[BUG]When the assets directory contains the Assets folder, the generated apk cannot run
yangbo637829 opened this issue · comments
Information
- Apktool Version (
apktool -version
) - 2.9.3 - Operating System (Mac, Linux, Windows) - mac
- APK From? (Playstore, ROM, Other) - playstore
- Java Version (
java --version
) - java 11
Bug
Pay attention to the capitalization of letters about assets and Assets
When the assets directory contains the Assets folder, an additional folder named Assets will be generated at the same level as assets in the generated apk. All non-directory files under the original assets will be placed in the Assets directory.
error code
brut.util.BrutIO#sanitizeFilepath:
final String canonicalEntryPath = new File(directory, entry).getCanonicalPath();
public static String sanitizeFilepath(final File directory, final String entry) throws IOException, BrutException {
if (entry.isEmpty()) {
throw new InvalidUnknownFileException("Invalid Unknown File");
}
if (new File(entry).isAbsolute()) {
throw new RootUnknownFileException("Absolute Unknown Files is not allowed");
}
final String canonicalDirPath = directory.getCanonicalPath() + File.separator;
final String canonicalEntryPath = new File(directory, entry).getCanonicalPath();
if (!canonicalEntryPath.startsWith(canonicalDirPath)) {
throw new TraversalUnknownFileException("Directory Traversal is not allowed");
}
// https://stackoverflow.com/q/2375903/455008
return canonicalEntryPath.substring(canonicalDirPath.length());
}
my temporary solution
Looking forward to the perfect solution.
public static String sanitizeFilepath(final File directory, final String entry) throws IOException, BrutException {
if (entry.isEmpty()) {
throw new InvalidUnknownFileException("Invalid Unknown File");
}
if (new File(entry).isAbsolute()) {
throw new RootUnknownFileException("Absolute Unknown Files is not allowed");
}
final String canonicalDirPath = directory.getCanonicalPath() + File.separator;
final File file = new File(directory, entry);
String canonicalEntryPath = file.getCanonicalPath();
if (canonicalEntryPath.contains("/assets/Assets/")) {
final String absolutePath = file.getAbsolutePath();
if (!canonicalEntryPath.equals(absolutePath)) {
LOGGER.info("sanitizeFilepath: replace path, from = " + canonicalEntryPath + " , to = " + absolutePath);
canonicalEntryPath = absolutePath;
}
}
if (!canonicalEntryPath.startsWith(canonicalDirPath)) {
throw new TraversalUnknownFileException("Directory Traversal is not allowed");
}
// https://stackoverflow.com/q/2375903/455008
return canonicalEntryPath.substring(canonicalDirPath.length());
}
Thanks for the report. May you submit a failing test case to the repo? I've seen a few iterations of this bug and never really track it down.
Since I can't really accept a patch that just hard-codes assets/Assets
- it must be some case sensitive changes we can do?
Thanks for the report. May you submit a failing test case to the repo? I've seen a few iterations of this bug and never really track it down.
Since I can't really accept a patch that just hard-codes
assets/Assets
- it must be some case sensitive changes we can do?
@Test
public void validAssetsFileTest() throws IOException, BrutException {
File asset = new File(sTmpDir, "assets");
if (!asset.exists()) {
asset.mkdirs();
}
File Asset = new File(asset, "Assets");
if (!Asset.exists()) {
Asset.mkdirs();
}
TestUtils.copyResourceDir(UnknownDirectoryTraversalTest.class, "util/traversal", asset);
String validFilename = BrutIO.sanitizeFilepath(asset, "assets/file");
assertEquals(validFilename, "assets/file");
}
![image](https://private-user-images.githubusercontent.com/8817374/320477473-2eadd6af-9f2c-41e7-ada3-4d5221fc7902.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTc5ODEyNTksIm5iZiI6MTcxNzk4MDk1OSwicGF0aCI6Ii84ODE3Mzc0LzMyMDQ3NzQ3My0yZWFkZDZhZi05ZjJjLTQxZTctYWRhMy00ZDUyMjFmYzc5MDIucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDYxMCUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA2MTBUMDA1NTU5WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9MGVjN2ExNWM5ZGVjMDU5ZWZkMmQ3NDY4NWUyZTFhMTZjZmY5OTU5NGQ4NzBmNTA3NGQzNzQ0MDUxZjYzNDg0ZiZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.r5lzl5Ag7RVZsjjr8RY_Zj7uxm4yTC-FPS8YJg1hnPU)
thanks. I'll take a look with this sample.