burpsuitepro-cn

maintainer wordsworth · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads the official Burp Suite Pro JAR from portswigger.net and a third-party Chinese translation/loader from GitHub; both are used as data or libraries without remote code execution, and the worst case of a swapped source is limited to tampering with the translation or loader, not arbitrary code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official Burp Suite Pro JAR from portswigger.net and a third-party Chinese translation/loader from GitHub; both are used as data or libraries without remote code execution, and the worst case of a swapped source is limited to tampering with the translation or loader, not arbitrary code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("${_up_pkg}-${pkgver}-orig.jar::https://portswigger.net/burp/releases/download?product=pro&version=${pkgver}&type=Jar"

PKGBUILD

1 offending line(s) highlighted

      1pkgname=burpsuitepro-cn
    
      2pkgver=2025.11
    
      3pkgrel=3
    
      4pkgdesc='Burp Suite Professional bundled with BurpSuiteCN loader/translation for a single localized launcher'
    
      5url='https://portswigger.net/burp/'
    
      6arch=('any')
    
      7depends=('java-runtime=21' 'bash' 'hicolor-icon-theme')
    
      8makedepends=('zip')
    
      9license=('custom' 'Apache-2.0')
    
      10provides=('burpsuite-pro')
    
      11conflicts=('burpsuite-pro')
    
      12_up_pkg=burpsuite-pro
    
      13_cnver=4.11.22
    
      14noextract=("${_up_pkg}-${pkgver}-orig.jar")
    
      15source=("${_up_pkg}-${pkgver}-orig.jar::https://portswigger.net/burp/releases/download?product=pro&version=${pkgver}&type=Jar"
    
      16        "${_up_pkg}"
    
      17        "${_up_pkg}.desktop"
    
      18        'icon16.png'
    
      19        'icon24.png'
    
      20        'icon32.png'
    
      21        'icon48.png'
    
      22        'icon128.png'
    
      23        'icon256.png'
    
      24        'icon512.png'
    
      25        'icon.svg'
    
      26        'cn-Logger++.txt'
    
      27        'cn-PentagridScanController.txt'
    
      28        'cn-Reshaper.txt'
    
      29        "burpsuitloader-${_cnver}-all.jar::https://github.com/Leon406/BurpSuiteCN-Release/releases/download/v${_cnver}/burpsuitloader-${_cnver}-all.jar"
    
      30        'BurpSuiteCN.LICENSE')
    
      31sha256sums=('fcbb9d6181139d44fb627ab0dc73bcdb685d314a33de6ad33da7bb64ef123321'
    
      32            '18b8179589f4f6af32d7383f0f2f022dac9e74f02dd608597c9ce5d097289b09'
    
      33            'f442258c5616969bfaad7c20b2ff99f05696ad04c2e2c3d145a360615650b9ec'
    
      34            'ff0b230af06fb76af053090ac021bf45b88341d746e67f6bb9e94ba40957d9d8'
    
      35            'a6791fcaee558f6744b4f5a3fc0af2c9ad7ce244033e224c4e4464563ac9b911'
    
      36            '48d529f2a045b1179d9cd87ffdeb7fd469d963f7606fd22b7edc665d0515e1d2'
    
      37            '2b2407b8ab2ee181bfd64e3ba3e3090a328cbef8f53cce20ba76cffbfb3bc1d1'
    
      38            '28d17763c17e010936ad8ed44427d9ce6523510f580aefce52eb7c0f26b48045'
    
      39            'da6469f32b0acfcad2057cf0920c128bbbf64bc72ec6a4d5e5ba10d5b8a2d859'
    
      40            '6bbfd022aa451efeb439a89527b814ae06f7ce6196f7ad8db276e9ad372a7e32'
    
      41            '8777077ed5b1809c8adde4c056a315f8ec8f1b79f4c4c0e60eb3582c4d7ab71d'
    
      42            '6dffd89f3c92605a09d4494bc23245830ba20ec96db173e273e78f4fd86f85b2'
    
      43            'ccf9d6ec55d42be4de6165b6bbc61ab2351389c41b7906246f518a7dae1506b8'
    
      44            'e84e75f16163c6d18e1405f83fa4aafe0ef4a1bbc3d7f69813993673d383b662'
    
      45            '650a4e48e2788747c56899b0e6e8e17bc3b75d2ec91f03fd7cc373a489a20b5d'
    
      46            'c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4')
    
      47
    
      48prepare() {
    
      49  cp "${srcdir}/${_up_pkg}-${pkgver}-orig.jar" "${srcdir}/${_up_pkg}-${pkgver}.jar"
    
      50  # remove useless chromium versions
    
      51  zip -d "${srcdir}/${_up_pkg}-${pkgver}.jar" 'chromium-macosx*.zip' 'chromium-win*.zip'
    
      52}
    
      53
    
      54package() {
    
      55  local sharedir="${pkgdir}/usr/share/${_up_pkg}"
    
      56
    
      57  install -Dm644 "${srcdir}/${_up_pkg}-${pkgver}.jar" "${sharedir}/${_up_pkg}.jar"
    
      58  install -Dm644 "${srcdir}/${_up_pkg}.desktop" -t "${pkgdir}/usr/share/applications/"
    
      59  install -Dm755 "${srcdir}/${_up_pkg}" "${pkgdir}/usr/bin/${_up_pkg}"
    
      60  ln -sf "../${_up_pkg}" "${pkgdir}/usr/bin/${pkgname}"
    
      61
    
      62  install -Dm644 "${srcdir}/burpsuitloader-${_cnver}-all.jar" "${sharedir}/${_up_pkg}-cn-loader.jar"
    
      63  install -Dm644 "${srcdir}/cn-Logger++.txt" "${sharedir}/cn/cn-Logger++.txt"
    
      64  install -Dm644 "${srcdir}/cn-PentagridScanController.txt" "${sharedir}/cn/cn-PentagridScanController.txt"
    
      65  install -Dm644 "${srcdir}/cn-Reshaper.txt" "${sharedir}/cn/cn-Reshaper.txt"
    
      66
    
      67  # install icons
    
      68  for size in 16 24 32 48 128 256 512; do
    
      69    install -Dm644 "${srcdir}/icon${size}.png" "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/burpsuite-pro.png"
    
      70  done
    
      71  install -Dm644 "${srcdir}/icon.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/burpsuite-pro.svg"
    
      72
    
      73  install -Dm644 "${srcdir}/BurpSuiteCN.LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/BurpSuiteCN.LICENSE"
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2