blacktop
c20f9af712
fix: multiple security vulnerabilities (SSRF, path traversal)
...
- Remove POST /diff/files endpoint that allowed arbitrary host file reads
(CWE-22); clients must now read files locally and POST content to
/diff/blobs instead
- Add validatePublicURL() to /info remote endpoints, rejecting URLs that
resolve to loopback, private, link-local, or multicast addresses to
prevent SSRF; also remove attacker-controlled proxy/insecure params
- Add SanitizeArchivePath() helper that verifies extracted archive entry
paths stay within the destination directory (zip-slip / tar-slip,
CWE-22); replace bare filepath.Join(dest, filepath.Clean(name)) calls
in SearchZip, OTA parser, AA payload extractor, and ota_extract
- Fix server listen address to use net.JoinHostPort to respect Host config
2026-04-11 14:37:41 -06:00
blacktop
8e6f2c554b
chore: modernize to 1.26
...
Refactor string concatenation to use strings.Builder for improved performance in multiple files
2026-02-12 10:02:01 -07:00
Maksym and GitHub
e56a63c7a9
feat: add --dec-retries and --dec-retry-backoff arguments to enable retries when encountering issues with calling LLM APIs ( #706 )
2025-05-18 10:34:27 -06:00
blacktop
6cca9a980d
refactor: replace interface{} with any and simplify loop constructs
2025-03-26 22:53:29 -06:00
blacktop
6d0e742a5c
fix: ipsw diff new/removed MachO bug + a unit test 👀 well, would ya look at that
2024-08-20 15:32:37 -06:00
blacktop
dfe5565a3b
fix: symbol server database code
2024-07-02 20:44:21 -06:00
blacktop
3c5e3b02a5
feat: add ability to partial-partialzip AEA1 private-key .pem files from remote/local IPSWs
2024-06-11 12:42:44 -06:00
blacktop
719d64682e
chore: rm deprecated rand.Seed from utils.go
2024-06-03 08:26:21 -06:00
blacktop
a4e7cbe7f8
chore(deps): bump mpb to v8
2024-06-01 12:49:43 -06:00
blacktop
a09f62f281
feat: add 🆕 --decrypt flag to ipsw dl ipsw to attempt to lookup and use keys for --pattern files
2024-04-20 20:15:50 -06:00
blacktop
726b5a926c
feat: add ability to extract SPTM firmware via ipsw extract --sptm
2023-06-08 21:58:28 -06:00
blacktop and GitHub
f85daa1ac3
feat: ipsw daemon (API) ( #219 )
2023-04-12 20:00:05 -06:00
blacktop
c62e15be2c
feat: add TOC to ipsw diff markdown output
2023-03-28 17:45:55 -06:00
blacktop
790e6f50a9
fix: utils.Retry function
2023-03-27 21:35:02 -06:00
blacktop
b4cf850de0
fix: ipsw kernel kmutil --filter cmd to walk dependency graph to accurately remove bundles and bundles with a dependency path to them
2023-03-03 18:42:28 -07:00
blacktop
fc21823a4d
feat: 🆕 --delta flag for ipsw dyld info --dylibs cmd to output dylib version diff deltas
2023-03-01 00:31:33 -07:00
blacktop
560d2ae0b5
feat: add more assetAudienceIDs to ipsw download ota cmd to dl latest Studio Display beta OTA
2023-02-17 22:03:11 -07:00
blacktop
47ac282f48
fix: many small issues w/ auto-folder name creation #184
2023-02-17 11:17:26 -07:00
blacktop
997608e030
fix: issue when regex matches directories when unzipping
2023-01-29 17:29:03 -07:00
blacktop
3f669ceb1e
feat: add --remote and --decrypt flags to ipsw pongo cmd to also extract and decrypt im4p files from local or remote IPSW/OTA
2023-01-27 19:52:41 -07:00
blacktop
e6d217581f
fix: many improvements to mounting DMGs on darwin to check if already extracted from IPSW and already mounted
2023-01-25 12:57:06 -07:00
blacktop
c55e26e9ea
feat: 🆕 ipsw macho search cmd
2023-01-22 23:09:33 -07:00
blacktop
303dce7911
feat: 🆕 ipsw download ipa cmd to download app from the iOS AppStore
2022-12-23 02:18:20 -07:00
blacktop
43e346eef0
fix: issue where ipsw download ota was filtering out device's w/ multi models
2022-11-18 17:40:21 -07:00
blacktop
e9d54eb7e3
feat: ipsw download ota --pattern add ability to pull remote files out of OTA's zip and then check the payloads if not found @nikias
2022-09-26 11:37:39 -06:00
blacktop
1f6eb3b141
feat: add ability to download DSC from remote IPSWs
2022-09-25 21:49:09 -06:00
blacktop
a0bc17f6d7
chore: remove DEPRECATED pkg ioutil
2022-08-11 16:27:04 -06:00
blacktop
952e432c18
feat: add 🆕 ipsw img4 kbag cmd to extract kbags from im4p files
2022-07-01 23:23:02 +10:00
blacktop
52a4978e1d
fix: standardize extract cmd output paths and make preserving src dir paths default
2022-06-30 20:37:58 +10:00
blacktop
290caed18c
fix: ipsw download dev cmd after Apple changed the html #104
2022-05-04 21:39:10 -06:00
blacktop
fb80e81042
fix: ipsw download macos cmd
2022-03-16 22:58:44 -06:00
blacktop
e901abbdb5
feat: add --pattern to ipsw extract --remote cmd
2022-03-06 13:23:37 -07:00
blacktop
0523b7e8e5
chore: switch to faster gzip
2022-03-01 21:49:37 -07:00
blacktop
0ce1f67976
fix: some CodeQL issues
2022-02-18 14:13:42 -07:00
blacktop
294e9f6751
feat: add ability to pull all shared_cache arches via dyld extract cmds
2022-02-01 22:25:38 -07:00
blacktop
ae82125f73
feat: dyld symaddr cmd can now take a JSON sym lookup file as input
2022-01-16 00:05:07 -07:00
blacktop and GitHub
adaa563f50
Feature: Upgrade to 🆕 ARMv9 disassembler ( #65 )
2021-12-26 23:36:32 -07:00
blacktop
6156f64bd2
fix: extract cmd folder dest to be the same for all items
2021-10-27 16:40:20 -06:00
blacktop
82eeb660ae
fix: extract filesystem DMG to ipsw style folder like other items
2021-10-26 23:30:45 -06:00
blacktop
dd93a0f8bd
feat: 🆕 update cmd
2021-06-25 01:47:06 -06:00
blacktop
bae065b76f
chore: small fixes and cleanup
2021-03-11 23:31:36 -05:00
blacktop
82ce0d10f3
feat: add [WIP] dyld xref cmd
2021-03-06 09:57:08 -05:00
blacktop
829cec51c5
feat: many dyld disass improvements/refactors
2021-03-01 00:49:11 -05:00
blacktop
b590747211
chore: small reorg
2021-01-11 15:05:29 -05:00
blacktop
0973525716
chore: cleanup
2020-12-17 09:11:00 -05:00
blacktop
fb2983b0fc
feat: add img3 pkg
2020-09-25 15:00:31 -04:00
blacktop
775b3707b3
feat: add 🆕 iboot cmd
2020-04-12 14:20:12 -04:00
blacktop
53b95f2988
feat: add dyld_cache_patch_info
2020-02-19 21:18:41 -05:00
blacktop
95faba5d27
chore: reorg
2020-01-24 18:36:34 -05:00
blacktop
MaksymandGitHub