发布 APK 如何盘点残留的调试文件与敏感资产

from pathlib import Path, PurePosixPath
import json
import re
import sys
import zipfile

if len(sys.argv) != 3:
    raise SystemExit(2)
apk_path = Path(sys.argv[1])
policy_path = Path(sys.argv[2])
if not apk_path.is_file() or not policy_path.is_file():
    raise SystemExit(2)
try:
    policy = json.loads(policy_path.read_text(encoding="utf-8"))
except (OSError, UnicodeError, json.JSONDecodeError):
    raise SystemExit(2)
allowed = policy.get("allowedFindings")
max_entry = policy.get("maxEntryBytes", 1048576)
max_total = policy.get("maxTotalBytes", 33554432)
if not isinstance(allowed, list) or not isinstance(max_entry, int) or not isinstance(max_total, int):
    raise SystemExit(2)
allowed_keys = {(item.get("path"), item.get("category")) for item in allowed if isinstance(item, dict)}
name_rules = {
    "debug-name": re.compile(r"(?i)(debug|staging|mock|testdata|trace|dump|backup)"),
    "key-file-name": re.compile(r"(?i)\.(pem|p12|pfx|jks|keystore)$")
}
text_rules = {
    "credential-key": re.compile(rb"(?i)(api[_-]?key|client[_-]?secret|password|authorization)\s*[:=]"),
    "environment-marker": re.compile(rb"(?i)(localhost|staging|internal[_-]?host|mock[_-]?server)"),
    "log-header": re.compile(rb"(?i)(set-cookie|bearer\s+[a-z0-9._-]+|session[_-]?id)")
}
text_suffixes = {".json", ".xml", ".txt", ".properties", ".yaml", ".yml", ".log", ".csv"}
findings = []
seen_paths = set()
total_size = 0

def add(path, category):
    findings.append({"path": path, "category": category})

try:
    with zipfile.ZipFile(apk_path) as archive:
        for info in archive.infolist():
            if info.is_dir():
                continue
            path = info.filename
            parts = PurePosixPath(path).parts
            if path.startswith("/") or ".." in parts or path in seen_paths:
                raise ValueError("unsafe or duplicate path")
            seen_paths.add(path)
            total_size += info.file_size
            if info.file_size < 0 or total_size > max_total:
                raise ValueError("archive size limit")
            for category, pattern in name_rules.items():
                if pattern.search(path):
                    add(path, category)
            suffix = PurePosixPath(path).suffix.lower()
            inspect_text = suffix in text_suffixes or re.fullmatch(r"classes(?:[2-9][0-9]*)?\.dex", PurePosixPath(path).name)
            if inspect_text and info.file_size > max_entry:
                add(path, "oversize-uninspected")
                continue
            if not inspect_text:
                continue
            data = archive.read(info)
            for category, pattern in text_rules.items():
                if pattern.search(data):
                    prefix = "dex-" if suffix == ".dex" else "asset-"
                    add(path, prefix + category)
except (OSError, zipfile.BadZipFile, RuntimeError, ValueError):
    raise SystemExit(2)
unique_findings = sorted({(item["path"], item["category"]) for item in findings})
unapproved = [{"path": path, "category": category} for path, category in unique_findings if (path, category) not in allowed_keys]
report = {"apk": apk_path.name, "entryCount": len(seen_paths), "findings": [{"path": path, "category": category} for path, category in unique_findings], "unapproved": unapproved}
print(json.dumps(report, ensure_ascii=False, indent=2))
if unapproved:
    raise SystemExit(3)