一个简单的例子 1、如果source设置为getJson()的return，sink设置为fromJson的return，可以扫出来；<

污点不能传播的其他例子，我想从uri->commit.<a class="user-mention notranslate" data-hovercard-type=

污点传播不支持gson.fromJson about appshark HOT 3 CLOSED

bytedance commented on August 23, 2024

污点传播不支持gson.fromJson

from appshark.

Comments (3)

firmianay commented on August 23, 2024

污点不能传播的其他例子，我想从uri->commit.@this：

从uri->input可以，从input->output不可以，从output->commit.@this可以

  fun installApk(uri: Uri) {
      val packageInstaller: PackageInstaller = packageManager.packageInstaller
      val params = PackageInstaller.SessionParams(PackageInstaller.SessionParams.MODE_FULL_INSTALL)
      val sessionId = packageInstaller.createSession(params)
      val session = packageInstaller.openSession(sessionId)

      val input: InputStream = contentResolver.openInputStream(uri)!!
      val output: OutputStream = session.openWrite("my_app", 0, -1)
      input.copyTo(output)

      session.fsync(output)
      input.close()
      output.close()

      val intent = Intent("action.demo")
      val pendingIntent = PendingIntent.getBroadcast(this, 0, intent, 0)
      session.commit(pendingIntent.intentSender)
  }

哦这个我在EngineConfig加上，可以解决：

      "<kotlin.io.ByteStreamsKt: long copyTo$default(java.io.InputStream,java.io.OutputStream,int,int,java.lang.Object)>": {
        "p0->p1": {
          "I": ["p0"],
          "O": ["p1"]
        }
      }

from appshark.