Verify MobSF service version with scanner_version
MobSF service version is different from analyzer version. We need to implement a verification process so that it enforces us to update versions in the both places. According to this comment, the following is suggested code-snippet:
type serviceVersion struct {
Version string `json:"version"`
}
// func analyze(...)
archive, err := createArchive(path, excludedDirs)
// versionUrl exposes the service version to verify analyzer match
versionUrl := getBaseURL()+"/api/v1/dynamic/get_apps"
req, err := newRequest(http.MethodGet, versionUrl)
if resp.StatusCode == http.StatusOK {
v := new(serviceVersion)
if err := json.NewDecoder(resp.Body).Decode(v); err != nil {
if v.Version != os.Getenv("SCANNER_VERSION") {
panic("VERSION MISMATCH")
}
}
}
info, err := upload(archive)
Ideally, we should keep track of the version in one place. We need to investigate whether we can implement a better solution to this issue by keeping the version in one place which will serve as a single source of truth.
Edited by Lucas Charles