Static Analysis Pipeline breaks entirely on APK files if they contain files named .dex, which aren't dex files.

[Alexeyan]

ENVIRONMENT

OS and Version: Ubuntu 20.04.2 LTS.  Linux 5.4.0
Python Version: 3.8.10
MobSF Version: 3.5  (Latest Docker Container) 

If an apk file contains a zip entry with a name that ends in .dex, but isn't actually a dex file, the analysis of the entire apk fails.
I'm getting the following error message in mobf:

Raised when run() is called with check=True and the process returns a non-zero exit status. Attributes: cmd, returncode, stdout, stderr, output

Command '['/jdk-16.0.1/bin/java', '-jar', '/home/mobsf/Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/tools/baksmali-2.5.2.jar', 'list', 'classes', '/home/mobsf/.MobSF/uploads/[REDACTED]/not-actually-classes.dex']' returned non-zero exit status 1.

and the following is the output from baksmali:

Exception in thread "main" org.jf.dexlib2.DexFileFactory$UnsupportedFileTypeException: /home/mobsf/.MobSF/uploads/[redacted]/not-actually-classes.dex is not an apk, dex, odex or oat file.
        at org.jf.dexlib2.DexFileFactory.loadDexContainer(DexFileFactory.java:282)
        at org.jf.baksmali.DexInputCommand.loadDexFile(DexInputCommand.java:153)
        at org.jf.baksmali.ListClassesCommand.run(ListClassesCommand.java:71)
        at org.jf.baksmali.ListCommand.run(ListCommand.java:83)
        at org.jf.baksmali.Main.main(Main.java:102)

Can you encapsulate this in a try-catch block or something so it just skips the dex file analysis on zip entries with .dex filename extension that aren't actually .dex files?

STEPS TO REPRODUCE THE ISSUE

1. Take any APK file, add a file with random content and name it something.dex into the archive
2. Analyze the APK file in MobSF static analyzer
3. Receive the Error message

[github-actions]

👋 @Alexeyan
Issues is only for reporting a bug/feature request. For limited support, questions, and discussions, please join MobSF Slack channel
Please include all the requested and relevant information when opening a bug report. Improper reports will be closed without any response.

[superpoussin22]

you should report this issue to the baksmali project :https://github.com/JesusFreke/smali

[ajinabraham]

I think this is something we can fix here

Mobile-Security-Framework-MobSF/mobsf/StaticAnalyzer/views/android/converter.py

Line 36 in 2906854

for dex_path in dexes:

@superpoussin22

[Alexeyan]

@superpoussin22 the issue doesn't lie with baksmali here. The issue is that MobSF is sending non-dex files to baksmali. Matching on the file extension doesn't guarantee that it's in actual fact a dex file and I think MobSF should either verify that a file with .dex extension is actually a dex file, or encapsulate the entire baksmali invocation into a try-catch block.