remote add upstream https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
+   ```
+
+2. If you cloned a while ago, get the latest changes from upstream:
+
+   ```bash
+   git checkout master
+   git pull upstream master
+   ```
+
+3. Commit your changes in logical chunks. Please adhere to these [git commit
+   message guidelines](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html)
+   or your code is unlikely be merged into the main project. Use Git's
+   [interactive rebase](https://help.github.com/articles/interactive-rebase)
+   feature to tidy up your commits before making them public.
+
+
+4. [Open a Pull Request](https://help.github.com/articles/using-pull-requests/)
+    with a clear title and description.
+
+**IMPORTANT**: By submitting a patch, you agree to allow the project owner to
+license your work under the same license as that used by the project.

package/MobSF/.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+github: ajinabraham
+custom: ['https://opensecurity.in/donate']

package/MobSF/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,54 @@
+---
+name: Bug report
+about: Reports without enough information will be closed without any response.
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+<!-- ## IMPORTANT -->
+<!-- Issues are ONLY for reporting BUGS. For support, feature requests, questions, queries, and discussions use our slack channel for limited support. Join MobSF Slack channel: http://tiny.cc/mobsf
+-->
+<!-- If you see errors while running setup/run scripts, it is mostly because you haven't installed the required dependencies correctly. You will have to look into the errors and figure out what is causing them and solve them accordingly. Make sure you have installed all the required dependencies and their correct versions as per the latest documentation. If you still find yourself at a dead end, join MobSF Slack channel: http://tiny.cc/mobsf Please do not post support/help request in GitHub issues, doing so will definitely waste our time get them closed without further response. -->
+
+## ENVIRONMENT
+
+```
+OS and Version:
+Python Version:
+MobSF Version:
+```
+
+## EXPLANATION OF THE ISSUE
+
+```
+What happens, under which versions, under what conditions, when, and what were you expecting instead.
+```
+<!-- If you see errors while running setup/run scripts, join MobSF Slack channel: http://tiny.cc/mobsf to get limited support. -->
+
+## STEPS TO REPRODUCE THE ISSUE
+
+```
+1. This is the first step
+2. This is the second step
+3. Further steps, etc.
+```
+
+
+## LOG FILE
+
+```
+Paste the contents of ~/.MobSF/debug.log here or attach the log file.
+```
+
+<!--
+BEFORE POSTING YOUR ISSUE/BUG
+- These comments won't show up when you submit the issue.
+- GitHub issues ARE NOT FOR FEATURE REQUESTS, SUPPORT, DISCUSSIONS AND QUESTIONS! 
+- If you have questions, use our slack channel. Join MobSF Slack channel: http://tiny.cc/mobsf
+- Reproduce issue in the latest master and try to add as much detail as possible.
+- Search this repository (top of the page) for the issue and it has not been fixed or reported already.
+- Once you open a bug, you should also provide additional information if requested. 
+- Failure to do so in 25 days will result in closure of the bug without further communication.
+-->

package/MobSF/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,22 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: "[FEATURE]"
+labels: enhancement
+assignees: ajinabraham
+
+---
+
+If you're requesting a new feature/enhancement, explain why you'd like it to be added and it's importance.
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is.
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

package/MobSF/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+<!-- Thank you for your contribution to MobSF! -->
+
+### Describe the Pull Request
+
+```
+DESCRIBE THE DETAILS OF PULL REQUEST HERE
+```
+
+### Checklist for PR
+
+- [ ] Run MobSF unit tests and lint `tox -e lint,test`
+- [ ] Tested Working on Linux, Mac, Windows, and Docker
+- [ ] Add unit test for any new Web API (Refer: `StaticAnalyzer/tests.py`)
+- [ ] Make sure tests are passing on your PR [![MobSF tests](https://github.com/MobSF/Mobile-Security-Framework-MobSF/workflows/MobSF%20tests/badge.svg?branch=master)](https://github.com/MobSF/Mobile-Security-Framework-MobSF/actions)
+
+### Additional Comments (if any)
+
+```
+DESCRIBE HERE
+```

package/MobSF/.github/SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.0.x   | :x:                |
+| 2.0.x   | :x:                |
+| 3.0.x   | :white_check_mark: |
+| 4.0.x   | :white_check_mark: |
+
+
+## Reporting a Vulnerability
+
+Please report all security issues [here](https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues) or email ajin25(gmail). We believe in coordinated and responsible disclosure.
+
+## Past Security Issues
+
+* [Local file reading regression < 3.0.0](https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/1197)
+* [Upload a malicious zip file can overwrite arbitary files >=v0.9.3.2 && <=0.9.4.1](https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/358)
+* [Fix Local File Inclusion Vulnerability in ViewSource Function. Version <= v0.9.2](https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/166)

package/MobSF/.github/SUPPORT.md

@@ -0,0 +1 @@
+Github Issues are ONLY for reporting bugs and feature requests. For support, questions, queries and discussions use our slack channel. [Join MobSF Slack Channel](https://mobsf.slack.com/join/shared_invite/enQtNzM2NTAyNzA1MjgxLTdjMzkzNDc3ZjdiMjkwZTZhMmFhNDlkZmMwZDhjNDNmYTAzYWE5NGZlMDIzYzliNTdiMDQ2MTRlYjU1MjkyNGM)

package/MobSF/.github/workflows/auto-comment.yml

@@ -0,0 +1,22 @@
+name: Auto Comment
+on: [issues, pull_request]
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: bubkoo/auto-comment@v1.0.7
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          issuesOpened: >
+            👋 @{{ author }}
+            
+            Issues is only for reporting a bug/feature request. For limited support, questions, and discussions, please join MobSF Slack channel: http://tiny.cc/mobsf
+            
+            Please include all the requested and relevant information when opening a bug report. Improper reports will be closed without any response.
+
+          pullRequestOpened: >
+            👋 @{{ author }}
+            
+            Thank you for sending this pull request ❤️.
+            
+            Please make sure you have followed our [contribution guidelines](https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/master/.github/CONTRIBUTING.md). We will review it as soon as possible

package/MobSF/.github/workflows/docker-build.yml

@@ -0,0 +1,35 @@
+name: 'Publish ARM image'
+
+on:
+    push:
+        branches:
+            - master
+
+jobs:
+    buildx:
+        runs-on: ubuntu-latest
+        steps:
+        -
+            name: Checkout
+            uses: actions/checkout@v2
+        -
+            name: Dockerhub login
+            env:
+                DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+                DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+            run: |
+                echo "${DOCKER_TOKEN}" | docker login --username ${DOCKER_USERNAME} --password-stdin
+        - 
+            name: Set up QEMU
+            uses: docker/setup-qemu-action@v1
+        -   
+            name: Set up Docker Buildx
+            uses: docker/setup-buildx-action@v1
+        -
+            name: Build dockerfile (with push)
+            run: |
+                docker buildx build \
+                --platform=linux/arm64 \
+                --output "type=image,push=true" \
+                --file ./Dockerfile . \
+                --tag opensecurity/mobile-security-framework-mobsf:arm

package/MobSF/.github/workflows/mobsf_test.yml

@@ -0,0 +1,58 @@
+name: MobSF tests
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-20.04, macos-latest, windows-latest]
+        python-version: [3.8, 3.9]
+        # exclude:
+          # excludes py38, py39 on Windows
+          # - os: windows-latest
+          #   python-version: 3.8
+
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v1
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Lint
+      run: |
+        python -m pip install --upgrade pip tox
+        tox -e lint
+    - name: Install Ubuntu Dependencies
+      if: startsWith(matrix.os, 'ubuntu')
+      run: |
+        sudo apt update && sudo apt install -y xfonts-75dpi xfonts-base
+        export WKHTML_URL=https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6-1/
+        export WKHTML_DEB=wkhtmltox_0.12.6-1.focal_amd64.deb
+        wget ${WKHTML_URL}${WKHTML_DEB} && sudo dpkg -i ${WKHTML_DEB} && rm -rf ${WKHTML_DEB}
+    - name: Install macOS Dependencies
+      if: startsWith(matrix.os, 'macOS')
+      run: |
+        brew install --cask wkhtmltopdf
+    - name: Install Windows Dependencies
+      if: startsWith(matrix.os, 'windows')
+      run: |
+        choco install wkhtmltopdf --version 0.12.6
+    - name: Install Python dependencies
+      run: |
+        pip install --use-deprecated=legacy-resolver -r requirements.txt
+    - name: Migrate Database
+      run: |
+        python manage.py makemigrations
+        python manage.py makemigrations StaticAnalyzer
+        python manage.py migrate
+    - name: Unit Tests
+      run: |
+        git submodule update --init --recursive
+        python manage.py test mobsf

package/MobSF/.github/workflows/python-publish.yml

@@ -0,0 +1,28 @@
+name: Upload Python Package
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  deploy:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python
+      uses: actions/setup-python@v2
+      with:
+        python-version: '3.x'
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install setuptools twine
+    - name: Build and publish
+      env:
+        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
+        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+      run: |
+        python setup.py sdist
+        twine upload dist/*

package/MobSF/.gitmodules

@@ -0,0 +1,3 @@
+[submodule "mobsf/StaticAnalyzer/test_files"]
+	path = mobsf/StaticAnalyzer/test_files
+	url = https://github.com/MobSF/test_files.git

package/MobSF/.pyup.yml

@@ -0,0 +1,27 @@
+# configure updates globally
+# default: all
+# allowed: all, insecure, False
+update: all
+
+# configure dependency pinning globally
+# default: True
+# allowed: True, False
+pin: True
+
+# set the default branch
+# default: empty, the default branch on GitHub
+branch: master
+
+# update schedule
+# default: empty
+# allowed: "every day", "every week", ..
+schedule: "every week"
+
+# search for requirement files
+# default: True
+# allowed: True, False
+search: True
+
+# allow to close stale PRs
+# default: True
+close_prs: True

package/MobSF/.sonarcloud.properties

@@ -0,0 +1,3 @@
+sonar.sources=.
+sonar.exclusions=mobsf/static/**/*,mobsf/templates/**/*
+sonar.sourceEncoding=UTF-8

package/MobSF/Dockerfile

@@ -0,0 +1,96 @@
+# Base image
+FROM ubuntu:20.04
+
+# Labels and Credits
+LABEL \
+    name="MobSF" \
+    author="Ajin Abraham <ajin25@gmail.com>" \
+    maintainer="Ajin Abraham <ajin25@gmail.com>" \
+    contributor_1="OscarAkaElvis <oscar.alfonso.diaz@gmail.com>" \
+    contributor_2="Vincent Nadal <vincent.nadal@orange.fr>" \
+    description="Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis."
+
+# Environment vars
+ENV DEBIAN_FRONTEND="noninteractive" \
+    ANALYZER_IDENTIFIER="" \
+    JDK_FILE="openjdk-16.0.1_linux-x64_bin.tar.gz" \
+    JDK_FILE_ARM="openjdk-16.0.1_linux-aarch64_bin.tar.gz" \
+    WKH_FILE="wkhtmltox_0.12.6-1.focal_amd64.deb" \
+    WKH_FILE_ARM="wkhtmltox_0.12.6-1.focal_arm64.deb" \
+    JAVA_HOME="/jdk-16.0.1" \
+    PATH="$JAVA_HOME/bin:$PATH"
+
+# See https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run
+RUN apt update -y && apt install -y  --no-install-recommends \
+    build-essential \
+    locales \
+    sqlite3 \
+    fontconfig-config \
+    libjpeg-turbo8 \
+    libxrender1 \
+    libfontconfig1 \
+    libxext6 \
+    fontconfig \
+    xfonts-75dpi \
+    xfonts-base \
+    python3.9 \
+    python3-dev \
+    python3-pip \
+    wget \
+    git \
+    android-tools-adb
+
+# Set locales
+RUN locale-gen en_US.UTF-8
+ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
+
+# Install wkhtmltopdf & OpenJDK
+ARG TARGETPLATFORM
+
+COPY scripts/install_java_wkhtmltopdf.sh .
+RUN ./install_java_wkhtmltopdf.sh
+
+WORKDIR /root/Mobile-Security-Framework-MobSF
+
+# Install Requirements
+COPY requirements.txt .
+RUN pip3 install --upgrade setuptools pip && \
+    pip3 install --quiet --no-cache-dir -r requirements.txt
+
+# Cleanup
+RUN \
+    apt remove -y \
+        libssl-dev \
+        libffi-dev \
+        libxml2-dev \
+        libxslt1-dev \
+        python3-dev \
+        wget && \
+    apt clean && \
+    apt autoclean && \
+    apt autoremove -y && \
+    rm -rf /var/lib/apt/lists/* /tmp/* > /dev/null 2>&1
+
+# Copy source code
+COPY . .
+
+# Set adb binary path and apktool directory
+RUN sed -i "s#ADB_BINARY = ''#ADB_BINARY = '/usr/bin/adb'#" mobsf/MobSF/settings.py && \
+    mkdir -p /root/.local/share/apktool/framework
+
+# Postgres support is set to false by default
+ARG POSTGRES=False
+
+ENV POSTGRES_USER=postgres
+ENV POSTGRES_PASSWORD=password
+ENV POSTGRES_DB=mobsf
+ENV POSTGRES_HOST=postgres
+
+# Check if Postgres support needs to be enabled
+RUN ./scripts/postgres_support.sh $POSTGRES
+
+# Expose MobSF Port and Proxy Port
+EXPOSE 8000 8000 1337 1337
+
+# Run MobSF
+CMD ["/root/Mobile-Security-Framework-MobSF/scripts/entrypoint.sh"]