Giters

MobSF / mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Android API 34 missing from ANDROID_API_LEVEL_MAP

arttujo opened this issue · comments

commented

It would seem that in the latest pull request and with the new ANDROID_API_LEVEL_MAP there seems to be an issue where if your targetSdk = 34 all the checks will default to API lvl 26 due to 34 missing from the definition.

commented

Thanks for reporting this, I will update the ANDROID_API_LEVEL_MAP.

It seems like if the targetSdk is not determined from the manifest file, minSdk is used as target SDK. ANDROID_API_LEVEL_MAP is not considered for determining targetSdk

commented

Addressed in #77

commented

It seems like if the targetSdk is not determined from the manifest file, minSdk is used as target SDK.

This will lead to a false failure in TaskHijackingChecks if minSdk=26 but targetSdk=34 defined in build.gradle.

Both minSdk and targetSdk really should come from build.gradle because it is no longer defined in Manifest.
@ajinabraham Is there a way to have scan_manifest or TaskHijackingChecks instead read from build.gradle in order to obtain the correct minSdk/targetSdk version?