@capgo/capacitor-updater 8.51.25 → 8.52.0

package/ios/Sources/CapacitorUpdaterPlugin/ZipArchiveReader.swift

@@ -0,0 +1,247 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+import Compression
+import Foundation
+
+enum ZipError: Error, Equatable {
+    case unreadableArchive
+    case missingEndOfCentralDirectory
+    case invalidCentralDirectory
+    case invalidLocalFileHeader
+    case truncatedEntryData
+    case corruptedEntryData
+    case encryptedEntry
+    case unsupportedCompressionMethod(UInt16)
+    case invalidBufferSize
+    case entryTooLarge
+}
+
+enum ZipEntryType {
+    case file
+    case directory
+    case symlink
+}
+
+struct ZipEntry {
+    let path: String
+    let type: ZipEntryType
+    let generalPurposeFlags: UInt16
+    let compressionMethod: UInt16
+    let compressedSize: UInt64
+    let uncompressedSize: UInt64
+    let localHeaderOffset: UInt64
+
+    var isEncrypted: Bool {
+        return generalPurposeFlags & 0x0001 != 0
+    }
+}
+
+/// Small read-only ZIP reader used to extract downloaded bundles.
+///
+/// Supports stored (0) and deflate (8) entries, ZIP64 archives, and streams entry contents in
+/// `bufferSize` chunks so large files are never fully loaded in memory. Encrypted entries and other
+/// compression methods are rejected. Every offset and size read from the archive is bounds-checked, so a
+/// corrupt archive throws instead of crashing.
+///
+/// This reader does not validate entry paths. Callers must resolve `ZipEntry.path` against the destination
+/// directory (see `CapgoUpdater.resolvePathInsideDirectory`) before writing anything.
+final class ZipArchiveReader {
+    static let compressionMethodStored: UInt16 = 0
+    static let compressionMethodDeflate: UInt16 = 8
+    private static let localFileHeaderSignature: UInt32 = 0x0403_4b50
+    private static let localFileHeaderSize = 30
+
+    let entries: [ZipEntry]
+    private let fileHandle: FileHandle
+    private let fileSize: UInt64
+
+    init(url: URL) throws {
+        let handle: FileHandle
+        do {
+            handle = try FileHandle(forReadingFrom: url)
+        } catch {
+            throw ZipError.unreadableArchive
+        }
+        do {
+            let size = try handle.seekToEnd()
+            self.fileHandle = handle
+            self.fileSize = size
+            self.entries = try ZipCentralDirectory.readEntries(handle: handle, fileSize: size)
+        } catch {
+            try? handle.close()
+            throw error
+        }
+    }
+
+    deinit {
+        try? fileHandle.close()
+    }
+
+    /// Streams the uncompressed contents of `entry` to `consumer` in chunks of at most `bufferSize` bytes.
+    /// Directory entries produce no data.
+    func extract(_ entry: ZipEntry, bufferSize: Int, consumer: (Data) throws -> Void) throws {
+        guard bufferSize > 0 else {
+            throw ZipError.invalidBufferSize
+        }
+        if entry.type == .directory {
+            return
+        }
+        if entry.isEncrypted {
+            throw ZipError.encryptedEntry
+        }
+
+        let header = try ZipBytes.readChunk(handle: fileHandle, fileSize: fileSize, at: entry.localHeaderOffset, count: Self.localFileHeaderSize)
+        guard ZipBytes.uint32(header, 0) == Self.localFileHeaderSignature else {
+            throw ZipError.invalidLocalFileHeader
+        }
+        let localFlags = ZipBytes.uint16(header, 6)
+        let localMethod = ZipBytes.uint16(header, 8)
+        let nameLength = UInt64(ZipBytes.uint16(header, 26))
+        let extraLength = UInt64(ZipBytes.uint16(header, 28))
+        if localFlags & 0x0001 != 0 {
+            throw ZipError.encryptedEntry
+        }
+
+        let headerLength = UInt64(Self.localFileHeaderSize) + nameLength + extraLength
+        let (dataOffset, overflow) = entry.localHeaderOffset.addingReportingOverflow(headerLength)
+        guard !overflow, dataOffset <= fileSize else {
+            throw ZipError.invalidLocalFileHeader
+        }
+
+        // Like the previous ZIPFoundation-based extraction, the local header decides the compression method
+        // while sizes come from the central directory.
+        switch localMethod {
+        case Self.compressionMethodStored:
+            // A stored entry's payload is its content; a size mismatch would read past it into the next records.
+            guard entry.compressedSize == entry.uncompressedSize else {
+                throw ZipError.corruptedEntryData
+            }
+            try readStored(from: dataOffset, size: entry.uncompressedSize, bufferSize: bufferSize, consumer: consumer)
+        case Self.compressionMethodDeflate:
+            if entry.compressedSize == 0 && entry.uncompressedSize == 0 {
+                // Some writers store empty files as deflate with no payload at all.
+                return
+            }
+            try readDeflated(
+                from: dataOffset,
+                compressedSize: entry.compressedSize,
+                expectedSize: entry.uncompressedSize,
+                bufferSize: bufferSize,
+                consumer: consumer
+            )
+        default:
+            throw ZipError.unsupportedCompressionMethod(localMethod)
+        }
+    }
+
+    /// Reads the full contents of a small entry (e.g. a symlink target), refusing entries larger than `maxBytes`.
+    func readSmallEntry(_ entry: ZipEntry, maxBytes: Int, bufferSize: Int) throws -> Data {
+        var result = Data()
+        try extract(entry, bufferSize: bufferSize) { chunk in
+            guard result.count + chunk.count <= maxBytes else {
+                throw ZipError.entryTooLarge
+            }
+            result.append(chunk)
+        }
+        return result
+    }
+
+    private func readStored(from offset: UInt64, size: UInt64, bufferSize: Int, consumer: (Data) throws -> Void) throws {
+        guard size <= fileSize, offset <= fileSize - size else {
+            throw ZipError.truncatedEntryData
+        }
+        try fileHandle.seek(toOffset: offset)
+        var remaining = size
+        while remaining > 0 {
+            let chunkSize = Int(min(UInt64(bufferSize), remaining))
+            try autoreleasepool {
+                guard let chunk = try fileHandle.read(upToCount: chunkSize), chunk.count == chunkSize else {
+                    throw ZipError.truncatedEntryData
+                }
+                try consumer(chunk)
+            }
+            remaining -= UInt64(chunkSize)
+        }
+    }
+
+    /// Inflates an entry, rejecting output that differs from the central directory's uncompressed size.
+    /// This also bounds decompression bombs to the declared size.
+    private func readDeflated(
+        from offset: UInt64,
+        compressedSize: UInt64,
+        expectedSize: UInt64,
+        bufferSize: Int,
+        consumer: (Data) throws -> Void
+    ) throws {
+        guard compressedSize <= fileSize, offset <= fileSize - compressedSize else {
+            throw ZipError.truncatedEntryData
+        }
+        try fileHandle.seek(toOffset: offset)
+
+        let stream = UnsafeMutablePointer<compression_stream>.allocate(capacity: 1)
+        defer { stream.deallocate() }
+        // COMPRESSION_ZLIB decodes raw DEFLATE (RFC 1951), which is what ZIP method 8 stores.
+        guard compression_stream_init(stream, COMPRESSION_STREAM_DECODE, COMPRESSION_ZLIB) == COMPRESSION_STATUS_OK else {
+            throw ZipError.corruptedEntryData
+        }
+        defer { compression_stream_destroy(stream) }
+
+        let sourceBuffer = UnsafeMutablePointer<UInt8>.allocate(capacity: bufferSize)
+        defer { sourceBuffer.deallocate() }
+        let destinationBuffer = UnsafeMutablePointer<UInt8>.allocate(capacity: bufferSize)
+        defer { destinationBuffer.deallocate() }
+
+        var remaining = compressedSize
+        stream.pointee.src_ptr = UnsafePointer(sourceBuffer)
+        stream.pointee.src_size = 0
+
+        var producedTotal: UInt64 = 0
+        var finished = false
+        while !finished {
+            try autoreleasepool {
+                if stream.pointee.src_size == 0 && remaining > 0 {
+                    let chunkSize = Int(min(UInt64(bufferSize), remaining))
+                    guard let chunk = try fileHandle.read(upToCount: chunkSize), chunk.count == chunkSize else {
+                        throw ZipError.truncatedEntryData
+                    }
+                    chunk.copyBytes(to: sourceBuffer, count: chunkSize)
+                    stream.pointee.src_ptr = UnsafePointer(sourceBuffer)
+                    stream.pointee.src_size = chunkSize
+                    remaining -= UInt64(chunkSize)
+                }
+
+                stream.pointee.dst_ptr = destinationBuffer
+                stream.pointee.dst_size = bufferSize
+                let flags = remaining == 0 ? Int32(COMPRESSION_STREAM_FINALIZE.rawValue) : 0
+                let status = compression_stream_process(stream, flags)
+                let produced = bufferSize - stream.pointee.dst_size
+                if produced > 0 {
+                    producedTotal += UInt64(produced)
+                    guard producedTotal <= expectedSize else {
+                        throw ZipError.corruptedEntryData
+                    }
+                    try consumer(Data(bytes: destinationBuffer, count: produced))
+                }
+
+                switch status {
+                case COMPRESSION_STATUS_END:
+                    guard producedTotal == expectedSize else {
+                        throw ZipError.corruptedEntryData
+                    }
+                    finished = true
+                case COMPRESSION_STATUS_OK:
+                    // All input consumed and no output produced: the deflate stream is truncated.
+                    if remaining == 0 && stream.pointee.src_size == 0 && produced == 0 {
+                        throw ZipError.truncatedEntryData
+                    }
+                default:
+                    throw ZipError.corruptedEntryData
+                }
+            }
+        }
+    }
+}

package/ios/Sources/CapacitorUpdaterPlugin/ZipCentralDirectory.swift

@@ -0,0 +1,280 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+import Foundation
+
+/// Parses the ZIP end of central directory (including ZIP64) and the central directory entries.
+/// Every offset and length is bounds-checked; malformed input throws `ZipError`.
+enum ZipCentralDirectory {
+    private static let eocdSignature: UInt32 = 0x0605_4b50
+    private static let zip64EocdSignature: UInt32 = 0x0606_4b50
+    private static let zip64LocatorSignature: UInt32 = 0x0706_4b50
+    private static let entrySignature: UInt32 = 0x0201_4b50
+    private static let eocdSize = 22
+    private static let zip64LocatorSize = 20
+    private static let zip64EocdMinimumSize = 56
+    private static let entryMinimumSize = 46
+    private static let maxCommentLength = 0xFFFF
+    private static let zip64ExtraFieldId: UInt16 = 0x0001
+
+    private struct EntrySizes {
+        var uncompressed: UInt64
+        var compressed: UInt64
+        var localHeaderOffset: UInt64
+    }
+
+    private struct Location {
+        var totalEntries: UInt64
+        var size: UInt64
+        var offset: UInt64
+        /// The central directory must end before this offset (the EOCD or ZIP64 EOCD record).
+        var end: UInt64
+    }
+
+    static func readEntries(handle: FileHandle, fileSize: UInt64) throws -> [ZipEntry] {
+        let location = try locateCentralDirectory(handle: handle, fileSize: fileSize)
+        guard location.offset <= location.end, location.size <= location.end - location.offset else {
+            throw ZipError.invalidCentralDirectory
+        }
+        // Every central directory entry takes at least 46 bytes, which bounds the entry count.
+        guard location.totalEntries <= location.size / UInt64(entryMinimumSize), location.size <= UInt64(Int.max) else {
+            throw ZipError.invalidCentralDirectory
+        }
+
+        let data = try ZipBytes.readChunk(handle: handle, fileSize: fileSize, at: location.offset, count: Int(location.size))
+        var entries: [ZipEntry] = []
+        entries.reserveCapacity(Int(location.totalEntries))
+        var cursor = 0
+        for _ in 0..<location.totalEntries {
+            let (entry, next) = try parseEntry(data, at: cursor)
+            entries.append(entry)
+            cursor = next
+        }
+        return entries
+    }
+
+    private static func locateCentralDirectory(handle: FileHandle, fileSize: UInt64) throws -> Location {
+        guard fileSize >= UInt64(eocdSize) else {
+            throw ZipError.missingEndOfCentralDirectory
+        }
+
+        // The EOCD record is at the end of the file, followed by an optional comment of up to 65535 bytes.
+        let tailLength = min(fileSize, UInt64(eocdSize + maxCommentLength))
+        let tailOffset = fileSize - tailLength
+        let tail = try ZipBytes.readChunk(handle: handle, fileSize: fileSize, at: tailOffset, count: Int(tailLength))
+
+        var eocdIndex: Int?
+        var index = tail.count - eocdSize
+        while index >= 0 {
+            if ZipBytes.uint32(tail, index) == eocdSignature,
+               index + eocdSize + Int(ZipBytes.uint16(tail, index + 20)) <= tail.count {
+                eocdIndex = index
+                break
+            }
+            index -= 1
+        }
+        guard let eocdIndex else {
+            throw ZipError.missingEndOfCentralDirectory
+        }
+
+        let eocdOffset = tailOffset + UInt64(eocdIndex)
+        let location = Location(
+            totalEntries: UInt64(ZipBytes.uint16(tail, eocdIndex + 10)),
+            size: UInt64(ZipBytes.uint32(tail, eocdIndex + 12)),
+            offset: UInt64(ZipBytes.uint32(tail, eocdIndex + 16)),
+            end: eocdOffset
+        )
+        let needsZip64 = location.totalEntries == 0xFFFF || location.size == 0xFFFF_FFFF || location.offset == 0xFFFF_FFFF
+        if let zip64Location = try readZip64Location(handle: handle, fileSize: fileSize, eocdOffset: eocdOffset) {
+            return zip64Location
+        }
+        if needsZip64 {
+            throw ZipError.invalidCentralDirectory
+        }
+        return location
+    }
+
+    private static func readZip64Location(handle: FileHandle, fileSize: UInt64, eocdOffset: UInt64) throws -> Location? {
+        guard eocdOffset >= UInt64(zip64LocatorSize) else {
+            return nil
+        }
+        let locatorOffset = eocdOffset - UInt64(zip64LocatorSize)
+        let locator = try ZipBytes.readChunk(handle: handle, fileSize: fileSize, at: locatorOffset, count: zip64LocatorSize)
+        guard ZipBytes.uint32(locator, 0) == zip64LocatorSignature else {
+            return nil
+        }
+        let recordOffset = ZipBytes.uint64(locator, 8)
+        guard recordOffset <= locatorOffset, locatorOffset - recordOffset >= UInt64(zip64EocdMinimumSize) else {
+            throw ZipError.invalidCentralDirectory
+        }
+        let record = try ZipBytes.readChunk(handle: handle, fileSize: fileSize, at: recordOffset, count: zip64EocdMinimumSize)
+        guard ZipBytes.uint32(record, 0) == zip64EocdSignature else {
+            throw ZipError.invalidCentralDirectory
+        }
+        return Location(
+            totalEntries: ZipBytes.uint64(record, 32),
+            size: ZipBytes.uint64(record, 40),
+            offset: ZipBytes.uint64(record, 48),
+            end: recordOffset
+        )
+    }
+
+    private static func parseEntry(_ data: Data, at offset: Int) throws -> (ZipEntry, Int) {
+        guard offset <= data.count - entryMinimumSize, ZipBytes.uint32(data, offset) == entrySignature else {
+            throw ZipError.invalidCentralDirectory
+        }
+        let versionMadeBy = ZipBytes.uint16(data, offset + 4)
+        let flags = ZipBytes.uint16(data, offset + 8)
+        let nameLength = Int(ZipBytes.uint16(data, offset + 28))
+        let extraLength = Int(ZipBytes.uint16(data, offset + 30))
+        let commentLength = Int(ZipBytes.uint16(data, offset + 32))
+        let externalAttributes = ZipBytes.uint32(data, offset + 38)
+
+        let nameStart = offset + entryMinimumSize
+        let extraStart = nameStart + nameLength
+        let next = extraStart + extraLength + commentLength
+        guard next <= data.count else {
+            throw ZipError.invalidCentralDirectory
+        }
+
+        var sizes = EntrySizes(
+            uncompressed: UInt64(ZipBytes.uint32(data, offset + 24)),
+            compressed: UInt64(ZipBytes.uint32(data, offset + 20)),
+            localHeaderOffset: UInt64(ZipBytes.uint32(data, offset + 42))
+        )
+        if sizes.uncompressed == 0xFFFF_FFFF || sizes.compressed == 0xFFFF_FFFF || sizes.localHeaderOffset == 0xFFFF_FFFF {
+            sizes = try applyZip64Extra(data, extraRange: extraStart..<(extraStart + extraLength), sizes: sizes)
+        }
+
+        // Same path decoding as ZIPFoundation: UTF-8 when general purpose bit 11 is set, CP437 otherwise.
+        let nameData = data.subdata(in: (data.startIndex + nameStart)..<(data.startIndex + extraStart))
+        let encoding: String.Encoding = flags & (1 << 11) != 0 ? .utf8 : codePage437
+        let path = String(data: nameData, encoding: encoding) ?? ""
+
+        let entry = ZipEntry(
+            path: path,
+            type: entryType(path: path, versionMadeBy: versionMadeBy, externalAttributes: externalAttributes),
+            generalPurposeFlags: flags,
+            compressionMethod: ZipBytes.uint16(data, offset + 10),
+            compressedSize: sizes.compressed,
+            uncompressedSize: sizes.uncompressed,
+            localHeaderOffset: sizes.localHeaderOffset
+        )
+        return (entry, next)
+    }
+
+    /// ZIP64 extended information: values are present only for fields saturated in the fixed record, in this order.
+    private static func applyZip64Extra(
+        _ data: Data,
+        extraRange: Range<Int>,
+        sizes: EntrySizes
+    ) throws -> EntrySizes {
+        var cursor = extraRange.lowerBound
+        while cursor + 4 <= extraRange.upperBound {
+            let headerId = ZipBytes.uint16(data, cursor)
+            let fieldStart = cursor + 4
+            let fieldEnd = fieldStart + Int(ZipBytes.uint16(data, cursor + 2))
+            guard fieldEnd <= extraRange.upperBound else {
+                throw ZipError.invalidCentralDirectory
+            }
+            if headerId != zip64ExtraFieldId {
+                cursor = fieldEnd
+                continue
+            }
+
+            var result = sizes
+            var valueCursor = fieldStart
+            func nextValue() throws -> UInt64 {
+                guard valueCursor + 8 <= fieldEnd else {
+                    throw ZipError.invalidCentralDirectory
+                }
+                defer { valueCursor += 8 }
+                return ZipBytes.uint64(data, valueCursor)
+            }
+            if result.uncompressed == 0xFFFF_FFFF {
+                result.uncompressed = try nextValue()
+            }
+            if result.compressed == 0xFFFF_FFFF {
+                result.compressed = try nextValue()
+            }
+            if result.localHeaderOffset == 0xFFFF_FFFF {
+                result.localHeaderOffset = try nextValue()
+            }
+            return result
+        }
+        throw ZipError.invalidCentralDirectory
+    }
+
+    /// Mirrors ZIPFoundation's `Entry.type` so the same entries are treated as files, directories or symlinks.
+    static func entryType(path: String, versionMadeBy: UInt16, externalAttributes: UInt32) -> ZipEntryType {
+        let hostSystem = versionMadeBy >> 8
+        let hasDirectorySuffix = path.hasSuffix("/")
+        switch hostSystem {
+        case 3, 19: // UNIX, macOS
+            let mode = mode_t(UInt16(truncatingIfNeeded: externalAttributes >> 16)) & S_IFMT
+            switch mode {
+            case S_IFREG:
+                return .file
+            case S_IFDIR:
+                return .directory
+            case S_IFLNK:
+                return .symlink
+            default:
+                return hasDirectorySuffix ? .directory : .file
+            }
+        case 0: // MS-DOS
+            return hasDirectorySuffix || (externalAttributes >> 4) == 0x01 ? .directory : .file
+        default:
+            return hasDirectorySuffix ? .directory : .file
+        }
+    }
+
+    private static let codePage437: String.Encoding = {
+        let encoding = CFStringConvertEncodingToNSStringEncoding(CFStringEncoding(CFStringEncodings.dosLatinUS.rawValue))
+        return String.Encoding(rawValue: encoding)
+    }()
+}
+
+/// Little-endian readers and bounded file reads for ZIP structures.
+enum ZipBytes {
+    static func readChunk(handle: FileHandle, fileSize: UInt64, at offset: UInt64, count: Int) throws -> Data {
+        guard count >= 0, UInt64(count) <= fileSize, offset <= fileSize - UInt64(count) else {
+            throw ZipError.invalidCentralDirectory
+        }
+        if count == 0 {
+            return Data()
+        }
+        try handle.seek(toOffset: offset)
+        guard let data = try handle.read(upToCount: count), data.count == count else {
+            throw ZipError.unreadableArchive
+        }
+        return data
+    }
+
+    // Callers bounds-check `offset` against `data.count` before reading.
+    static func uint16(_ data: Data, _ offset: Int) -> UInt16 {
+        let base = data.startIndex + offset
+        return UInt16(data[base]) | (UInt16(data[base + 1]) << 8)
+    }
+
+    static func uint32(_ data: Data, _ offset: Int) -> UInt32 {
+        let base = data.startIndex + offset
+        var value: UInt32 = 0
+        for byteIndex in 0..<4 {
+            value |= UInt32(data[base + byteIndex]) << (8 * UInt32(byteIndex))
+        }
+        return value
+    }
+
+    static func uint64(_ data: Data, _ offset: Int) -> UInt64 {
+        let base = data.startIndex + offset
+        var value: UInt64 = 0
+        for byteIndex in 0..<8 {
+            value |= UInt64(data[base + byteIndex]) << (8 * UInt64(byteIndex))
+        }
+        return value
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-updater",
-  "version": "8.51.25",
+  "version": "8.52.0",
   "license": "MPL-2.0",
   "description": "Live update for capacitor apps",
   "main": "dist/plugin.cjs.js",