@gpc-cli/core 0.10.5 → 0.10.6

package/dist/index.d.ts

@@ -886,7 +886,9 @@ declare function listReportObjects(auth: ReportsAuth, bucket: string, options: {
  * content-encoding:gzip objects on this path in Node's fetch, but callers must still run the
  * bytes through the decode layer, which re-checks the gzip magic as a backstop.
  */
-declare function downloadReportObject(auth: ReportsAuth, bucket: string, objectName: string): Promise<Buffer>;
+declare function downloadReportObject(auth: ReportsAuth, bucket: string, objectName: string, options?: {
+    maxBytes?: number;
+}): Promise<Buffer>;
 
 declare function isGzip(buf: Uint8Array): boolean;
 declare function isZip(buf: Uint8Array): boolean;
@@ -907,13 +909,23 @@ interface ZipCsvEntry {
     name: string;
     text: string;
 }
+interface ExtractCsvEntriesOptions {
+    /** Ceiling on the inflated size of a single CSV entry. Defaults to MAX_INFLATED_BYTES. */
+    maxEntryBytes?: number;
+    /** Ceiling on the decoded text of all entries combined. Defaults to MAX_INFLATED_BYTES. */
+    maxTotalBytes?: number;
+}
 /**
  * Extract the CSV entries from a financial report ZIP archive, returned as decoded text.
  * Uses yauzl's `fromBuffer` (no file descriptor) so it behaves identically under the
  * Bun-compiled standalone binary, and is bounded by a timeout so a corrupt archive can
  * never hang the process (same hardening as the preflight AAB reader).
+ *
+ * Each entry is also bounded by `maxEntryBytes`: a ZIP entry's declared sizes are
+ * attacker-controlled, so a small archive can otherwise inflate to gigabytes of buffers
+ * (a 408 KB archive reached 1.35 GB RSS before this cap).
  */
-declare function extractCsvEntriesFromZip(buffer: Buffer): Promise<ZipCsvEntry[]>;
+declare function extractCsvEntriesFromZip(buffer: Buffer, options?: ExtractCsvEntriesOptions): Promise<ZipCsvEntry[]>;
 
 declare function isFinancialReportType(type: string): boolean;
 declare function isStatsReportType(type: string): boolean;

package/dist/index.js

@@ -2315,28 +2315,18 @@ function reviewsToCsv(reviews) {
     const uc = r.comments?.[0]?.userComment;
     const fields = [
       r.reviewId,
-      csvEscape(r.authorName),
+      escapeCsvField(r.authorName),
       uc?.starRating ?? "",
-      csvEscape(uc?.text ?? ""),
+      escapeCsvField(uc?.text ?? ""),
       uc?.reviewerLanguage ?? "",
       uc ? new Date(Number(uc.lastModified.seconds) * 1e3).toISOString() : "",
-      csvEscape(uc?.device ?? ""),
-      csvEscape(uc?.appVersionName ?? "")
+      escapeCsvField(uc?.device ?? ""),
+      escapeCsvField(uc?.appVersionName ?? "")
     ];
     return fields.join(",");
   });
   return [header, ...rows].join("\n");
 }
-function csvEscape(value) {
-  let safe = value;
-  if (/^[=+\-@\t\r]/.test(safe)) {
-    safe = `'${safe}`;
-  }
-  if (safe.includes(",") || safe.includes('"') || safe.includes("\n")) {
-    return `"${safe.replace(/"/g, '""')}"`;
-  }
-  return safe;
-}
 async function analyzeReviews2(client, packageName, options) {
   const { reviews } = await listReviews(client, packageName, options);
   const items = reviews.map((r) => {
@@ -4151,6 +4141,7 @@ function reportObjectNotFoundError(opts) {
 var GCS_API_BASE = "https://storage.googleapis.com/storage/v1/b";
 var LIST_TIMEOUT_MS = 6e4;
 var DOWNLOAD_TIMEOUT_MS = 12e4;
+var MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;
 function networkError(bucket, cause) {
   const detail = cause instanceof Error ? cause.message : String(cause);
   return new GpcError(
@@ -4160,6 +4151,14 @@ function networkError(bucket, cause) {
     "Check your internet connection and retry. Google Cloud Storage may also be briefly unavailable."
   );
 }
+function tooLargeError(objectName, maxBytes) {
+  return new GpcError(
+    `Report object "${objectName}" is larger than the ${maxBytes}-byte download limit.`,
+    "REPORT_DOWNLOAD_FAILED",
+    4,
+    "Play bulk reports are far smaller than this; confirm the bucket and object name, then download the file from Play Console -> Download reports if you really need it."
+  );
+}
 function maxRetries() {
   const parsed = Number(process.env["GPC_MAX_RETRIES"]);
   return Number.isInteger(parsed) && parsed >= 0 && parsed <= 10 ? parsed : 3;
@@ -4226,7 +4225,8 @@ async function listReportObjects(auth, bucket, options) {
   }));
   return { objects, nextPageToken: body.nextPageToken };
 }
-async function downloadReportObject(auth, bucket, objectName) {
+async function downloadReportObject(auth, bucket, objectName, options = {}) {
+  const maxBytes = options.maxBytes ?? MAX_DOWNLOAD_BYTES;
   const url = `${GCS_API_BASE}/${encodeURIComponent(bucket)}/o/${encodeURIComponent(objectName)}?alt=media`;
   const res = await gcsFetch(auth, bucket, url, DOWNLOAD_TIMEOUT_MS);
   if (res.status === 404) {
@@ -4245,11 +4245,25 @@ async function downloadReportObject(auth, bucket, objectName) {
       "Retry in a moment. If the error persists, list the reports to confirm the object still exists."
     );
   }
+  const declared = Number(res.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    throw tooLargeError(objectName, maxBytes);
+  }
+  const body = res.body;
+  if (!body) return Buffer.alloc(0);
+  const chunks = [];
+  let read = 0;
   try {
-    return Buffer.from(await res.arrayBuffer());
+    for await (const chunk of body) {
+      read += chunk.length;
+      if (read > maxBytes) throw tooLargeError(objectName, maxBytes);
+      chunks.push(Buffer.from(chunk));
+    }
   } catch (err) {
+    if (err instanceof GpcError) throw err;
     throw networkError(bucket, err);
   }
+  return Buffer.concat(chunks);
 }
 
 // src/reports/decode.ts
@@ -4285,13 +4299,15 @@ function decodeStatsCsv(buf) {
   return decodeCsvText(gunzipIfNeeded(buf));
 }
 var ZIP_READ_TIMEOUT_MS = 3e4;
-function extractCsvEntriesFromZip(buffer) {
+var MAX_CSV_ENTRIES = 64;
+function extractCsvEntriesFromZip(buffer, options = {}) {
+  const maxEntryBytes = options.maxEntryBytes ?? MAX_INFLATED_BYTES;
+  const maxTotalBytes = options.maxTotalBytes ?? MAX_INFLATED_BYTES;
   return new Promise((resolve2, reject) => {
     let settled = false;
     const timer = setTimeout(() => {
       settleReject(new Error("Timed out reading report archive"));
     }, ZIP_READ_TIMEOUT_MS);
-    timer.unref?.();
     function settleResolve(v) {
       if (settled) return;
       settled = true;
@@ -4314,6 +4330,8 @@ function extractCsvEntriesFromZip(buffer) {
         const entries = [];
         let pending = 0;
         let entriesDone = false;
+        let csvEntries = 0;
+        let totalBytes = 0;
         function fail(e) {
           try {
             zipfile.close();
@@ -4329,6 +4347,10 @@ function extractCsvEntriesFromZip(buffer) {
             zipfile.readEntry();
             return;
           }
+          if (++csvEntries > MAX_CSV_ENTRIES) {
+            fail(new Error(`Report archive holds more than ${MAX_CSV_ENTRIES} CSV entries`));
+            return;
+          }
           pending++;
           zipfile.openReadStream(entry, (streamErr, stream) => {
             if (streamErr || !stream) {
@@ -4336,10 +4358,35 @@ function extractCsvEntriesFromZip(buffer) {
               return;
             }
             const chunks = [];
-            stream.on("data", (c) => chunks.push(c));
+            let read = 0;
+            stream.on("data", (c) => {
+              read += c.length;
+              if (read > maxEntryBytes) {
+                stream.destroy();
+                fail(
+                  new Error(
+                    `Entry "${entry.fileName}" exceeds the ${maxEntryBytes}-byte limit for a report CSV`
+                  )
+                );
+                return;
+              }
+              chunks.push(c);
+            });
             stream.on("error", fail);
             stream.on("end", () => {
-              entries.push({ name: entry.fileName, text: decodeStatsCsv(Buffer.concat(chunks)) });
+              let text;
+              try {
+                text = decodeStatsCsv(Buffer.concat(chunks));
+              } catch (e) {
+                fail(e instanceof Error ? e : new Error(String(e)));
+                return;
+              }
+              totalBytes += text.length;
+              if (totalBytes > maxTotalBytes) {
+                fail(new Error(`Report archive exceeds the ${maxTotalBytes}-byte total limit`));
+                return;
+              }
+              entries.push({ name: entry.fileName, text });
               pending--;
               zipfile.readEntry();
               maybeResolve();
@@ -5458,11 +5505,11 @@ async function getAchievementConfig(client, achievementId) {
 }
 async function createAchievementConfig(client, applicationId, data) {
   validateApplicationId(applicationId);
-  return client.achievements.insert(applicationId, data);
+  return client.achievements.insert(applicationId, withoutRedactedToken(data));
 }
 async function updateAchievementConfig(client, achievementId, data) {
   validateResourceId(achievementId, "achievement");
-  return client.achievements.update(achievementId, data);
+  return client.achievements.update(achievementId, withoutRedactedToken(data));
 }
 async function deleteAchievementConfig(client, achievementId) {
   validateResourceId(achievementId, "achievement");
@@ -5494,11 +5541,11 @@ async function getLeaderboardConfig(client, leaderboardId) {
 }
 async function createLeaderboardConfig(client, applicationId, data) {
   validateApplicationId(applicationId);
-  return client.leaderboards.insert(applicationId, data);
+  return client.leaderboards.insert(applicationId, withoutRedactedToken(data));
 }
 async function updateLeaderboardConfig(client, leaderboardId, data) {
   validateResourceId(leaderboardId, "leaderboard");
-  return client.leaderboards.update(leaderboardId, data);
+  return client.leaderboards.update(leaderboardId, withoutRedactedToken(data));
 }
 async function deleteLeaderboardConfig(client, leaderboardId) {
   validateResourceId(leaderboardId, "leaderboard");
@@ -5556,6 +5603,11 @@ async function setLeaderboardIcon(client, leaderboardId, filePath) {
     iconContentType(filePath)
   );
 }
+function withoutRedactedToken(config) {
+  if (config.token !== REDACTED) return config;
+  const { token: _token, ...rest } = config;
+  return rest;
+}
 function safeConfigFilename(id) {
   return `${id.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`;
 }
@@ -5583,7 +5635,7 @@ async function readConfigDir(dir) {
         "Each file must contain a single achievement or leaderboard config object."
       );
     }
-    out.push({ file, config: parsed });
+    out.push({ file, config: withoutRedactedToken(parsed) });
   }
   return out;
 }
@@ -6293,6 +6345,7 @@ var SO_PATH_RE = /(?:^|\/)lib\/[^/]+\/[^/]+\.so$/;
 var MODULE_MANIFEST_RE = /^([^/]+)\/manifest\/AndroidManifest\.xml$/;
 var MAX_MODULE_MANIFEST_BYTES = 1024 * 1024;
 var MAX_MODULE_MANIFESTS = 256;
+var MAX_SO_HEADER_READS = 512;
 var SCAN_TIMEOUT_MS = 6e4;
 function detectManifestPath(filePath) {
   return filePath.toLowerCase().endsWith(".apk") ? APK_MANIFEST_PATH : AAB_MANIFEST_PATH;
@@ -6390,6 +6443,7 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
         const soHeaders = /* @__PURE__ */ new Map();
         const moduleManifests = /* @__PURE__ */ new Map();
         let moduleManifestReads = 0;
+        let soHeaderReads = 0;
         let manifestBuf = null;
         let pendingStreams = 0;
         let entrysDone = false;
@@ -6406,6 +6460,10 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
             settleResolve({ zipfile, entries, manifestBuf, soHeaders, moduleManifests });
           }
         }
+        function advance() {
+          if (settled) return;
+          zipfile.readEntry();
+        }
         function readEntryStream(entry, onData, maxBytes, optional = false) {
           pendingStreams++;
           let done = false;
@@ -6417,6 +6475,7 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
             if (done) return;
             done = true;
             pendingStreams--;
+            advance();
             maybeResolve();
           };
           zipfile.openReadStream(entry, (streamErr, stream) => {
@@ -6443,6 +6502,7 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
               const buf = Buffer.concat(chunks);
               onData(maxBytes ? buf.subarray(0, maxBytes) : buf);
               pendingStreams--;
+              advance();
               maybeResolve();
             };
             stream.on("end", finish);
@@ -6479,7 +6539,8 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
                 MAX_MODULE_MANIFEST_BYTES,
                 true
               );
-            } else if (SO_PATH_RE.test(path)) {
+            } else if (SO_PATH_RE.test(path) && soHeaderReads < MAX_SO_HEADER_READS) {
+              soHeaderReads++;
               readEntryStream(
                 entry,
                 (buf) => {
@@ -6487,8 +6548,9 @@ function openAndScan(buffer, manifestPath = AAB_MANIFEST_PATH) {
                 },
                 SO_HEADER_BYTES
               );
+            } else {
+              advance();
             }
-            zipfile.readEntry();
           } catch (e) {
             fail(e instanceof Error ? e : new Error(String(e)));
           }
@@ -7044,6 +7106,20 @@ var nativeLibsScanner = {
       });
     }
     check16KBAlignment(ctx.nativeLibHeaders, ctx.manifest, findings);
+    if (ctx.nativeLibHeaders) {
+      const soCount = entries.filter((e) => nativeLibAbi(e.path) && e.path.endsWith(".so")).length;
+      const unchecked = soCount - ctx.nativeLibHeaders.size;
+      if (unchecked > 0) {
+        findings.push({
+          scanner: "native-libs",
+          ruleId: "native-libs-16kb-unchecked",
+          severity: "warning",
+          title: `${unchecked} of ${soCount} native libraries not checked for 16KB alignment`,
+          message: `Preflight checked the first ${ctx.nativeLibHeaders.size} native libraries in this bundle; the remaining ${unchecked} were not inspected, so a misaligned library among them would not be reported.`,
+          suggestion: "Verify alignment of the full bundle with Android Studio's APK Analyzer or `zipalign -c -P 16 -v 4 app.apk` on a universal APK."
+        });
+      }
+    }
     const detectedAbis = KNOWN_ABIS.filter((abi) => abisFound.has(abi));
     const unknownAbis = [...abisFound].filter(
       (abi) => !KNOWN_ABIS.includes(abi)
@@ -9807,7 +9883,7 @@ async function sha256File(filePath) {
 }
 
 // src/commands/image-sync.ts
-import { readdir as readdir7, stat as stat10 } from "fs/promises";
+import { readdir as readdir7 } from "fs/promises";
 import { join as join13, extname as extname5 } from "path";
 import { PlayApiError } from "@gpc-cli/api";
 var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg"]);
@@ -9822,12 +9898,20 @@ var ALL_IMAGE_TYPES2 = [
   "wearScreenshots"
 ];
 async function scanLocalImages(dir) {
+  let entries;
   try {
-    const entries = await readdir7(dir, { withFileTypes: true });
-    return entries.filter((e) => e.isFile() && IMAGE_EXTENSIONS.has(extname5(e.name).toLowerCase())).map((e) => e.name).sort();
-  } catch {
-    return [];
+    entries = await readdir7(dir, { withFileTypes: true });
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return null;
+    throw new GpcError(
+      `Cannot read image directory "${dir}": ${code ?? String(error)}`,
+      "IMAGE_SYNC_DIR_UNREADABLE",
+      1,
+      "Check the directory's permissions (and container volume ownership in CI). Nothing was changed on Google Play."
+    );
   }
+  return entries.filter((e) => e.isFile() && IMAGE_EXTENSIONS.has(extname5(e.name).toLowerCase())).map((e) => e.name).sort();
 }
 async function scanLanguages(dir) {
   try {
@@ -9837,13 +9921,6 @@ async function scanLanguages(dir) {
     return [];
   }
 }
-async function dirExists(path) {
-  try {
-    return (await stat10(path)).isDirectory();
-  } catch {
-    return false;
-  }
-}
 async function syncImages(client, packageName, dir, options) {
   const details = [];
   let uploaded = 0;
@@ -9864,7 +9941,8 @@ async function syncImages(client, packageName, dir, options) {
     for (const language of languages) {
       for (const imageType of imageTypes) {
         const localDir = join13(dir, language, imageType);
-        const localFiles = await scanLocalImages(localDir);
+        const scanned = await scanLocalImages(localDir);
+        const localFiles = scanned ?? [];
         let remoteImages;
         try {
           remoteImages = await client.images.list(packageName, edit.id, language, imageType);
@@ -9906,7 +9984,7 @@ async function syncImages(client, packageName, dir, options) {
           details.push({ language, imageType, file, action: "upload", reason });
         };
         if (options?.delete) {
-          if (localFiles.length === 0 && remoteImages.length > 0 && !await dirExists(localDir)) {
+          if (scanned === null && remoteImages.length > 0) {
             for (const img of remoteImages) {
               details.push({
                 language,