Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[EFR] AuthZ and AuthN for MobSF + Bug Fixes #2366

Merged
merged 42 commits into from
May 21, 2024
Merged

[EFR] AuthZ and AuthN for MobSF + Bug Fixes #2366

merged 42 commits into from
May 21, 2024

Conversation

ajinabraham
Copy link
Member

@ajinabraham ajinabraham commented Mar 23, 2024

Describe the Pull Request

* Authentication and Authorization (`Maintainer` , Viewer`) support in MobSF
* Basic User Management
* Bug Fixes in Runtime Executable Tampering
* Ratelimiting support for login endpoint
* Disable AuthZ/AuthN for REST API and also via ENV VAR `MOBSF_DISABLE_AUTHENTICATION=1`
* Bug Fix #2285 
* Bug Fix Icon Analysis Nonetype
* Update SSRF Filter
* Dependency Bump
* Beta to Stable release from V4
* Runs with DEBUG=False
* New home screen UI

Checklist for PR

  • Run MobSF unit tests and lint tox -e lint,test
  • Tested Working on Linux, Mac, Windows, and Docker
  • Add unit test for any new Web API (Refer: StaticAnalyzer/tests.py)
  • Make sure tests are passing on your PR MobSF tests

Additional Comments (if any)

DESCRIBE HERE

Copy link

👋 @ajinabraham
Thank you for sending this pull request ❤️.
Please make sure you have followed our contribution guidelines. We will review it as soon as possible

mobsf/MobSF/views/authentication.py Dismissed Show dismissed Hide dismissed
mobsf/MobSF/views/authentication.py Dismissed Show dismissed Hide dismissed
@ohyeah521
Copy link
Contributor

Many security issues can be avoided using the django-allauth module.

@ajinabraham
Copy link
Member Author

For basic username/password authentication and account management, Django has decent inbuilt authentication APIs. Will consider django-allauth or others if we plan to support other authentication strategies.

@ajinabraham ajinabraham marked this pull request as ready for review May 19, 2024 07:17
sydowma
sydowma previously approved these changes May 19, 2024
@matandobr
Copy link
Member

@ajinabraham Great stuff, let me test 😊

Copy link
Member

@matandobr matandobr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good! also tried some Pen testing on it, seems solid
Let me know what you think / if you need help

setup.bat Outdated Show resolved Hide resolved
mobsf/templates/base/nav.html Show resolved Hide resolved
mobsf/templates/auth/users.html Outdated Show resolved Hide resolved
mobsf/MobSF/views/authorization.py Show resolved Hide resolved
mobsf/MobSF/views/authorization.py Show resolved Hide resolved
@ajinabraham
Copy link
Member Author

@matandobr I guess, I have addressed the review comments.

@ajinabraham ajinabraham self-assigned this May 19, 2024
@ajinabraham ajinabraham added this to In progress in MobSF 2024 Development via automation May 20, 2024
@ajinabraham ajinabraham merged commit 76187b8 into master May 21, 2024
12 checks passed
MobSF 2024 Development automation moved this from In progress to Done May 21, 2024
@ajinabraham ajinabraham deleted the auth branch May 21, 2024 17:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants