Package jadx.api.security.impl

Class JadxSecurity

java.lang.Object

jadx.api.security.impl.JadxSecurity

All Implemented Interfaces:

IJadxSecurity, IJadxZipSecurity

public class JadxSecurity
extends Object
implements IJadxSecurity

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private static final class	JadxSecurity.SecureDBFHolder
private static final class	JadxSecurity.SimpleDBFHolder

Field Summary

Fields

Modifier and Type	Field	Description
private final Set<JadxSecurityFlag>	flags
private static final org.slf4j.Logger	LOG
private static final Pattern	SANITIZE_GRADLE_PATTERN
private final IJadxZipSecurity	zipSecurity

Constructor Summary

Constructors

Constructor	Description
JadxSecurity(Set<JadxSecurityFlag> flags)
JadxSecurity(Set<JadxSecurityFlag> flags, IJadxZipSecurity zipSecurity)

Method Summary

Modifier and Type	Method	Description
int	getMaxEntriesCount()	Max entries count expected in a zip file, fail zip open if the limit exceeds.
boolean	isInSubDirectory(File baseDir, File file)	Check if a file will be inside baseDir after a system resolves its path
boolean	isValidEntry(IZipEntry entry)	Check if zip entry is valid and safe to process
boolean	isValidEntryName(String entryName)	Check if the zip entry name is valid.
Document	parseXml(InputStream in)	XML document parser
private String	sanitizeGradle(String str)
String	sanitizeString(String str, SanitizeType type)	Sanitize/escape string to make it safe for use in place described by SanitizeType
boolean	useLimitedDataStream()	Use limited InputStream for entry uncompressed data
String	verifyAppPackage(String appPackage)	Check if application package is safe

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

private static final org.slf4j.Logger LOG

flags

private final Set<JadxSecurityFlag> flags

zipSecurity

private final IJadxZipSecurity zipSecurity

SANITIZE_GRADLE_PATTERN

private static final Pattern SANITIZE_GRADLE_PATTERN

Constructor Details

JadxSecurity

public JadxSecurity(Set<JadxSecurityFlag> flags)

JadxSecurity

public JadxSecurity(Set<JadxSecurityFlag> flags,
 IJadxZipSecurity zipSecurity)

Method Details

isValidEntry

public boolean isValidEntry(IZipEntry entry)

Description copied from interface: IJadxZipSecurity

Check if zip entry is valid and safe to process

Specified by:

isValidEntry in interface IJadxZipSecurity

isValidEntryName

public boolean isValidEntryName(String entryName)

Description copied from interface: IJadxZipSecurity

Check if the zip entry name is valid. This check should be part of IJadxZipSecurity.isValidEntry(IZipEntry) method.

Specified by:

isValidEntryName in interface IJadxZipSecurity

isInSubDirectory

public boolean isInSubDirectory(File baseDir,
 File file)

Description copied from interface: IJadxZipSecurity

Check if a file will be inside baseDir after a system resolves its path

Specified by:

isInSubDirectory in interface IJadxZipSecurity

useLimitedDataStream

public boolean useLimitedDataStream()

Description copied from interface: IJadxZipSecurity

Use limited InputStream for entry uncompressed data

Specified by:

useLimitedDataStream in interface IJadxZipSecurity

getMaxEntriesCount

public int getMaxEntriesCount()

Description copied from interface: IJadxZipSecurity

Max entries count expected in a zip file, fail zip open if the limit exceeds. Return -1 to disable entries count check.

Specified by:

getMaxEntriesCount in interface IJadxZipSecurity

verifyAppPackage

public String verifyAppPackage(String appPackage)

Description copied from interface: IJadxSecurity

Check if application package is safe

Specified by:

verifyAppPackage in interface IJadxSecurity

Returns:

normalized/sanitized string or same string if safe

sanitizeString

public String sanitizeString(String str,
 SanitizeType type)

Description copied from interface: IJadxSecurity

Sanitize/escape string to make it safe for use in place described by SanitizeType

Specified by:

sanitizeString in interface IJadxSecurity

sanitizeGradle

private String sanitizeGradle(String str)

parseXml

public Document parseXml(InputStream in)

Description copied from interface: IJadxSecurity

XML document parser

Specified by:

parseXml in interface IJadxSecurity