Feature Suggestion: To be able to look into Android Manifest about mariana-trench

[Securee]

Hi @yuhshin-oss what does the feature "via-caller-exported" mean ? I used the mariana-trench to analyze my apk, and the mariana-trench find many issues, but most of the issues did not filter the soures which conponents（Activity，Provider）are not exported writed in manifest.xml（Android:Exported = False）.
How can I filter the False positive issues ?
（I used the default rules to analyze my apk）

[yuhshin-oss]

Hi @chuayupeng, thanks for the feature request!

Mariana Trench today internally looks at the manifest to determine some class properties. It is used to add features to the flows (e.g. "via-caller-exported", "via-caller-unexported", etc.). You can find the list of features here:

https://github.com/facebook/mariana-trench/blob/main/source/ClassProperties.cpp#L305-L330

Does this contain what you are looking for?

[chuayupeng]

Hi @yuhshin-oss, I was thinking of allowing us to write in analysis for Deeplinks and point out simple vulns like allowBackup etc, but that is a great feature that i didnt notice was in previously! Will look at it again, thanks!