Skip to content

Commit

Permalink
Uncrush PNG on popular Windows and Linux arch, Fixes #2397
Browse files Browse the repository at this point in the history
  • Loading branch information
ajinabraham committed Nov 7, 2024
1 parent 744a7f4 commit d82acb7
Show file tree
Hide file tree
Showing 4 changed files with 22 additions and 3 deletions.
Binary file not shown.
Binary file not shown.
Binary file not shown.
25 changes: 22 additions & 3 deletions mobsf/StaticAnalyzer/views/ios/icon_analysis.py
Original file line number Diff line number Diff line change
Expand Up @@ -37,19 +37,38 @@ def get_icon_from_ipa(app_dict, binary):
return
icon_file = icons.pop()
outfile = Path(settings.DWD_DIR) / f'{md5}-icon.png'
if platform.system() == 'Darwin':
tools_dir = Path(settings.BASE_DIR) / 'StaticAnalyzer' / 'tools' / 'ios'
cgbipng_bin = None
arch = platform.machine()
system = platform.system()
# Uncrush PNG. CgBI -> PNG
# https://iphonedevwiki.net/index.php/CgBI_file_format
if system == 'Darwin':
args = ['xcrun', '-sdk', 'iphoneos', 'pngcrush', '-q',
'-revert-iphone-optimizations',
icon_file, outfile.as_posix()]
# Uncrush PNG. CgBI -> PNG, Mac only
# https://iphonedevwiki.net/index.php/CgBI_file_format
try:
out = subprocess.run(args, capture_output=True)
if b'libpng error:' in out.stdout:
# PNG looks normal
raise ValueError('PNG is not CgBI')
except Exception:
shutil.copy2(icon_file, outfile.as_posix())
elif system == 'Windows' and arch in ('AMD64', 'x86'):
cgbipng_bin = 'CgbiPngFix.exe'
elif system == 'Linux' and arch == 'x86_64':
cgbipng_bin = 'CgbiPngFix_amd64'
elif system == 'Linux' and arch == 'aarch64':
cgbipng_bin = 'CgbiPngFix_arm64'
if cgbipng_bin:
cbin = tools_dir / 'CgbiPngFix' / cgbipng_bin
args = [cbin.as_posix(), '-i',
icon_file, '-o', outfile.as_posix()]
try:
out = subprocess.run(args, capture_output=True)

Check failure

Code scanning / CodeQL

Uncontrolled command line Critical

This command line depends on a
user-provided value
.
This command line depends on a
user-provided value
.
except Exception:
# Fails or PNG is not crushed
shutil.copy2(icon_file, outfile.as_posix())
else:
shutil.copy2(icon_file, outfile.as_posix())
app_dict['icon_path'] = outfile.name
Expand Down

0 comments on commit d82acb7

Please sign in to comment.