safetorun / safe_to_run Goto Github PK
View Code? Open in Web Editor NEWA library to help verify the security of your android application
Home Page: https://safetorun.com
License: Apache License 2.0
A library to help verify the security of your android application
Home Page: https://safetorun.com
License: Apache License 2.0
Create the ability for data to be stored locally and sent in bulk to the backend server for analytics event
The function throwApiException is missing documentation.
fun throwApiException(message: String): ApiException = ApiException(message)
static boolean detect_threadCpuTimeNanos(){
long start = Debug.threadCpuTimeNanos();
for(int i=0; i<1000000; ++i)
continue;
long stop = Debug.threadCpuTimeNanos();
if(stop - start < 10000000) {
return false;
}
else {
return true;
}
}
Add the configuration builder for off device configuration including
Prevent an app + its data from being copied and working correctly from one device to another
Can do this by using the android keystore to generate a signature and then verifying it on launch
ZipFile(Main.MyContext.getPackageCodePath());
Unzip and whitelist the code is in there as expected
We should ideally keep track of device IDs by creating a unique device ID for each user and storing it on device.
We should also look to allow someone to access the device ID from the public facing SDK.
Add documentation for the analytics work to explain usage
IDeviceInformationBuilder is missing required documentation.
interface IDeviceInformationBuilder {
Set up a kotlin multiplatform project that can be used to start sending analytics data to the backend
ConfirmVerificationRequest is missing required documentation.
data class ConfirmVerificationRequest(
Add configuration for on-device checks including
Allow for having a builder and configuration that looks like this:
safeToRun(
blacklistedAppCheck {
"com.test.app".add()
rootApps.addAll()
}
)
Capture device metadata to form part of the API call. Should include:
Currently to add a URL Configuration, you have to do this:
val extraIntent = intent.getParcelableExtra<Intent>("extra_intent")
extraIntent?.verify(this) {
urlConfiguration {
"insecureapp.com".allowHost()
}.addConfiguration()
actionOnSuccess = {
startActivity(extraIntent)
finish()
}
actionOnFailure = {
throw RuntimeException("Please don't hack my app")
}
}
Instead, it should just be added automatically by adding a URL configuration function to the builder. e.g. it should look like this:
extraIntent?.verify(this) {
urlConfiguration {
"insecureapp.com".allowHost()
}
}
Allow generation of input verification code from a configuration file. This will allow input verification configuration to be validated at build time, but also allow us to change configuration remotely
Attempt to detect native debuggers (ptrace) attached
Provide a mechanism for rotating the backend secret (ideally using a certificate) and also provide a way of exposing the public certificate to 3rd parties for verification on their own server
Check for sensitive files that you might be accidentally egressing and also check for directory traversal that you might be downloading
The function build is missing documentation.
fun build() = deviceInformationBuilder.build().run {
Add a function to fail nox emulator:
Add the ability for a function or interface to be attached to safe to run resilience which will allow us to log failures and successes - also add a default logger which logs to logcat.
Most likely the best way would be adding a function as a parameter - e.g.:
// Current
inline fun safeToRun(
safeToRunChecks: List<SafeToRunCheck>
)
// Add this:
inline fun safeToRun(
logFunction : (Boolean) -> Unit,
safeToRunChecks: List<SafeToRunCheck>
)
Need to do this in such a way that we actually have two functions so as not to break for existing users
Some (or maybe all) Xiaomi devices have set Build.BOOTLOADER = "unknown"
because of that, every emulator check false triggers
these method are affected
banAvdEmulatorCheck()
banBluestacksEmulatorCheck()
banGenymotionEmulatorCheck()
intentVerificationBuilder {
allowUnknownFields = false
addDataVerification(...)
actionVerification(..)
addBundleVerification(parameterName = "") {
}
addIntentVerification(parameterName = "") {
intentVerification = intentVerificationBuilder { ... }
}
addStringVerification(parameterName = "file") {
fileVerification = //...
}
addStringVerification(parameterName = "url") {
urlVerification = urlVerification {}
}
}
Need to verify loads of different types, e.g. Int, Byte, IntArray, ByteArray etc
We should be able to store device information and query it from the API
We can look at using a combination of inline functions, annotation processing and compiler plugins to make binary modification harder
Requires
In order to allow safe to run functionality to run from react we can package & create a package that can be installed in a react native app and called from javascript.
Need to consider:
Create a comprehensive function for capturing device metadata and potential failures.
Specifically, this should be the object to capturing data:
data class DeviceMetadata(buildInfo : Map<String, String>, rooted : Boolean, emulator : Boolean, signature:String, installOrigin:String, extraData : Map<String, String>)
Build information would be populated by the Build
class.
Extra data would be left empty by default, but allow people to populate with extra checks they make
Currently to add a URL Configuration, you have to do this:
val extraIntent = intent.getParcelableExtra<Intent>("extra_intent")
extraIntent?.verify(this) {
urlConfiguration {
"insecureapp.com".allowHost()
}.addConfiguration()
actionOnSuccess = {
startActivity(extraIntent)
finish()
}
actionOnFailure = {
throw RuntimeException("Please don't hack my app")
}
}
Instead, it should just be added automatically by adding a URL configuration function to the builder. e.g. it should look like this:
extraIntent?.verify(this) {
urlConfiguration {
"insecureapp.com".allowHost()
}
}
Create a function which is able to log users successes and failures to a backend API
We'll need to be able to differentiate between simple API key auth as would be provided from the app (e.g. a public API key) and users who need to perform extra queries - e.g. because they want to be able to query for a list of device information(s) etc
The os check syntax is slightly clunky it might make more sense for conditional builder to be re written
Allow Annotation to provide check before a function is executed.
This means
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.