Skip to content

Commit e0729e8

Browse files
abrignoniclaude
abrignoni
and
claude
committed
chore: vendor blackboxprotobuf and bump protobuf to 5.29.6
The PyPI blackboxprotobuf pins protobuf==3.10.0, which carries three high-severity CVEs (CVE-2022-1941, CVE-2025-4565, CVE-2026-0994). Vendor the 1.0.1 decoder into scripts/blackboxprotobuf (matching ALEAPP), repoint the 35 artifact imports to 'from scripts import blackboxprotobuf', drop the PyPI dep, and pin protobuf==5.29.6. iLEAPP has no generated _pb2 bindings, so no regeneration was needed. Adds check_runtime_dependencies() called from ileapp.py and ileappGUI.py to warn if protobuf/Pillow drift. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 parent 2b31e94 commit e0729e8

49 files changed

Lines changed: 3522 additions & 2689 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎ileapp.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from scripts.search_files import *
2020
from scripts.ilapfuncs import *
2121
from leapp_functions.app.output import validate_output_folder_available
22-
from scripts.version_info import leapp_name, leapp_version
22+
from scripts.version_info import leapp_name, leapp_version, check_runtime_dependencies
2323
from time import process_time, gmtime, strftime, perf_counter
2424
from scripts.lavafuncs import *
2525
from scripts.context import Context
@@ -169,6 +169,7 @@ def create_casedata(path):
169169
return
170170

171171
def main():
172+
check_runtime_dependencies()
172173
parser = argparse.ArgumentParser(description=f'iLEAPP v{leapp_version}: iOS Logs, Events, And Plists Parser.')
173174
parser.add_argument('-t', choices=['fs', 'tar', 'zip', 'gz', 'itunes', 'file'], required=False, action="store",
174175
help=("Specify the input type. "

‎ileappGUI.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
from PIL import Image, ImageTk
1414
from tkinter import ttk, filedialog as tk_filedialog, messagebox as tk_msgbox
15-
from scripts.version_info import leapp_name, leapp_version
15+
from scripts.version_info import leapp_name, leapp_version, check_runtime_dependencies
1616
from scripts.search_files import *
1717
from scripts.ilapfuncs import *
1818
from scripts.tz_offset import tzvalues
@@ -790,6 +790,8 @@ def close_case_window():
790790
case_window.grab_set()
791791

792792

793+
check_runtime_dependencies()
794+
793795
## Main window creation
794796
main_window = tk.Tk()
795797
icon = resource_path('icon.png')

‎requirements.txt‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ astc_decomp_faster
22
pytypedstream
33
bencoding
44
biplist
5-
blackboxprotobuf
65
bs4
76
ijson
87
mmh3
@@ -18,6 +17,10 @@ PGPy
1817
standard-imghdr; python_version >= "3.13" # PGPy imports stdlib imghdr, removed in Python 3.13 (PEP 594)
1918
pillow
2019
pillow_heif
20+
# protobuf is required by the vendored scripts/blackboxprotobuf. Do NOT add the
21+
# PyPI 'blackboxprotobuf' back: it pins protobuf==3.10.0, reintroducing patched
22+
# CVEs. 5.29.6 is the minimum that clears CVE-2022-1941/2025-4565/2026-0994.
23+
protobuf==5.29.6
2124
pycryptodome
2225
pyinstaller
2326

‎scripts/artifacts/appleMapsApplication.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
}
3232

3333

34-
import blackboxprotobuf
34+
from scripts import blackboxprotobuf
3535
from scripts.ilapfuncs import artifact_processor, get_file_path, get_plist_file_content
3636

3737
@artifact_processor

‎scripts/artifacts/appleMapsGroup.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
}
3232
}
3333

34-
import blackboxprotobuf
34+
from scripts import blackboxprotobuf
3535
from scripts.ilapfuncs import artifact_processor, get_file_path, get_plist_file_content
3636

3737
@artifact_processor

‎scripts/artifacts/appleMapsSearchHistory.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
}
2222
}
2323

24-
import blackboxprotobuf
24+
from scripts import blackboxprotobuf
2525
import base64
2626
import binascii
2727
import pprint

‎scripts/artifacts/biomeAirpMode.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
}
2828

2929
import os
30-
import blackboxprotobuf
30+
from scripts import blackboxprotobuf
3131
from datetime import timezone
3232
from scripts.ccl_segb.ccl_segb import read_segb_file
3333
from scripts.ccl_segb.ccl_segb_common import EntryState

‎scripts/artifacts/biomeAppWebUsage.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727

2828
import os
2929
from datetime import timezone
30-
import blackboxprotobuf
30+
from scripts import blackboxprotobuf
3131
from scripts.ccl_segb.ccl_segb import read_segb_file
3232
from scripts.ccl_segb.ccl_segb_common import EntryState
3333
from scripts.ilapfuncs import artifact_processor, webkit_timestampsconv

‎scripts/artifacts/biomeAppinstall.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
import os
3131
import struct
3232
from datetime import timezone
33-
import blackboxprotobuf
33+
from scripts import blackboxprotobuf
3434
from google.protobuf.message import DecodeError
3535
from scripts.ccl_segb.ccl_segb import read_segb_file
3636
from scripts.ccl_segb.ccl_segb_common import EntryState

‎scripts/artifacts/biomeBacklight.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323

2424
import os
2525
from datetime import timezone
26-
import blackboxprotobuf
26+
from scripts import blackboxprotobuf
2727
from scripts.ccl_segb.ccl_segb import read_segb_file
2828
from scripts.ccl_segb.ccl_segb_common import EntryState
2929
from scripts.ilapfuncs import artifact_processor, webkit_timestampsconv

0 commit comments

Comments
 (0)