Class SensitiveInfoExtractor

static_tools/sensitive_info_extractor.py:25–153

class SensitiveInfoExtractor(object):

    def get_all_file_paths(self, file_path):
        totalFiles = []
        for root, dirs, files in os.walk(file_path):
            tempFiles = [os.path.join(root, i) for i in files]
            totalFiles += tempFiles

        return totalFiles
    
    def extract_all_sensitive_info(self, list_of_files, relative_path):
        """
        This function detects M1: Insecure Authentication/Authorization
        Extracts all the keys for all the apk file
        in: file list - all file path
            relative - gives the path relative to this path
        Out: string path: key type: value
        """
        all_sensitive_info_list = []
        indent = "    "

        excluded_extensions = ['.ttf', '.otf', '.png', '.jpg', '.jpeg', '.gif', '.webp', '.dex', '.gradle']

        for file in list_of_files:
            _, file_extension = os.path.splitext(file)
            if file_extension.lower() not in excluded_extensions:
                try:
                    with open(file, "r", encoding='utf-8', errors='ignore') as f:
                        read = f.read()
                    types_ioc_list = self.extract(read)
                    real_relative_path = os.path.relpath(file, relative_path)
                    for items in types_ioc_list:
                        print(indent + items)
                        parts = items.split(": ", 1)
                        secret_info = {
                            "type": parts[0],
                            "ioc": parts[1] if len(parts) > 1 else "",
                            "path": real_relative_path,
                        }
                        all_sensitive_info_list.append(secret_info)
                except Exception:
                    continue
        return all_sensitive_info_list
    
    def extract_insecure_request_protocol(self, list_of_files):
        """
        This function detects M2: Insecure Communication in OWASP Top 10
        It will check for all the insure communication used throughout the app source code.
        """
        final_list = list()
        script_dir = os.path.dirname(os.path.abspath(__file__))
        file_path = os.path.join(script_dir, 'known_false_positives.txt')
        # Read known false positives from a file (skip empty lines and comments)
        with open(file_path, 'r') as f:
            known_false_positives = [
                line.strip() for line in f
                if line.strip() and not line.strip().startswith('#')
            ]