安全分析报告： CloudStream Remix v2.5

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

[android:allowBackup=true]
这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。

(com.lagradost.cloudstream3.ui.player.DownloadedPlayerActivity)
如果设置了 taskAffinity，其他应用程序可能会读取发送到属于另一个任务的 Activity 的 Intent。为了防止其他应用程序读取发送或接收的 Intent 中的敏感信息，请始终使用默认设置，将 affinity 保持为包名

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

Permission: android.permission.BIND_JOB_SERVICE [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

Permission: android.permission.DUMP [android:exported=true]
发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

[android:exported=true]
发现 Content Provider与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Service与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Broadcast Receiver与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

[android:exported=true]
发现 Activity与设备上的其他应用程序共享，因此可被设备上的任何其他应用程序访问。

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
coil3/intercept/EngineInterceptor.java, line(s) 109
coil3/memory/MemoryCache.java, line(s) 93
coil3/memory/MemoryCacheService.java, line(s) 31
coil3/request/ImageRequest.java, line(s) 138,138
coil3/request/Options.java, line(s) 46
coil3/request/SuccessResult.java, line(s) 41
coil3/transform/Transformation.java, line(s) 29
com/lagradost/api/BuildConfig.java, line(s) 9
com/lagradost/cloudstream3/BuildConfig.java, line(s) 11
com/lagradost/cloudstream3/MainAPIKt.java, line(s) 48
com/lagradost/cloudstream3/MainActivity.java, line(s) 127,128
com/lagradost/cloudstream3/extractors/MailRu.java, line(s) 154
com/lagradost/cloudstream3/extractors/Rabbitstream.java, line(s) 37
com/lagradost/cloudstream3/extractors/WcoStream.java, line(s) 136
com/lagradost/cloudstream3/extractors/helper/NineAnimeHelper.java, line(s) 21,20
com/lagradost/cloudstream3/extractors/helper/WcoHelper.java, line(s) 156,75
com/lagradost/cloudstream3/plugins/PluginManagerKt.java, line(s) 10
com/lagradost/cloudstream3/plugins/VotingApi.java, line(s) 23
com/lagradost/cloudstream3/syncproviders/InAppAuthAPI.java, line(s) 94
com/lagradost/cloudstream3/syncproviders/providers/AniListApi.java, line(s) 66,35,36,37
com/lagradost/cloudstream3/syncproviders/providers/Dropbox.java, line(s) 18
com/lagradost/cloudstream3/syncproviders/providers/MALApi.java, line(s) 81,45,46,47,48
com/lagradost/cloudstream3/syncproviders/providers/OpenSubtitlesApi.java, line(s) 40,35,326
com/lagradost/cloudstream3/syncproviders/providers/SimklApi.java, line(s) 96,206,69,70,65,544
com/lagradost/cloudstream3/syncproviders/providers/SubDlApi.java, line(s) 35,653,286,542
com/lagradost/cloudstream3/ui/library/LibraryFragment.java, line(s) 81
com/lagradost/cloudstream3/ui/library/LibraryViewModelKt.java, line(s) 7
com/lagradost/cloudstream3/ui/player/CS3IPlayer.java, line(s) 471
com/lagradost/cloudstream3/ui/player/CS3IPlayerKt.java, line(s) 7
com/lagradost/cloudstream3/ui/player/FullScreenPlayerKt.java, line(s) 14
com/lagradost/cloudstream3/ui/quicksearch/QuickSearchFragment.java, line(s) 56,59
com/lagradost/cloudstream3/ui/search/SearchHistoryItem.java, line(s) 75
com/lagradost/cloudstream3/ui/search/SearchViewModelKt.java, line(s) 7
com/lagradost/cloudstream3/ui/settings/extensions/ExtensionsViewModelKt.java, line(s) 7
com/lagradost/cloudstream3/ui/setup/SetupFragmentLanguageKt.java, line(s) 7
com/lagradost/cloudstream3/ui/subtitles/ChromecastSubtitlesFragmentKt.java, line(s) 7
com/lagradost/cloudstream3/ui/subtitles/SubtitlesFragmentKt.java, line(s) 9,8,10
com/uwetrottmann/tmdb2/Tmdb.java, line(s) 47
org/jsoup/helper/W3CDom.java, line(s) 211
org/jsoup/internal/SharedConstants.java, line(s) 8,4,6,7
org/jsoup/nodes/DocumentType.java, line(s) 13,14,16
org/schabi/newpipe/extractor/services/peertube/PeertubeParsingHelper.java, line(s) 39,41
org/schabi/newpipe/extractor/services/soundcloud/extractors/SoundcloudPlaylistInfoItemExtractor.java, line(s) 16,17,18
org/schabi/newpipe/extractor/services/youtube/extractors/YoutubeCommentsExtractor.java, line(s) 39,40

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
com/applisto/appcloner/classes/BundleObb.java, line(s) 106
com/hippo/unifile/DocumentsContractApi19.java, line(s) 84
com/lagradost/cloudstream3/plugins/PluginManager.java, line(s) 338,81
com/lagradost/cloudstream3/ui/download/DownloadViewModel.java, line(s) 431
com/lagradost/cloudstream3/ui/subtitles/SubtitlesFragment.java, line(s) 223,496
com/lagradost/safefile/MediaFileKt.java, line(s) 71
com/lagradost/safefile/SafeFile.java, line(s) 553
io/github/anilbeesetti/nextlib/mediainfo/PathUtil.java, line(s) 50
org/acra/file/Directory.java, line(s) 53,103

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
coil3/decode/SourceImageSource.java, line(s) 74
com/applisto/appcloner/classes/Utils.java, line(s) 427
com/lagradost/cloudstream3/actions/OpenInAppActionKt.java, line(s) 61
com/lagradost/cloudstream3/subtitles/SubtitleResource.java, line(s) 35,53
j$/nio/file/Files.java, line(s) 167,171
org/junit/rules/TemporaryFolder.java, line(s) 79,164

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
j$/util/concurrent/ThreadLocalRandom.java, line(s) 14
org/jsoup/helper/DataUtil.java, line(s) 17
org/junit/runner/manipulation/Ordering.java, line(s) 7
org/schabi/newpipe/extractor/services/youtube/YoutubeParsingHelper.java, line(s) 28
org/schabi/newpipe/extractor/utils/RandomStringFromAlphabetGenerator.java, line(s) 3

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/lagradost/cloudstream3/extractors/Chillx.java, line(s) 62

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
com/lagradost/cloudstream3/ui/WebviewFragment.java, line(s) 68,69

MD5是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
andhook/lib/xposed/XposedHelpers.java, line(s) 1087
com/lagradost/cloudstream3/extractors/Rabbitstream.java, line(s) 113

IP地址泄露


Files:
com/applisto/appcloner/classes/HostsBlocker.java, line(s) 147
com/lagradost/cloudstream3/network/DohProvidersKt.java, line(s) 38,38,53,63,63,58,58,33,33,48,48,53,43,43

此应用程序有多个1隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

从应用程序中识别出以下机密确保这些不是机密或私人信息
"biometric_key" : "biometric_key"
"extension_authors" : "Lahaanshaha"
"player_resize_enabled_key" : "player_resize_enabled_key"
"simkl_key" : "simkl_key"
"download_path_key_visual" : "download_path_key_visual"
"rotate_video_key" : "rotate_video_key"
"example_password" : "wachtwoord123"
"redo_setup_key" : "redo_setup_key"
"extension_authors" : "Pembuat"
"player_default_key" : "player_default_key"
"poster_ui_key" : "poster_ui_key"
"double_tap_enabled_key" : "double_tap_enabled_key"
"nginx_key" : "nginx_key"
"example_username" : "MijnCoolGebruikersnaam"
"extension_authors" : "Auteurs"
"test_providers_key" : "test_providers_key"
"example_password" : "motdepasse123"
"playback_speed_enabled_key" : "playback_speed_enabled_key"
"battery_optimisation_key" : "battery_optimisation"
"pref_category_android_tv_key" : "pref_category_android_tv_key"
"enable_nsfw_on_providers_key" : "enable_nsfw_on_providers_key"
"double_tap_seek_time_key" : "double_tap_seek_time_key2"
"quality_pref_mobile_data_key" : "quality_pref_mobile_data_key"
"show_kitsu_posters_key" : "show_kitsu_posters_key"
"extension_authors" : "Autorzy"
"android_tv_interface_off_seek_key" : "android_tv_interface_off_seek_key"
"preview_seekbar_key" : "preview_seekbar_key"
"video_buffer_length_key" : "video_buffer_length_key"
"subdl_key" : "subdl_key"
"legal_notice_key" : "legal_notice_key"
"auto_rotate_video_key" : "auto_rotate_video_key"
"pref_category_gestures_key" : "pref_category_gestures_key"
"dns_key" : "dns_key"
"app_layout_key" : "app_layout_key"
"video_buffer_disk_key" : "video_buffer_disk_key"
"auto_rotate_video_key" : "automatski_rotiraj_video_tipka"
"example_password" : "pasvorto123"
"mal_key" : "mal_key"
"swipe_enabled_key" : "swipe_enabled_key"
"extension_authors" : "Autoriai"
"example_username" : "MiaSalutNomo"
"example_username" : "MagacKaYaabAh"
"extension_authors" : "Autoren"
"pref_category_bypass" : "ISP-Umgehungen"
"show_fillers_key" : "show_fillers_key"
"override_site_key" : "override_site_key"
"skip_startup_account_select_key" : "skip_startup_account_select_key"
"opensubtitles_key" : "opensubtitles_key"
"android_tv_interface_on_seek_key" : "android_tv_interface_on_seek_key"
"show_sub_key" : "show_sub_key"
"rotate_video_key" : "rotera_video_nyckel"
"example_username" : "Benutzername"
"example_password" : "passord123"
"app_theme_key" : "app_theme_key"
"rotate_video_key" : "rotiraj_video_tipka"
"restore_key" : "restore_key"
"apk_installer_key" : "apk_installer_key"
"show_dub_key" : "show_dub_key"
"search_types_list_key" : "search_type_list"
"show_trailers_key" : "show_trailers_key"
"example_username" : "aaaagggk"
"backup_dir_key" : "backup_dir_key"
"display_sub_key" : "display_sub_key"
"quality_pref_key" : "quality_pref_key"
"pref_category_security_key" : "pref_category_security_key"
"extension_authors" : "Autors"
"log_enabled_key" : "log_enabled_key"
"extension_authors" : "Autori"
"subtitles_encoding_key" : "subtitles_encoding_key"
"video_buffer_size_key" : "video_buffer_size_key"
"jsdelivr_proxy_key" : "jsdelivr_proxy_key"
"provider_lang_key" : "provider_lang_key"
"locale_key" : "app_locale"
"example_password" : "passwort123"
"example_username" : "MojeSuperMeno"
"automatic_backup_key" : "automatic_backup_key"
"double_tap_pause_enabled_key" : "double_tap_pause_enabled_key"
"example_password" : "parola123"
"example_password" : "heslo123"
"autoplay_next_key" : "autoplay_next_key"
"auto_rotate_video_key" : "auto_rotera_video_nyckel"
"prefer_media_type_key" : "prefer_media_type_key_2"
"extension_authors" : "Pengarang"
"extension_authors" : "Autores"
"search_providers_list_key" : "search_providers_list"
"anilist_key" : "anilist_key"
"swipe_vertical_enabled_key" : "swipe_vertical_enabled_key"
"example_password" : "Lambarkasirta123"
"backup_key" : "backup_key"
"extension_authors" : "Authors"
"video_buffer_clear_key" : "video_buffer_clear_key"
"auto_download_plugins_key" : "auto_download_plugins_key2"
"episode_sync_enabled_key" : "episode_sync_enabled_key"
"example_password" : "parol123"
"use_system_brightness_key" : "use_system_brightness_key"
"example_username" : "Username"
"example_password" : "lozinka123"
"example_password" : "Parole123"
"extension_authors" : "Utviklere"
"example_username" : "MittKuleBrukernavn"
"download_path_key" : "download_path_key"
"extension_authors" : "ooooggg"
"show_logcat_key" : "show_logcat_key"
"backup_path_key" : "backup_path_key"
"primary_color_key" : "primary_color_key"
"example_password" : "password123"
"software_decoding_key" : "software_decoding_key2"
"pip_enabled_key" : "pip_enabled_key"
"filter_sub_lang_key" : "filter_sub_lang_key"
"show_hd_key" : "show_hd_key"
"example_password" : "senha123"
"example_password" : "Slaptazodis123"
"pref_filter_search_quality_key" : "pref_filter_search_quality_key"
bac0925df628dce7841a1d4e8d474c2e63fb818b
nZWtL6D4gxleEjTgRsiZreZ8nNC9qRwx6BC0WIWuyNpCzY/YJalfUgLEw4LPgFs0T+snumNuJ4BOD
nbmhoaGhoaMig8M5S0hTgENxxYMk8kg9v+nAPg34ys79CB6GnkDt8Q5KGon97Er8nPxu1LWU8UsbB
n5cgy1k4ASf3A5cAFuJXKKaF9KpBPgDvM7KP4g1oIIGkCMADcBJwb2p8KOMvMPoUaCCBpALgfmBba
nd7qkHRn2vssMU5VdE3xYVka86jITBsDMNuBGM2mjDa9lhqhj7ifnqmsbvLfG5CH0PGDUkNXMvqV4
n+ZGkpzrId6ak3RlpLm1xz5kePn0QOrZ5A3H9GIMf80wHeZ+l7OZo6Qh7HwFWh45t3iCsKEiATkXo
n2olwU2SXZdN1AtzmEfwtI+49oSQRspqj1yT9EUqAMoahx3rYvpW8MLONwFzglxT7WyQ97eOMmX0M
nnEP6ewBXAAflTa7oYJUhwJEetmtGlXCvCL+m3LNYblk7NznmCXnpivcDfARoGWQz+wH3PlZaTRjs
nJ2k5MBi65DXhQ6iwE5b0BHBP6FLXhB3AUWa2u5ImSNKdNMFPcp2Z7YYKaoCkmcDa0CWuCVuBu8zs
e6333b32409e02a4a6eba6fb7ff866bb
nzHYAd4WORoWsA241sxkhgw8jJi6SHgPuC+lQifwMvAu8ZGavhnYmptVM+CLc4RUzgEm42eiehP2E
n4EPbNtXMNgNzgO0pJjfLc54Q9QnnUoOaUIYAPh3VtjxGkQhzM+wXdSDCxzgR/iipbLkIXQNuy2sY
nxtAB6Dkkzc+55W9DaF97Fkkv5BBgPHxbUjgkvZgS+F2SbgztX10o9cGJpAXA1cB03BOr94DlZvZT
N2YzODYwYWQzNGI4ZTZmOTdmN2I5MTA0ZWQzMzEwOGI0MmQ3MTdlMTM0MmM2NGMxMTg5NGE1MjUyYTQ3NjE3Zg==
n78C8qoIPewXwOcK9V1kHzIi2qlRGLEB3LDSVx3KgP3rEWSlxHzAZt8OgljPjEvkcWGJmr4dyoA/A
noCasBeYxdhEKpQwBfJ50pb7yY2abgNmki7C4F0QoQ4DC2slIhFm4VchWLJb0nGeaa3F9QicidEUf
Y29tLmFwcGxpc3RvLmFwcGNsb25lci5jbGFzc2VzLnNlY29uZGFyeQ==
nAP7xsB0qOvNGAL+5kIrOvBGghKD60AgQmEYAONDD9oSiM98ndOlrwNdAPL4fjn7G/UKyedoX+C60
n+AxcP7sT90e4wsx2lRLoVkh6KOeOs1Z8IekeSce3yWOWpL9T0tglaWGb+w/x8OmdyoJXQPCPkDTc
nbz2PpFXK5obQPvYskh5WPqaG9rXnkDRR0q6cAjxZdP59oQNQA84ADshpO6vozBsB4DAP2/2KzrwR
njY7OJr0mLOpwiHpt4BgUi6Q3PCZi8h1SSjpR0vaM9LxEkHSMh69dMRHz7agGfUSIhqhzKG50dHiJ
nCXBIWXMAAC4jAAAuIwF4pT92AAAHk0lEQVR42u2dW6wdUxjHf98pirqURElc6tIihKZOL0rqLiEl
1714d6f2f4f7cc19644384f8c4629910
nJBUhcameExFCkEhow4NEJCIST32oW4TEg3ogbg+NklAaSl1KFG2lNGlJimqU0/P3sGZ0nLNn9qx9
39f470a9f2ec1aa2383269ca831bc7be0e47da48d6d708ccad9bed4e1a60993e
nlwr5ETjezBRsKULS6ZJWAU8xvoIPcBxwGQRaC5I0iNvycX7oSARkPgQQQNKjwHJgQugIBGYiVLwY
uyBLgFD17MgrYmA0gSXoKllMJBelOYj2
nsw0NDQ0NDQ0FUesnYpIOBE4BTsKt2ewLTEyYDCfK0MfeUYzYO8ROjmQsca3o2lrYFJm2AXuAL81s
n6ILXhSq+P2Ae7qsIh4HV0REDDQ314F/QQmVQhaYmuwAAAABJRU5ErkJggg==
nEWYD347Bz/VmtmYM96cSWoCWRCLMJVsE38naNXQ+k30gdExyI+kVj3Z1fpu0Jssdnp1GWxEkHSTp
1e8f8cd198588a544e2063c8d50c29ea6b5a4c7b7d8ee65e96fe4aaf001872e0
nYfAXeebVnyGCJC3JuHeGh1/vFx2nMjvh++m8iTvax9jMPgHOBv5OMXlE0tICyhR86SYXchted46h