Security fixes
We recommend upgrading.
- High: GitHub Action runs Python code from the repository it scans.
GHSA-jm43-56r4-gg3h - Low: Incomplete SSRF protection in the App Links check.
GHSA-c24h-ff56-crqw - Low: Scan hangs on a slow App Links response.
GHSA-p634-w5cj-mm4w - Low: HTML injection in the
--htmlreport.
GHSA-7fwm-f8j5-53hr - Low: Symlinks followed out of the scanned tree.
GHSA-wc6x-4qwm-pcw9
New detection rules
New Android rules (Java and Kotlin) for:
- path traversal in content providers, and ZipSlip
- intent redirection
- PendingIntents created without
FLAG_IMMUTABLE - deep links loaded into a WebView
- OAuth redirects to custom schemes
LocalServerSocket- databases on external storage
- Google API keys and PEM private keys
New iOS rules coverASWebAuthenticationSessionand SSZipArchive.
Other changes
- The GitHub Action now runs on Python 3.13, set up by
actions/setup-python, instead of whatever Python the
runner provides. - An XML file that can't be parsed is now skipped, instead of being reported with the previous file's findings.
- Requires libsast 3.1.9 or later.
Thanks to the security researchers who reported these issues; credits are on each advisory.
What's Changed
- Skip unparsable XML instead of reusing the previous document by @marcelxsilva in #127
- Add detection rules: path traversal, intent redirection, PendingIntents, deep link to WebView, OAuth custom schemes, local sockets, secret material by @ajinabraham in #128
- Escape every cell in the --html report by @ajinabraham in #133
- Harden the App Links assetlinks.json fetch against SSRF by @ajinabraham in #132
- Require libsast 3.1.9 so symlinked files aren't scanned by @ajinabraham in #134
- Run the Action's Python from its own directory, not the scanned workspace by @ajinabraham in #129
- Run the Action on Python 3.13 from setup-python by @ajinabraham in #130
New Contributors
- @marcelxsilva made their first contribution in #127
Full Changelog: 1.0.1...1.1.0