safe_to_run

Introduction: A library to help verify that an application is safe to run
More: Author   ReportBugs   
Tags:

Known Vulnerabilities Codacy Badge Quality Gate Status codecov

Safe to run (android library) Maven central - SafeToRun

Core Maven central - Core

Input validation Maven central - Input validation

The purpose of this library is to provide a simple and extensible framework you can use in order to check your app is safe to run, and provide you with a way to verify data from intents or deep links is safe.

Documentation

Documentation website

Quickstart

implementation "io.github.dllewellyn.safetorun:safetorun:$safeToRunVersion"
implementation "io.github.dllewellyn.safetorun:safeToRunCore:$safeToRunVersion"
implementation "io.github.dllewellyn.safetorun:inputverification:$safeToRunVersion"

Safe to run input verification

A fuller discussion can be found here:

Verify URL

Urls

Here's a sample which will only allow safetorun.com as the host, and only allowed the parameterName with the name "param" of type string.

"https://safetorun.com?param=abc".urlVerification {
    "safetorun.com".allowHost()
    allowParameter {
        allowedType = AllowedType.String
        parameterName = "param"
    }
} == true

We are able to provide more permissive options, for example:

"https://safetorun.com?param=abc".urlVerification {
    "safetorun.com".allowHost()
    allowAnyParameter()
} == true

Files

Allow specific private file

We can use safe to run for files too:

Allowing a specific file

val isFileSafeToOpen = uri.verifyFile(this) {
    // This
    File(context.filesDir + "files/", "safe_to_read.txt").allowExactFile()

    // Is the same as this:
    addAllowedExactFile(File(context.filesDir + "files/", "safe_to_read.txt"))
}

or maybe adding a directory

val isFileSafeToOpen = uri.verifyFile(this) {
    // This
    addAllowedParentDirectory(context.filesDir.allowDirectory())

    // Is the same as this:
    FileUriMatcherBuilder.FileUriMatcherCheck(
        context.filesDir,
        false
    )
}

See docs for full information, and "app" for an example

Recompilation protection

Safe to run uses inline functions as an added level of protection against reverse engineering. It is recommended that you use the inline implementation in many places throughout the application in order to harden against reverse engineering.

 private inline fun canIRun(actionOnFailure: () -> Unit) {
      if (safeToRun(buildSafeToRunCheckList {
              add {
                  banAvdEmulatorCheck()
              }

              add {
                  blacklistedAppCheck()
              }

              add {
                  rootDetectionCheck()
              }

              add {
                  banGenymotionEmulatorCheck()
              }

              add {
                  banBluestacksEmulatorCheck()
              }

              add {
                  safeToRunCombinedCheck(
                      listOf(
                          { bannedHardwareCheck("hardware") },
                          { bannedBoardCheck("board") }
                      )
                  )
              }

              add {
                  safeToRunCombinedCheck(
                      listOf { installOriginCheckWithDefaultsCheck() },
                      listOf { !BuildConfig.DEBUG }
                  )

              }

              add {
               verifySignatureCheck("Abc")
              }
          })()) {
          actionOnFailure()
      }
  }
Apps
About Me
GitHub: Trinea
Facebook: Dev Tools