Member-only story
Android Security: mobsfscan
Not a medium member? “Read for free”
One way to help ensure we write secure apps is to use static analysis tools to find insecure code patterns in our source code. What better tool to do this than the free and open-source mobsfscan?
mobsfscan is based on the Mobile Security Framework (MobSF) rules and supports Java, Kotlin, Swift, and Objective-C code. The Python-based tools’ rules use semgrep and libsast pattern matchers.
Enabling mobsfscan
As shown in the documentation, there are many different ways of running mobsfscan, such as installing locally with pip, running in CI/CD, or using a Docker image.
For our purposes, I will talk about setting up using GitHub Actions, as we can add the results directly to the Security tab inside GitHub.
To use GitHub’s security tab, we need the output from mobsfscan to be in the Static Analysis Results Interchange Format (SARIF). We then upload the results using the github/codeql-action/upload-sarif action. You might notice that the upload-sarif action is part of CodeQL, a semantic code analysis engine that looks for vulnerabilities, which I will write…
