@forthtilliath/expo-release-updates 0.5.0 → 0.6.1

package/README.md

@@ -104,9 +104,9 @@ const history = await fetchReleaseHistory({
 // [{ version: "1.11.0", notes: "### Added\n- ...", publishedAt: "2026-07-30T..." }, ...]
 ```
 
-### `downloadAndInstallApk({ apkUrl, fileName, onProgress?, expectedMd5? })`
+### `downloadAndInstallApk({ apkUrl, fileName, onProgress?, expectedMd5?, allowedHosts? })`
 
-Downloads an APK to the app's cache directory and triggers the Android install-package intent. **Android only** — there is no iOS equivalent (sideloading isn't possible there). Pass `expectedMd5` to verify the downloaded file before installing — a mismatch deletes the file and throws instead. Publish the checksum alongside the release (e.g. in the release notes or a `.md5` asset) and read it yourself: `fetchLatestRelease` doesn't return it.
+Downloads an APK to the app's cache directory and triggers the Android install-package intent. **Android only** — there is no iOS equivalent (sideloading isn't possible there). `apkUrl` must be an `https://` URL on one of `allowedHosts` (default `["github.com"]`, where `fetchLatestRelease`'s `apkUrl` points) — anything else throws before downloading. Pass `expectedMd5` to verify the downloaded file before installing — a mismatch deletes the file and throws instead. Publish the checksum alongside the release (e.g. in the release notes or a `.md5` asset) and read it yourself: `fetchLatestRelease` doesn't return it.
 
 What `expectedMd5` does and doesn't protect against:
 

package/dist/downloadAndInstallApk.d.ts

@@ -12,14 +12,22 @@ export interface DownloadAndInstallApkOptions {
      * signed with the same key as the installed app is what guards against that.
      */
     expectedMd5?: string;
+    /**
+     * Hosts `apkUrl` may point to — `["github.com"]` by default, the host of
+     * the `apkUrl` returned by `fetchLatestRelease` (GitHub then redirects to
+     * its own download host). Any other host, or a non-`https://` URL, is
+     * rejected before downloading anything.
+     */
+    allowedHosts?: string[];
 }
 /**
  * Downloads an APK to the cache directory and triggers the Android
  * install-package intent. Android only — there is no equivalent flow on iOS,
  * which doesn't allow installing a downloaded package outside the App Store.
  *
- * @throws if the download fails, or if `expectedMd5` is set and doesn't
- * match the downloaded file.
+ * @throws if `apkUrl` isn't an `https://` URL on one of `allowedHosts`, if
+ * the download fails, or if `expectedMd5` is set and doesn't match the
+ * downloaded file.
  */
-export declare function downloadAndInstallApk({ apkUrl, fileName, onProgress, expectedMd5, }: DownloadAndInstallApkOptions): Promise<void>;
+export declare function downloadAndInstallApk({ apkUrl, fileName, onProgress, expectedMd5, allowedHosts, }: DownloadAndInstallApkOptions): Promise<void>;
 //# sourceMappingURL=downloadAndInstallApk.d.ts.map

package/dist/downloadAndInstallApk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"downloadAndInstallApk.d.ts","sourceRoot":"","sources":["../src/downloadAndInstallApk.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,WAAW,GACZ,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B9C"}
+{"version":3,"file":"downloadAndInstallApk.d.ts","sourceRoot":"","sources":["../src/downloadAndInstallApk.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,WAAW,EACX,YAAoC,GACrC,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC9C"}

package/dist/downloadAndInstallApk.js

@@ -5,15 +5,31 @@ import * as IntentLauncher from "expo-intent-launcher";
  * installer read the APK through its `content://` URI.
  */
 const FLAG_GRANT_READ_URI_PERMISSION = 1;
+const DEFAULT_ALLOWED_HOSTS = ["github.com"];
+/**
+ * Host of an `https://` URL, lowercased — or `null` for any other scheme, or
+ * a URL with credentials (`https://github.com@evil.example/`). Parsed by hand:
+ * React Native's `URL` doesn't implement `hostname`.
+ */
+function httpsHost(url) {
+    const match = /^https:\/\/([^/?#:@]+)(?::\d+)?(?:[/?#]|$)/i.exec(url);
+    return match?.[1]?.toLowerCase() ?? null;
+}
 /**
  * Downloads an APK to the cache directory and triggers the Android
  * install-package intent. Android only — there is no equivalent flow on iOS,
  * which doesn't allow installing a downloaded package outside the App Store.
  *
- * @throws if the download fails, or if `expectedMd5` is set and doesn't
- * match the downloaded file.
+ * @throws if `apkUrl` isn't an `https://` URL on one of `allowedHosts`, if
+ * the download fails, or if `expectedMd5` is set and doesn't match the
+ * downloaded file.
  */
-export async function downloadAndInstallApk({ apkUrl, fileName, onProgress, expectedMd5, }) {
+export async function downloadAndInstallApk({ apkUrl, fileName, onProgress, expectedMd5, allowedHosts = DEFAULT_ALLOWED_HOSTS, }) {
+    const host = httpsHost(apkUrl);
+    if (!host ||
+        !allowedHosts.some((allowed) => allowed.toLowerCase() === host)) {
+        throw new Error(`Refusing to download the APK from ${apkUrl}: expected an https:// URL on ${allowedHosts.join(", ")}.`);
+    }
     const destination = new File(Paths.cache, fileName);
     if (destination.exists)
         destination.delete();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forthtilliath/expo-release-updates",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -26,7 +26,7 @@
     "expo-intent-launcher": ">=12.0.0"
   },
   "dependencies": {
-    "@forthtilliath/ts-kit": "^0.11.0"
+    "@forthtilliath/ts-kit": "^0.12.0"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "5.0.2",
@@ -35,9 +35,9 @@
     "expo-intent-launcher": "~57.0.1",
     "typescript": "^5.9.3",
     "vitest": "^5.0.2",
-    "@forthtilliath/eslint-config": "0.8.0",
-    "@forthtilliath/test-kit": "0.3.0",
-    "@forthtilliath/typescript-config": "0.1.1"
+    "@forthtilliath/eslint-config": "0.9.0",
+    "@forthtilliath/typescript-config": "0.1.1",
+    "@forthtilliath/test-kit": "0.3.0"
   },
   "scripts": {
     "lint": "eslint . --max-warnings 0",