Add APK upload/install endpoints

[mahbd]

PR Type

Feature

PR Checklist

• Tests for the changes have been added / updated.
• Documentation comments have been added / updated.
• A changelog entry has been made.
• Version number has been updated.
• Required modules have been added to respective "requirements*.txt" files.
• Relevant Test Cases added to this description (below).
• (Team) Label with affected action categories and semver status.

Overview

Node now able to receive request to upload android apk file. It also can install uploaded APK file.

In general, to fix uncontrolled command-line issues you should avoid shell=True with untrusted input and instead pass arguments as a list to subprocess.run so they are not interpreted by a shell. If shell usage is unavoidable, you must strictly validate or allowlist user input before including it in the command.

For this file, the safest change without altering functionality is:

1. Refactor run_adb_command to accept the command as a list of arguments and invoke subprocess.run with shell=False.
2. Update all callers (shown snippet: get_devices and capture_ui_dump) to pass argument lists instead of format-assembled strings.
3. In particular, build the optional -s <serial> portion as separate list elements, not interpolated into a shell string.

Concretely:

• In run_adb_command (around lines 107–121):

  • Change the command parameter to be a sequence of arguments (we can keep the name but adjust usage).
  • Change the subprocess.run call to subprocess.run(command, shell=False, ...).

• In get_devices (around line 48):

  • Replace devices_output = run_adb_command(f"{ADB_PATH} devices -l") by devices_output = run_adb_command([ADB_PATH, "devices", "-l"]).

• In capture_ui_dump (around lines 123–128):

  • Replace construction of device_flag as a string and the .strip()-based assembly with list concatenation, e.g.:

  cmd = [ADB_PATH]
  if device_serial:
      cmd.extend(["-s", device_serial])
  cmd.extend(["shell", "uiautomator", "dump", "/sdcard/ui.xml"])
  out = run_adb_command(cmd)

No new imports are required; we only adjust how subprocess.run is invoked and how commands are constructed.

In general, to fix uncontrolled path usage, normalize the path, enforce that it stays within an expected base directory, and/or restrict names to a safe subset. Here, the safest and simplest fix without changing functionality is: (1) derive an absolute, normalized path from ZEUZ_NODE_DOWNLOADS_DIR/apk and the provided filename; (2) reject any request where the resolved path is not within that directory; and (3) optionally disallow path separators in filename so only simple filenames are accepted. This preserves the existing behavior for valid names in the apk directory while preventing traversal or absolute paths.

Concretely in server/mobile.py, update handle_apk_install:

• Compute base_dir = os.path.abspath(os.path.join(ZEUZ_NODE_DOWNLOADS_DIR, "apk")).
• Normalize the user-supplied filename and construct file_path = os.path.abspath(os.path.join(base_dir, filename)).
• Check file_path.startswith(base_dir + os.sep) (or equality if ever equal to base), and if not, return an error like {"message": "Invalid filename"}.
• Optionally, before path computations, enforce that filename does not contain path separators ('/' or os.sep) and is non-empty.
• Keep the rest of the logic (existence check, get_package_name, subprocess.run) unchanged.

No new external libraries are needed; os.path utilities already imported via import os are sufficient.

In general, to fix this kind of issue you should avoid including raw exception text or stack traces in responses sent back to clients. Instead, log the full error details on the server (to logs or monitoring systems) and return a generic, user-friendly error message that does not reveal internal implementation details.

For this specific case in server/mobile.py, the best fix is:

• In handle_apk_install, modify the except Exception as e: block so that:
  • It logs the error details using CommonUtil.ExecLog (already used elsewhere in this file) including str(e) and any helpful context such as filename and serial.
  • It returns a response with a generic error message, e.g. "Failed to install APK.", without embedding str(e).

This change only affects the error path and does not alter the success path or the API shape (the JSON keys can remain "message", "filename", and "package_name"). No new imports are required; we reuse CommonUtil.ExecLog, which is already imported and used in upload_android_ui_dump.

Concretely:

• Edit the except block around lines 248–249 to:
  • Call CommonUtil.ExecLog("", f"Error installing APK '{filename}' on device '{serial}': {str(e)}", iLogLevel=3).
  • Return {"message": "Failed to install APK.", "filename": filename, "package_name": package_name}.