MobSF/mobsfscan 1.2.0

on GitHub

JavaScript, TypeScript & Hybrid Mobile Support

• Tree-sitter AST rules (libsast[js] >= 3.2.0): Added 28 MobSF JavaScript and TypeScript rules covering React Native, Expo, Cordova / Ionic, Capacitor, and WebView apps across .js, .jsx, .ts, .tsx, .mjs, .cjs, and <script> blocks in .html, .htm, .vue, and .svelte.
  • Covers WebView misconfigurations (JavaScript enabled, file access, mixed content, wildcard origins, dynamic URIs, dynamic script injection, remote debugging, all-frame injection, allow-all navigation, unverified onMessage bridges), DOM XSS sinks, dynamic code execution (eval / Function / string timers), wildcard postMessage('*'), unencrypted storage (AsyncStorage, MMKV, Realm, SQLite, redux-persist), hardcoded secrets and crypto keys, weak cryptography, TLS validation bypass, SQLite injection, Keychain accessibility, clipboard leaks, insecure expo-auth-session OAuth, non-crypto biometrics, shared external storage, sensitive console logging outside __DEV__, client-side auth gates, and bundled debug tooling.
• Hybrid configuration checks:
  • Cordova / PhoneGap (config.xml): Wildcard <access origin="*" /> and <allow-navigation> origins.
  • Capacitor (capacitor.config.json): Cleartext HTTP server settings and wildcard server.allowNavigation.
  • Expo (app.json, app.config.json, app.config, app.manifest): Secret-like values in extra and cleartext or unsigned OTA updates.
• React Native Android bridge rules: Added Semgrep rules (Java and Kotlin) for @ReactMethod native module methods performing file system I/O or command execution.
• CLI & suppressions:
  • Added --type javascript (--type {android,ios,javascript,auto}); --type auto runs JavaScript/hybrid checks automatically alongside Android and iOS checks while skipping node_modules and vendor bundles.
  • Inline mobsf-ignore: suppressions now also support JSX ({/* ... */}) and HTML/XML (<!-- ... -->) comments.

Rule & Engine Fixes

• Java XXE rules: Synced xmlinputfactory_xxe and xmlinputfactory_xxe_enabled with upstream semgrep-rules to fix false positives when disabling external entities via XMLInputFactory constants and catch Boolean.TRUE / SUPPORT_DTD variants (#136).
• Semgrep option-injection hardening: Requires libsast >= 3.2.0 (includes libsast 3.1.10's -- end-of-options separator before Semgrep file paths).
• Refreshed GitHub Action dependencies and workflow pins.

What's Changed

• Require libsast 3.1.10 by @ajinabraham in #135
• Fix #136: sync XXE XMLInputFactory rules with upstream semgrep-rules by @Huyvux12 in #137
• Add JavaScript, TypeScript, and hybrid mobile SAST rules (v1.2.0) by @ajinabraham in #138

New Contributors

• @Huyvux12 made their first contribution in #137

Full Changelog: 1.1.0...1.2.0