search

Guardsquare / appsweep-gradle

This Gradle plugin can be used to continuously integrate app scanning using AppSweep into your Android app build process
http://guardsquare.com/appsweep-mobile-application-security-testing
Apache License 2.0
47 stars 3 forks source link

Calculates path to mapping file on non-dexguarded builds #1

Closed ubiratansoares closed 2 years ago

ubiratansoares commented 2 years ago

Hi 👋🏼

What

Rising this PR as per suggestion given in this thread from Guardsquare community

How

This PR enables the upload of mapping.txt file for non Dexguarded builds by calculating the conventional path 

<buildDir>/outputs/mapping/<variant>/mapping.txt

when registering the appsweep tasks for project's variants.

Tested locally and it seems the upload is working fine.

titze commented 2 years ago

Hi @ubiratansoares,

thanks for the PR, but unfortunately I think it does not work reliably this way.

Before, we depended on the Dexguard-task, which meant that we would run after the Dexguard-task which created the mapping.txt file (if it existed).

Lets assume a Proguard-task creates this mapping-file, then we do not specify that we want to run after this task, and the execution order could be:

1) AppSweep-Task 2) Proguard-Task

then 1) would either not see any mapping-file or (maybe worse), take a stale mapping-file from a previous execution.

The way to solve this would be the @InputFile annotation, but we would first need to check if all other Gradle plugins mark the mappingfile.txt as @OutputFile. (This is true for Proguard and Dexguard, but I am not sure about others)

I can also create a task for us to look into it, if you prefer that we take this up?

ubiratansoares commented 2 years ago

Hi @titze, thanks for the reply.

I do see the issue now!

Jooc I had some look on AGP sources but could not confirm if it will mark mapping.txt as an output file at all 😢

Maybe I missed something ... In any case, maybe it is a better idea Guardsquare taking this task as you've suggested, most likely you folks will have more time and resources to tackle it.

I tried the quick win; when it works it is great, when it doesnt, it is OK too 🙂

Thanks for taking some time for reviewing my PR! Looking forward for the upcoming releases!