Skip to content

Add support for scanning multiple projects of any supported type

James Liu requested to merge jliu-android-multimodule into master

What does this MR do?

Adds support for executing multiple scans in a single run. Scans can be a mix of source projects (Android Studio, Eclipse, XCode) and binaries (.ipa, .apk), and any combination.

The analyser will attempt to walk the repository to collect a list of possible scanning entrypoints. The entrypoint is the containing folder for manifest-based scans, and the binary itself for binary-based scans. Each entrypoint will be uploaded to the MobSF instance running internally in the analyser container to be scanned. The scan results are processed to have the correct file paths, and are then be merged into a single gl-sast-report.json. This report provides a comprehensive view of all supported sources and binaries in the repository.

The following types of scans are supported:

  • Android Studio projects (via AndroidManifest.xml)
  • Eclipse projects (via AndroidManifest.xml)
  • Android binaries (via .apk)

The following scans technically work, but we don't parse the results yet:

  • iOS binaries (via .ipa)

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

Edited by James Liu

Merge request reports