App 加固后导出组件怎样回归：给四类组件建立允许与拒绝矩阵

import json
import sys
import xml.etree.ElementTree as ET
from pathlib import Path

ANDROID = '{http://schemas.android.com/apk/res/android}'
TYPES = {'activity', 'activity-alias', 'service', 'receiver', 'provider'}
REQUIRED_OUTCOMES = {'allow', 'deny-permission', 'deny-malformed'}
FORBIDDEN_FIELDS = {'token', 'password', 'privateKey', 'userData'}

def stop(message):
    raise SystemExit(message)

def component_name(element):
    return str(element.get(ANDROID + 'name', '')).strip()

def exported_components(manifest_path):
    root = ET.parse(manifest_path).getroot()
    application = root.find('application')
    if application is None:
        stop('manifest has no application element')
    result = {}
    for element in application:
        if element.tag not in TYPES:
            continue
        exported = element.get(ANDROID + 'exported')
        if exported is None:
            stop(f'{element.tag} has no explicit exported value')
        if exported != 'true':
            continue
        name = component_name(element)
        if not name:
            stop(f'{element.tag} has no component name')
        if name in result:
            stop(f'duplicate exported component: {name}')
        result[name] = {
            'type': element.tag,
            'permission': str(element.get(ANDROID + 'permission', '')).strip(),
        }
    return result

def load_plan(plan_path):
    data = json.loads(plan_path.read_text(encoding='utf-8'))
    tests = data.get('tests') if isinstance(data, dict) else None
    if not isinstance(tests, list) or not tests:
        stop('test plan has no tests')
    return tests

if len(sys.argv) != 3:
    stop('usage: check_exported_matrix.py AndroidManifest.xml tests.json')
manifest_path = Path(sys.argv[1])
plan_path = Path(sys.argv[2])
if not manifest_path.is_file() or not plan_path.is_file():
    raise SystemExit('manifest or test plan is missing')
components = exported_components(manifest_path)
tests = load_plan(plan_path)
coverage = {name: set() for name in components}
for index, test in enumerate(tests):
    if not isinstance(test, dict):
        stop(f'test {index} is not an object')
    if FORBIDDEN_FIELDS.intersection(test):
        stop(f'test {index} contains forbidden fields')
    component = str(test.get('component', '')).strip()
    outcome = str(test.get('expected', '')).strip()
    if component not in components:
        stop(f'test {index} references unknown component')
    if outcome not in REQUIRED_OUTCOMES:
        stop(f'test {index} has invalid expected outcome')
    expected_permission = str(test.get('componentPermission', '')).strip()
    if expected_permission != components[component]['permission']:
        stop(f'test {index} permission differs from manifest')
    if outcome == 'deny-malformed' and test.get('inputValidation') is not True:
        stop(f'test {index} lacks input validation evidence')
    coverage[component].add(outcome)
missing = {name: sorted(REQUIRED_OUTCOMES - outcomes) for name, outcomes in coverage.items() if outcomes != REQUIRED_OUTCOMES}
if missing:
    raise SystemExit(f'exported components lack test outcomes: {missing}')
print(json.dumps({'components': len(components), 'tests': len(tests), 'status': 'pass'}))