sensepost / sensepost/objection
[bug] objection patchipa freezes indefinitely when .mobileprovision is invalid
- Dominant language
- Python
- Stars
- 9.4k
- Forks
- 1k
- Avg merge
- 14d 5h
- Merged PRs (30d)
- 1
Description
Describe the bug
Hello,
The objection patchipa command freezes indefinitely when specifying an invalid .mobileprovision file.
To Reproduce
Run the following command and provide an empty or invalid .mobileprovision file:
objection patchipa --source iGoat-Swift.ipa --codesign-signature XXXXX -P /dev/null
Expected behavior
The command should immediately return with an error message. Instead, it freezes indefinitely and never returns:
The issue seems to happen when fetching the bundle id from the .mobileprovision file (https://github.com/sensepost/objection/blob/master/objection/utils/patchers/ios.py#L475), the chain of commands is prepended with cat | , thus the whole command never returns whereas the underlying security cms command immediately returns an error when ran separately:
$ security cms -D -i /dev/null | plutil -extract Entitlements.application-identifier xml1 -o - - | grep string | sed 's/^<string>[^\.]*\.\(.*\)<\/string>$/\1/g'
security: failed to decode message: UNKNOWN (-8183(d)
security: problem decoding
Environment :
- OS: macOS 13
- Frida Version: 16.0.11
- Objection Version: 1.11.0
Thank you.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.