@hot-updater/react-native 0.36.3 → 0.36.4

package/android/src/main/java/com/hotupdater/TarArchiveInputStream.kt

@@ -13,7 +13,7 @@ class TarArchiveInputStream(
 ) : InputStream() {
     private var currentEntry: TarArchiveEntry? = null
     private var currentEntryBytesRead: Long = 0
-    private var longName: String? = null
+    private var pendingName: String? = null
 
     companion object {
         private const val TAG = "TarInputStream"
@@ -73,14 +73,20 @@ class TarArchiveInputStream(
 
             // Handle GNU long filename extension
             if (entry.typeFlag == 'L') {
-                longName = readLongName(entry.size)
+                pendingName = readLongName(entry.size)
                 continue
             }
 
-            // Apply long name if present
-            if (longName != null) {
-                entry.name = longName!!
-                longName = null
+            // Handle POSIX PAX extended header
+            if (entry.typeFlag == 'x') {
+                readPaxPath(entry.size)?.let { pendingName = it }
+                continue
+            }
+
+            // Apply extended name if present
+            if (pendingName != null) {
+                entry.name = pendingName!!
+                pendingName = null
             }
 
             // Validate entry
@@ -306,6 +312,95 @@ class TarArchiveInputStream(
         return String(nameBytes, 0, nameLength, Charsets.UTF_8)
     }
 
+    /**
+     * Read the path attribute from a POSIX PAX extended header.
+     * Record lengths are measured in bytes and include the length itself.
+     */
+    private fun readPaxPath(size: Long): String? {
+        if (size < 0 || size > MAX_FILE_SIZE) {
+            throw SecurityException("Invalid PAX header size: $size")
+        }
+
+        val data = ByteArray(size.toInt())
+        var bytesRead = 0
+        while (bytesRead < data.size) {
+            val count = input.read(data, bytesRead, data.size - bytesRead)
+            if (count < 0) throw EOFException("Unexpected end reading PAX header")
+            bytesRead += count
+        }
+        skipPadding(size)
+
+        var offset = 0
+        var path: String? = null
+        while (offset < data.size) {
+            val space = findByte(data, ' '.code.toByte(), offset, data.size)
+            if (space <= offset) throw IOException("Invalid PAX record length")
+
+            val recordLength = parsePaxRecordLength(data, offset, space)
+            if (recordLength <= 0 || recordLength > data.size - offset) {
+                throw IOException("Invalid PAX record length: $recordLength")
+            }
+
+            val recordEnd = offset + recordLength
+            if (recordEnd <= space + 2 || data[recordEnd - 1] != '\n'.code.toByte()) {
+                throw IOException("Invalid PAX record")
+            }
+
+            val valueEnd = recordEnd - 1
+            val equals = findByte(data, '='.code.toByte(), space + 1, valueEnd)
+            if (equals <= space + 1) throw IOException("Invalid PAX record")
+
+            val key =
+                String(
+                    data,
+                    space + 1,
+                    equals - space - 1,
+                    Charsets.UTF_8,
+                )
+            if (key == "path") {
+                path =
+                    String(
+                        data,
+                        equals + 1,
+                        valueEnd - equals - 1,
+                        Charsets.UTF_8,
+                    )
+            }
+
+            offset = recordEnd
+        }
+
+        return path
+    }
+
+    private fun parsePaxRecordLength(
+        bytes: ByteArray,
+        start: Int,
+        end: Int,
+    ): Int {
+        var result = 0
+        for (index in start until end) {
+            val digit = bytes[index].toInt() - '0'.code
+            if (digit !in 0..9 || result > (Int.MAX_VALUE - digit) / 10) {
+                throw IOException("Invalid PAX record length")
+            }
+            result = result * 10 + digit
+        }
+        return result
+    }
+
+    private fun findByte(
+        bytes: ByteArray,
+        value: Byte,
+        start: Int,
+        end: Int,
+    ): Int {
+        for (index in start until end) {
+            if (bytes[index] == value) return index
+        }
+        return -1
+    }
+
     /**
      * Skip padding to 512-byte boundary
      */

package/android/src/test/java/com/hotupdater/TarArchiveInputStreamTest.kt

@@ -0,0 +1,68 @@
+package com.hotupdater
+
+import org.apache.commons.compress.archivers.tar.TarArchiveOutputStream
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertThrows
+import org.junit.Test
+import java.io.ByteArrayInputStream
+import java.io.ByteArrayOutputStream
+import org.apache.commons.compress.archivers.tar.TarArchiveEntry as CommonsTarArchiveEntry
+
+class TarArchiveInputStreamTest {
+    @Test
+    fun `reads a long basename from a POSIX PAX header`() {
+        val path = "raw/${"long-name-".repeat(14)}asset.bmp"
+        val contents = "pax asset".toByteArray()
+        val archive = createPaxArchive(path, contents)
+
+        TarArchiveInputStream(ByteArrayInputStream(archive)).use { tar ->
+            val entry = tar.getNextEntry()
+
+            assertEquals(path, entry?.name)
+            assertArrayEquals(contents, tar.readBytes())
+            assertNull(tar.getNextEntry())
+        }
+    }
+
+    @Test
+    fun `rejects path traversal from a POSIX PAX header`() {
+        val path = "../${"long-name-".repeat(14)}asset.bmp"
+        val archive =
+            createPaxArchive(
+                path = path,
+                contents = "malicious".toByteArray(),
+                headerPath = "safe.bmp",
+            )
+
+        val error =
+            assertThrows(SecurityException::class.java) {
+                TarArchiveInputStream(ByteArrayInputStream(archive)).use { tar ->
+                    tar.getNextEntry()
+                }
+            }
+
+        assertEquals("Path traversal detected: $path", error.message)
+    }
+
+    private fun createPaxArchive(
+        path: String,
+        contents: ByteArray,
+        headerPath: String = path,
+    ): ByteArray {
+        val output = ByteArrayOutputStream()
+        TarArchiveOutputStream(output).use { tar ->
+            tar.setLongFileMode(TarArchiveOutputStream.LONGFILE_POSIX)
+            val entry =
+                CommonsTarArchiveEntry(headerPath).apply {
+                    size = contents.size.toLong()
+                    if (path != headerPath) addPaxHeader("path", path)
+                }
+            tar.putArchiveEntry(entry)
+            tar.write(contents)
+            tar.closeArchiveEntry()
+        }
+        return output.toByteArray()
+    }
+}

package/lib/commonjs/sdkVersion.js

@@ -4,5 +4,5 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.HOT_UPDATER_SDK_VERSION = void 0;
-const HOT_UPDATER_SDK_VERSION = exports.HOT_UPDATER_SDK_VERSION = "0.36.3";
+const HOT_UPDATER_SDK_VERSION = exports.HOT_UPDATER_SDK_VERSION = "0.36.4";
 //# sourceMappingURL=sdkVersion.js.map

package/lib/module/sdkVersion.js

@@ -1,4 +1,4 @@
 "use strict";
 
-export const HOT_UPDATER_SDK_VERSION = "0.36.3";
+export const HOT_UPDATER_SDK_VERSION = "0.36.4";
 //# sourceMappingURL=sdkVersion.js.map

package/lib/typescript/commonjs/sdkVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const HOT_UPDATER_SDK_VERSION = "0.36.3";
+export declare const HOT_UPDATER_SDK_VERSION = "0.36.4";
 //# sourceMappingURL=sdkVersion.d.ts.map

package/lib/typescript/module/sdkVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const HOT_UPDATER_SDK_VERSION = "0.36.3";
+export declare const HOT_UPDATER_SDK_VERSION = "0.36.4";
 //# sourceMappingURL=sdkVersion.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/react-native",
-  "version": "0.36.3",
+  "version": "0.36.4",
   "description": "React Native OTA solution for self-hosted",
   "source": "./src/index.ts",
   "main": "./lib/commonjs/index.js",
@@ -131,14 +131,14 @@
     "react-native-builder-bob": "0.41.0",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "hot-updater": "0.36.3"
+    "hot-updater": "0.36.4"
   },
   "dependencies": {
     "use-sync-external-store": "1.5.0",
-    "@hot-updater/cli-tools": "0.36.3",
-    "@hot-updater/js": "0.36.3",
-    "@hot-updater/core": "0.36.3",
-    "@hot-updater/plugin-core": "0.36.3"
+    "@hot-updater/cli-tools": "0.36.4",
+    "@hot-updater/core": "0.36.4",
+    "@hot-updater/js": "0.36.4",
+    "@hot-updater/plugin-core": "0.36.4"
   },
   "scripts": {
     "build": "node ./scripts/sync-sdk-version.mjs run -- bob build && tsc -p plugin/tsconfig.build.json",

package/src/sdkVersion.ts

@@ -1 +1 @@
-export const HOT_UPDATER_SDK_VERSION = "0.36.3";
+export const HOT_UPDATER_SDK_VERSION = "0.36.4";