Skip to content

fix: cache App Link host SSRF verdicts and log them once - #2723

Merged
ajinabraham merged 3 commits into
MobSF:masterfrom
Antiksec:fix/dedup-invalid-host-warning
Oct 24, 2026
Merged

ajinabraham merged 3 commits into
MobSF:masterfrom
Antiksec:fix/dedup-invalid-host-warning

Conversation

@Antiksec

Copy link
Copy Markdown
Contributor

Describe the Pull Request

Manifest analysis calls valid_host() (a DNS lookup) for every
<data android:host=...> declaration across all browsable intent filters.
Apps with many activities that deep-link to the same (non-public) hosts
perform hundreds of identical DNS queries and emit hundreds of duplicate
'Invalid Host' warnings per scan.

Cache the verdict per host: behavior is unchanged, each host is resolved
and logged exactly once per manifest parse.

Checklist for PR

  • Run MobSF unit tests and lint tox -e lint,test
  • Tested Working on Linux, Mac, Windows, and Docker
  • Add unit test for any new Web API (Refer: StaticAnalyzer/tests.py)
  • Make sure tests are passing on your PR MobSF tests

Additional Comments (if any)

flake8 with the plugin set from tox.ini passes on the changed file;
the full `tox -e lint,test` suite was not run locally.

🤖 Generated with O3 Agent Claude
image

Manifest analysis calls valid_host() (a DNS lookup) for every
<data android:host=...> declaration across all browsable intent
filters. Apps with many activities that deep-link to the same
(non-public) hosts perform hundreds of identical DNS queries and
emit hundreds of duplicate 'Invalid Host' warnings per scan.
Cache the verdict per host: behavior is unchanged, each host is
resolved and logged exactly once per manifest parse.
@github-actions

Copy link
Copy Markdown

👋 @Antiksec

Thank you for sending this pull request ❤️.

Please make sure you have followed our contribution guidelines. We will review it as soon as possible

@ajinabraham
ajinabraham merged commit f8300a3 into MobSF:master Oct 24, 2026
11 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants