Severe vulnerability

[cyb3r-s3npai]

Hey guys!

I found your project yesterday and made little test. It looks like it have some severe vulnerabilities in some of the asset files.

Here to report them before it become a major thread..

Zerion-2.0.7/zerion-android/src/androidTestOfficial/assets/lottapixel.jpg
Virus type: Trojan
Name : Ceevee
Alert level: : Severe
Status : Active

Also one of the hash didn't matched when I load the gradle for first time with POM file but I forget to save that log. Please make sure to check that as well.

[zerionproject]

Hey, thanks for the heads up.

That file isn't malware, it's a test image. lottapixel.jpg is a tiny (~4.8 KB) jpeg that claims to be 64250x64250 pixels in its header, which makes it a decompression bomb. We keep it around so the tests can check that the app doesn't fall over or eat gigabytes of RAM when it gets a crafted image like that. The test is AttachmentRetrieverIntegrationTest.testLottaPixels() and it just confirms we shrink it down to a safe thumbnail.

A few things worth knowing:

• It lives under src/androidTestOfficial/assets/, so it's only used by the instrumentation tests. It's never packaged into the release apk, so it never lands on anyone's phone.
• We didn't add it ourselves. It comes straight from Briar, which Zerion is a fork of: briar-android/src/androidTestOfficial/assets/lottapixel.jpg, same file, same test.
• The "Trojan Ceevee" hit is just an AV engine getting spooked by a weird image. There's no code in it.

On the gradle hash thing, I can't really chase it without the log. We have dependency verification switched on (checksums and signatures), so a genuinely tampered dependency would break the build. If you can reproduce it, grab the artifact name and the hash it complained about and I'll take a look.

Cheers