@dynamic-labs/react-native-extension 4.91.6 → 4.92.0

package/index.cjs

@@ -35,7 +35,7 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var version = "4.91.6";
+var version = "4.92.0";
 
 function _extends() {
   return _extends = Object.assign ? Object.assign.bind() : function (n) {
@@ -1335,6 +1335,20 @@ const setupPlatformHandler = core => {
     fileName,
     mimeType
   }) {
+    /**
+     * Sanitize the caller-provided fileName to prevent path traversal
+     * (CWE-22). The fileName is used to build a path inside the app cache
+     * directory, so a value containing path separators or `..` segments
+     * could escape the cache directory and delete/overwrite arbitrary files
+     * in the app sandbox. Reject anything that is not a plain basename:
+     * empty, `.`/`..`, or containing `/` or `\` (any `..` segment within a
+     * path is caught by the separator checks). Reducing to the basename here
+     * would silently write attacker-chosen data under a different name, so we
+     * reject instead.
+     */
+    if (!fileName || fileName === '.' || fileName === '..' || fileName.includes('/') || fileName.includes('\\')) {
+      throw new Error(`Invalid fileName: ${fileName}`);
+    }
     /**
      * Because this is an iOS and Android only package, we need to import
      * dynamically to avoid react-native-web build errors.

package/index.js

@@ -13,7 +13,7 @@ import { createURL, getInitialURL, addEventListener, openURL } from 'expo-linkin
 import { openAuthSessionAsync } from 'expo-web-browser';
 import { createPasskey, PasskeyStamper } from '@turnkey/react-native-passkey-stamper';
 
-var version = "4.91.6";
+var version = "4.92.0";
 
 function _extends() {
   return _extends = Object.assign ? Object.assign.bind() : function (n) {
@@ -1313,6 +1313,20 @@ const setupPlatformHandler = core => {
     fileName,
     mimeType
   }) {
+    /**
+     * Sanitize the caller-provided fileName to prevent path traversal
+     * (CWE-22). The fileName is used to build a path inside the app cache
+     * directory, so a value containing path separators or `..` segments
+     * could escape the cache directory and delete/overwrite arbitrary files
+     * in the app sandbox. Reject anything that is not a plain basename:
+     * empty, `.`/`..`, or containing `/` or `\` (any `..` segment within a
+     * path is caught by the separator checks). Reducing to the basename here
+     * would silently write attacker-chosen data under a different name, so we
+     * reject instead.
+     */
+    if (!fileName || fileName === '.' || fileName === '..' || fileName.includes('/') || fileName.includes('\\')) {
+      throw new Error(`Invalid fileName: ${fileName}`);
+    }
     /**
      * Because this is an iOS and Android only package, we need to import
      * dynamically to avoid react-native-web build errors.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/react-native-extension",
-  "version": "4.91.6",
+  "version": "4.92.0",
   "main": "./index.cjs",
   "module": "./index.js",
   "types": "./src/index.d.ts",
@@ -18,11 +18,11 @@
     "@turnkey/react-native-passkey-stamper": "1.2.7",
     "@react-native-documents/picker": "^11.0.0",
     "react-native-fs": ">=2.20.0",
-    "@dynamic-labs/assert-package-version": "4.91.6",
-    "@dynamic-labs/client": "4.91.6",
-    "@dynamic-labs/logger": "4.91.6",
-    "@dynamic-labs/message-transport": "4.91.6",
-    "@dynamic-labs/webview-messages": "4.91.6"
+    "@dynamic-labs/assert-package-version": "4.92.0",
+    "@dynamic-labs/client": "4.92.0",
+    "@dynamic-labs/logger": "4.92.0",
+    "@dynamic-labs/message-transport": "4.92.0",
+    "@dynamic-labs/webview-messages": "4.92.0"
   },
   "peerDependencies": {
     "react": ">=18.0.0 <20.0.0",