Release 1.0.0: Semgrep Kotlin/Swift migration, new rules, reporting, and reliability fixes by ajinabraham · Pull Request #121 · MobSF/mobsfscan

ajinabraham · 2026-08-10T04:25:07Z

Summary

This branch prepares mobsfscan 1.0.0 with a major rules-engine cleanup, new mobile security coverage, CI/reporting improvements, and a set of long-standing bug fixes.

Rules engine (Semgrep-first)

Port Kotlin and Swift pattern rules to Semgrep; keep Objective-C on libsast regex.
Organize Semgrep rules by language: semgrep/{java,kotlin,swift}/ and best_practices/{java,kotlin,swift}/.
Preserve best-practice missing-control inversion per language (SafetyNet/root/tapjacking/pinning/etc.).
Android code scanning is Semgrep-only (removed Android regex pattern dirs).

New / expanded security coverage

Clean-room Android rules researched from Minded Security MASTG Semgrep work (biometric crypto, weak TLS, sensitive input/notifications, XOR crypto, layout XML), with credit in README — no GPL rule text copied.
iOS Info.plist App Transport Security checks.
Additional Kotlin ports of common Java sinks (WebView, crypto, injection, XXE, etc.).

Reporting & CI

Native GitLab SAST report output (--gitlab-sast).
SonarQube formatter upgraded to generic issue format 10.3+.
Richer SARIF rule titles/dashboard metadata.
README CI examples updated (actions/checkout@v5, setup-python@v6, SARIF upload).

Reliability / false-positive fixes

Require libsast 3.1.8 for Semgrep ARG_MAX batching on large scans.
Fix network_security_config crash with multiple domain-config siblings.
mobsf-ignore applies correctly per match across files.
.mobsf severity-overrides for per-rule severity.
Hardcoded-secret FP reductions (ios_hardcoded_secret produces too many false positives #111) and longer secret literals (False negatives: hardcoded secrets #88).
Exclude Swift print() from ios_log ('print' in swift rules #112).

Packaging

Version bump to 1.0.0; setuptools classifier set to Production/Stable.
Refresh Pipfile.lock / requirements.txt (used by the composite GitHub Action).

Validation

Unit tests and Semgrep rule fixtures updated/passing.
Spot-checked against vulnerable apps: PIVAA (Java), InsecureShop (Kotlin), iGoat-Swift, OWASP iGoat (ObjC) — scans completed with findings and no engine errors.

Test plan

CI green on this PR (tox / unit tests / Semgrep validate+test)
pip install -e . then mobsfscan -v shows 1.0.0
Scan a mixed Android project (.java + .kt) and confirm Semgrep findings + language-appropriate missing controls
Scan an iOS Swift project and confirm ios_* Semgrep findings; print alone does not trigger ios_log
Scan an Objective-C project and confirm regex ios_* findings still work
Verify --sarif, --sonarqube, --gitlab-sast, and --json outputs
Verify .mobsf ignore-rules, severity-overrides, and // mobsf-ignore: comments
Confirm GitHub Action still installs from requirements.txt and runs successfully

Made with Cursor

Add mixed-content detection for Java/Kotlin and tighten SharedPreferences world mode matching from MobSF. Co-authored-by: Cursor <cursoragent@cursor.com>

Use descriptive rule names plus security-severity, tags, help text, and defaultConfiguration so GitLab/GitHub/SonarQube show meaningful findings. Fixes #116 Co-authored-by: Cursor <cursoragent@cursor.com>

Introduce --gitlab-sast to emit GitLab's SAST JSON directly, with CWE/OWASP/MASVS mapping and README CI examples. Fixes #115 Co-authored-by: Cursor <cursoragent@cursor.com>

Emit separate rules and issues arrays with Clean Code attributes and SECURITY impacts so imports no longer warn about the deprecated format. Fixes #114 Co-authored-by: Cursor <cursoragent@cursor.com>

print writes to stdout, not the system console like NSLog/os_log. Fixes #112 Co-authored-by: Cursor <cursoragent@cursor.com>

Require a bare key= or common secret-key names instead of any identifier ending in key (e.g. APP_VERSION_KEY / languageKey). Fixes #111 Co-authored-by: Cursor <cursoragent@cursor.com>

Allow projects to bump or lower rule severity (INFO/WARNING/ERROR) before severity-filter, exit codes, and report formatters run. Fixes #108 Co-authored-by: Cursor <cursoragent@cursor.com>

Replace file-wide wipe with a line-level filter, parse ignore rule ids as tokens, and check the full match line span so BOL findings can be suppressed. Supersedes the approach in PR #105. Fixes #99 Fixes #104 Fixes #107 Co-authored-by: Cursor <cursoragent@cursor.com>

Pull in the Semgrep argv batching fix so large trees no longer fail with "Argument list too long" (mobsfscan#98). Co-authored-by: Cursor <cursoragent@cursor.com>

Kotlin/iOS regex rules capped values at 100 chars, so long hex keys and similar secrets were false negatives while Java Semgrep was not. Fixes #88 Co-authored-by: Cursor <cursoragent@cursor.com>

xmltodict returns a list for sibling domain-config nodes; iterate configs (including nested) instead of calling .get on the list. Fixes #87 Co-authored-by: Cursor <cursoragent@cursor.com>

Port MobSF ATS analysis so NSAllowsArbitraryLoads and exception-domain misconfigurations are reported from Info.plist during iOS/auto scans. Co-authored-by: Cursor <cursoragent@cursor.com>

…rep. Clean-room Semgrep, Kotlin, and layout XML checks cover biometric crypto binding, weak TLS, sensitive input caching, custom XOR crypto, and sensitive notifications without importing GPL rule text. Also refresh README CI action versions. Fixes #68. Co-authored-by: Cursor <cursoragent@cursor.com>

Replace Android Kotlin and iOS Swift regex patterns with Semgrep rules, move Java Semgrep under java/, keep Objective-C on libsast, and preserve best-practice missing-control inversion per language. Co-authored-by: Cursor <cursoragent@cursor.com>

Mark setuptools development status as Production/Stable and drive formatter tests from __version__ instead of hardcoded strings. Co-authored-by: Cursor <cursoragent@cursor.com>

Keep the GitHub Action dependency freeze aligned with the locked libsast 3.1.8 hashes and current package name normalization. Co-authored-by: Cursor <cursoragent@cursor.com>

cursor · 2026-08-10T04:25:12Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Stop forcing absolute paths in Android XML and iOS Info.plist results so they match Semgrep/source reporting and reduce ASOC duplicates (#109). Co-authored-by: Cursor <cursoragent@cursor.com>

ajinabraham · 2026-08-10T04:30:14Z

Also landed path normalization for Android XML and Info.plist findings (inspired by #109): results now prefer cwd-relative file_path values, matching Semgrep/source output.

Avoid an empty except in security_severity_score so CodeQL py/empty-except is satisfied while keeping the severity fallback. Co-authored-by: Cursor <cursoragent@cursor.com>

Invert presence hits for both dialects under a platform (Java∪Kotlin, Swift∪ObjC) so Semgrep BP rules cannot leak, while only reporting missing controls for languages actually present in the scan paths. Co-authored-by: Cursor <cursoragent@cursor.com>

Ajin and others added 16 commits August 9, 2026 19:20

Bump to 0.4.6 and port recent MobSF WebView rules.

49d1fc9

Add mixed-content detection for Java/Kotlin and tighten SharedPreferences world mode matching from MobSF. Co-authored-by: Cursor <cursoragent@cursor.com>

Improve SARIF rule titles and dashboard metadata.

c4e941b

Use descriptive rule names plus security-severity, tags, help text, and defaultConfiguration so GitLab/GitHub/SonarQube show meaningful findings. Fixes #116 Co-authored-by: Cursor <cursoragent@cursor.com>

Add native GitLab SAST report output.

f2e7b8f

Introduce --gitlab-sast to emit GitLab's SAST JSON directly, with CWE/OWASP/MASVS mapping and README CI examples. Fixes #115 Co-authored-by: Cursor <cursoragent@cursor.com>

Upgrade SonarQube output to the 10.3+ generic issue format.

114c12d

Emit separate rules and issues arrays with Clean Code attributes and SECURITY impacts so imports no longer warn about the deprecated format. Fixes #114 Co-authored-by: Cursor <cursoragent@cursor.com>

Exclude Swift print() from ios_log to cut false positives.

c111034

print writes to stdout, not the system console like NSLog/os_log. Fixes #112 Co-authored-by: Cursor <cursoragent@cursor.com>

Tighten hardcoded key matching to reduce false positives.

101abd0

Require a bare key= or common secret-key names instead of any identifier ending in key (e.g. APP_VERSION_KEY / languageKey). Fixes #111 Co-authored-by: Cursor <cursoragent@cursor.com>

Add .mobsf severity-overrides for per-rule severity.

dc07dcc

Allow projects to bump or lower rule severity (INFO/WARNING/ERROR) before severity-filter, exit codes, and report formatters run. Fixes #108 Co-authored-by: Cursor <cursoragent@cursor.com>

Require libsast 3.1.8 for Semgrep ARG_MAX batching.

c1c28ef

Pull in the Semgrep argv batching fix so large trees no longer fail with "Argument list too long" (mobsfscan#98). Co-authored-by: Cursor <cursoragent@cursor.com>

Raise hardcoded-secret string length limit to 8192.

0f44e99

Kotlin/iOS regex rules capped values at 100 chars, so long hex keys and similar secrets were false negatives while Java Semgrep was not. Fixes #88 Co-authored-by: Cursor <cursoragent@cursor.com>

Fix network_security_config crash with multiple domain-config blocks.

789bb96

xmltodict returns a list for sibling domain-config nodes; iterate configs (including nested) instead of calling .get on the list. Fixes #87 Co-authored-by: Cursor <cursoragent@cursor.com>

Add iOS Info.plist App Transport Security checks.

da7f58d

Port MobSF ATS analysis so NSAllowsArbitraryLoads and exception-domain misconfigurations are reported from Info.plist during iOS/auto scans. Co-authored-by: Cursor <cursoragent@cursor.com>

Align packaging and tests with the 1.0.0 stable release.

fcd5752

Mark setuptools development status as Production/Stable and drive formatter tests from __version__ instead of hardcoded strings. Co-authored-by: Cursor <cursoragent@cursor.com>

Refresh Pipfile.lock and requirements.txt after pipenv sync.

3bd2630

Keep the GitHub Action dependency freeze aligned with the locked libsast 3.1.8 hashes and current package name normalization. Co-authored-by: Cursor <cursoragent@cursor.com>

github-advanced-security AI found potential problems Aug 10, 2026

View reviewed changes

Comment thread mobsfscan/formatters/sarif.py Fixed

Prefer cwd-relative paths for XML and Info.plist findings.

d57c23c

Stop forcing absolute paths in Android XML and iOS Info.plist results so they match Semgrep/source reporting and reduce ASOC duplicates (#109). Co-authored-by: Cursor <cursoragent@cursor.com>

ajinabraham mentioned this pull request Aug 10, 2026

Removing resolve absolute path of XML files #109

Closed

ajinabraham and others added 2 commits August 9, 2026 21:31

Clarify SARIF CVSS parsing when metadata is non-numeric.

1040e96

Avoid an empty except in security_severity_score so CodeQL py/empty-except is satisfied while keeping the severity fallback. Co-authored-by: Cursor <cursoragent@cursor.com>

ajinabraham merged commit a43635d into main Aug 10, 2026
12 checks passed

ajinabraham deleted the aug-9-2026 branch August 10, 2026 05:31

This was referenced Aug 10, 2026

Ensure multiple suppressions work as expected #105

Closed

backport rule #118

Closed

I scan the others as normal But this folder will have error #98

Closed

Write semgrep kotlin rules #29

Closed

Navigation Menu

Uh oh!

Uh oh!

Release 1.0.0: Semgrep Kotlin/Swift migration, new rules, reporting, and reliability fixes - #121

Release 1.0.0: Semgrep Kotlin/Swift migration, new rules, reporting, and reliability fixes#121
ajinabraham merged 19 commits into
mainfrom
aug-9-2026

ajinabraham commented Aug 10, 2026

Uh oh!

cursor Bot commented Aug 10, 2026

Uh oh!

Uh oh!

ajinabraham commented Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

ajinabraham commented Aug 10, 2026

Summary

Rules engine (Semgrep-first)

New / expanded security coverage

Reporting & CI

Reliability / false-positive fixes

Packaging

Validation

Test plan

Uh oh!

cursor Bot commented Aug 10, 2026

Uh oh!

Uh oh!

ajinabraham commented Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants