AppThreat / AppThreat/chen

[java] Signal-Android is missing most purl tags

Open
#104 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Scala
Stars
34
Forks
5
Avg merge
1h 56m
Merged PRs (30d)
3

Description

While analysing Signal-Android [repo](https://github.com/signalapp/Signal-Android), I noticed that our [CdxPass](https://github.com/AppThreat/chen/blob/1143fda53b4107087c2ef6350b478dc3bb339e0c/platform/frontends/x2cpg/src/main/scala/io/appthreat/x2cpg/passes/taggers/CdxPass.scala#L17) is missing most of the purl tags. We need to triage to find out where the problem is. It is possible that cdxgen is missing namespaces for jars inside `ANDROID_SDK` at this point, but it is best to have a ticket here and test the entire stack.

Atom file, slices, etc., can be found at the link below:

https://huggingface.co/datasets/AppThreat/ukaina/tree/main/java/Signal-Android

Only the purl tags below are present in the atom [file](https://huggingface.co/datasets/AppThreat/ukaina/blob/main/java/Signal-Android/app.atom).

```text
"pkg:maven/org.conscrypt/conscrypt-openjdk-uber@2.5.2?type=jar",
"pkg:maven/org.jetbrains.kotlin/kotlin-stdlib@1.9.10?type=jar",
"pkg:maven/com.squareup.okio/okio-jvm@3.9.0?type=jar",
"pkg:maven/com.googlecode.ez-vcard/ez-vcard@0.9.11?type=jar",
"pkg:maven/com.squareup.okhttp3/okhttp@4.12.0?type=jar",
"pkg:maven/org.robolectric/robolectric@4.10.3?type=jar",
"pkg:maven/org.signal/libsignal-client@0.69.1?type=jar",
"pkg:maven/org.mp4parser/muxer@1.9.39?type=jar",
"pkg:maven/com.google.guava/guava@32.0.1-jre?type=jar",
"pkg:maven/org.mp4parser/streaming@1.9.39?type=jar",
"pkg:maven/net.sf.kxml/kxml2@2.3.0?type=jar",
"pkg:maven/com.github.bumptech.glide/disklrucache@4.15.1?type=jar",
"pkg:maven/com.google.firebase/firebase-annotations@16.2.0?type=jar",
"pkg:maven/androidx.lifecycle/lifecycle-common-jvm@2.8.7?type=jar",
"pkg:maven/org.greenrobot/eventbus@3.0.0?type=jar",
"pkg:maven/com.annimon/stream@1.1.8?type=jar",
"pkg:maven/com.googlecode.libphonenumber/libphonenumber@8.13.50?type=jar",
"pkg:maven/junit/junit@4.13.2?type=jar",
"pkg:maven/org.mp4parser/isoparser@1.9.39?type=jar",
"pkg:maven/com.google.zxing/android-integration@3.3.0?type=jar",
"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.0?type=jar",
"pkg:maven/com.uber.rxdogtag2/rxdogtag@2.0.1?type=jar",
"pkg:maven/com.squareup.wire/wire-runtime-jvm@4.4.3?type=jar",
"pkg:maven/dnsjava/dnsjava@2.1.9?type=jar"
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.