New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 721530 link

Starred by 1 user
Status: Fixed
Owner:
█ scottkir...@chromium.org
Last visit > 30 days ago
Closed: Jun 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 1
Type: Bug



Sign in to add a comment

WebAPK Comment check should check 'gaps' in apk.

Project Member Reported by scottkir...@chromium.org, May 11 2017 
APKs are build on top of jar files which are essentially zip files.
The zip file format is flexible and gaps can exist in the zip that are ignored when uncompressing the archive. The danger is that code could potentially be stored in these 'gaps' and loaded dynamically and then executed.

Specific cases are:
* Gap before start of zip.
* Gap at the end of the the zip.
* Gap before the EOCD.
* Gap before the Central Directory.
* Gap between zip files.

The apksigner (v2 signing) stores some signing info before the central directory, so that gap should still be supported (up to a point), but only if its signature is detected.

The Comment signed verification code still needs to be performant.
Project Member

Comment 1 by bugdroid1@chromium.org, May 19 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/48a8f38f1be0b12ab76dd6d7543e0448726030a1

commit 48a8f38f1be0b12ab76dd6d7543e0448726030a1
Author: scottkirkwood <scottkirkwood@chromium.org>
Date: Fri May 19 15:35:26 2017

Add additional checks for comment signed WebAPKs.

* Make sure there's no block before the start of the APK.
* Make sure there's no block at the end of the APK.
* Make sure there's no block before EOCD or CD.
* If it appears to be v2 signed, then we allow a medium sized block
  before the Central Directory (CD).

BUG= 721530 

Review-Url: https://codereview.chromium.org/2873943005
Cr-Commit-Position: refs/heads/master@{#473200}

[modify] https://crrev.com/48a8f38f1be0b12ab76dd6d7543e0448726030a1/chrome/android/webapk/libs/client/junit/src/org/chromium/webapk/lib/client/WebApkValidatorTest.java
[modify] https://crrev.com/48a8f38f1be0b12ab76dd6d7543e0448726030a1/chrome/android/webapk/libs/client/src/org/chromium/webapk/lib/client/WebApkVerifySignature.java
[add] https://crrev.com/48a8f38f1be0b12ab76dd6d7543e0448726030a1/chrome/test/data/webapks/block-at-end.apk
[add] https://crrev.com/48a8f38f1be0b12ab76dd6d7543e0448726030a1/chrome/test/data/webapks/block-before-cd.apk
[add] https://crrev.com/48a8f38f1be0b12ab76dd6d7543e0448726030a1/chrome/test/data/webapks/block-before-eocd.apk
[add] https://crrev.com/48a8f38f1be0b12ab76dd6d7543e0448726030a1/chrome/test/data/webapks/block-before-first.apk

Comment 3 by yfried...@chromium.org, May 25 2017

Labels: -Pri-3 M-60 Pri-1
Anything left here or can it be closed?

Comment 4 by scottkir...@chromium.org, May 25 2017 

Still missing gaps between files in a zip. Not sure how I'll do it, either sorting or using a map since the order of the files isn't guaranteed to be in file offset order.

Comment 6 by scottkir...@chromium.org, Jun 8 2017

Status: Fixed (was: Started)
►

Sign in to add a comment