App 加固后 PendingIntent 与通知跳转回归指南：可变性、请求码、组件显式性与返回栈校验

#!/usr/bin/env python3
"""扫描源码目录中所有 PendingIntent 创建点，校验 flags 与目标组件显式性。
失败条件：任一创建点缺少 FLAG_IMMUTABLE 或 FLAG_MUTABLE，或未显式设置目标组件。
用法：python3 scan_pi.py <src_dir>"""
import sys, os, re

def find_pi_creations(content):
    """返回找到的 PendingIntent 创建调用的列表，每项为 (line_num, call_type)"""
    pattern = r'PendingIntent\.(getActivity|getBroadcast|getService|getForegroundService)\s*\('
    return [(m.start() + 1, m.group(1)) for m in re.finditer(pattern, content)]

def check_flags(content, start_line, end_line):
    """检查指定行范围内是否调用了 setFlags 并包含 IMMUTABLE 或 MUTABLE"""
    region = content.splitlines()[start_line-1:end_line]
    region_text = '\n'.join(region)
    has_flags = re.search(r'\.setFlags\s*\([^)]*PendingIntent\.FLAG_(IMMUTABLE|MUTABLE)', region_text)
    return bool(has_flags)

def check_explicit_target(content, start_line, end_line):
    """检查同一范围内 Intent 对象是否显式设置 component 或 package"""
    region = content.splitlines()[start_line-1:end_line]
    region_text = '\n'.join(region)
    has_explicit = re.search(r'intent\.(setComponent|setClassName|setPackage)\s*\(', region_text)
    return bool(has_explicit)

def main():
    if len(sys.argv) != 2:
        print("Usage: python3 scan_pi.py <source_directory>")
        sys.exit(2)
    src_dir = sys.argv[1]
    if not os.path.isdir(src_dir):
        print(f"错误：'{src_dir}' 不是有效的目录")
        sys.exit(2)
    has_violation = False
    for root, _, files in os.walk(src_dir):
        for fname in files:
            if not fname.endswith(('.java', '.kt')):
                continue
            path = os.path.join(root, fname)
            with open(path, 'r', encoding='utf-8', errors='ignore') as f:
                content = f.read()
            creations = find_pi_creations(content)
            if not creations:
                continue
            lines = content.splitlines()
            for line_num, call_type in creations:
                window_end = min(line_num + 8, len(lines))
                if not check_flags(content, line_num, window_end):
                    print(f"[高危] {path}:{line_num} {call_type} 缺少 FLAG_IMMUTABLE 或 FLAG_MUTABLE")
                    has_violation = True
                if not check_explicit_target(content, line_num, window_end):
                    print(f"[警告] {path}:{line_num} {call_type} Intent 未显式设置目标组件")
                    has_violation = True
    if has_violation:
        print("\n回归未通过：存在不满足加固后 PendingIntent 安全要求的创建点。")
        sys.exit(1)
    else:
        print("扫描完成：所有 PendingIntent 创建点均通过回归校验。")
        sys.exit(0)

if __name__ == '__main__':
    main()