@hot-updater/react-native 1.0.0-rc.1 → 1.0.0-rc.15

package/android/src/test/java/com/hotupdater/TarArchiveInputStreamTest.kt

@@ -1,68 +0,0 @@
-package com.hotupdater
-
-import org.apache.commons.compress.archivers.tar.TarArchiveOutputStream
-import org.junit.Assert.assertArrayEquals
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertThrows
-import org.junit.Test
-import java.io.ByteArrayInputStream
-import java.io.ByteArrayOutputStream
-import org.apache.commons.compress.archivers.tar.TarArchiveEntry as CommonsTarArchiveEntry
-
-class TarArchiveInputStreamTest {
-    @Test
-    fun `reads a long basename from a POSIX PAX header`() {
-        val path = "raw/${"long-name-".repeat(14)}asset.bmp"
-        val contents = "pax asset".toByteArray()
-        val archive = createPaxArchive(path, contents)
-
-        TarArchiveInputStream(ByteArrayInputStream(archive)).use { tar ->
-            val entry = tar.getNextEntry()
-
-            assertEquals(path, entry?.name)
-            assertArrayEquals(contents, tar.readBytes())
-            assertNull(tar.getNextEntry())
-        }
-    }
-
-    @Test
-    fun `rejects path traversal from a POSIX PAX header`() {
-        val path = "../${"long-name-".repeat(14)}asset.bmp"
-        val archive =
-            createPaxArchive(
-                path = path,
-                contents = "malicious".toByteArray(),
-                headerPath = "safe.bmp",
-            )
-
-        val error =
-            assertThrows(SecurityException::class.java) {
-                TarArchiveInputStream(ByteArrayInputStream(archive)).use { tar ->
-                    tar.getNextEntry()
-                }
-            }
-
-        assertEquals("Path traversal detected: $path", error.message)
-    }
-
-    private fun createPaxArchive(
-        path: String,
-        contents: ByteArray,
-        headerPath: String = path,
-    ): ByteArray {
-        val output = ByteArrayOutputStream()
-        TarArchiveOutputStream(output).use { tar ->
-            tar.setLongFileMode(TarArchiveOutputStream.LONGFILE_POSIX)
-            val entry =
-                CommonsTarArchiveEntry(headerPath).apply {
-                    size = contents.size.toLong()
-                    if (path != headerPath) addPaxHeader("path", path)
-                }
-            tar.putArchiveEntry(entry)
-            tar.write(contents)
-            tar.closeArchiveEntry()
-        }
-        return output.toByteArray()
-    }
-}

package/ios/HotUpdater/Internal/ArchiveExtractionUtilities.swift

@@ -1,178 +0,0 @@
-import Foundation
-
-enum ArchiveExtractionUtilities {
-    static let bufferSize = 64 * 1024
-
-    static func readUpToCount(from handle: FileHandle, count: Int) throws -> Data? {
-        guard count >= 0 else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 5,
-                userInfo: [NSLocalizedDescriptionKey: "Invalid read size: \(count)"]
-            )
-        }
-
-        if count == 0 {
-            return Data()
-        }
-
-        if #available(macOS 10.15.4, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
-            return try handle.read(upToCount: count)
-        }
-
-        return handle.readData(ofLength: count)
-    }
-
-    static func readExactly(from handle: FileHandle, count: Int) throws -> Data {
-        guard count >= 0 else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 1,
-                userInfo: [NSLocalizedDescriptionKey: "Invalid read size: \(count)"]
-            )
-        }
-
-        if count == 0 {
-            return Data()
-        }
-
-        guard let data = try readUpToCount(from: handle, count: count), data.count == count else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 2,
-                userInfo: [NSLocalizedDescriptionKey: "Unexpected end of archive while reading \(count) bytes"]
-            )
-        }
-
-        return data
-    }
-
-    static func currentOffset(for handle: FileHandle) -> UInt64 {
-        if #available(macOS 10.15.4, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
-            return (try? handle.offset()) ?? 0
-        }
-
-        return handle.offsetInFile
-    }
-
-    static func seek(_ handle: FileHandle, to offset: UInt64) throws {
-        if #available(macOS 10.15.4, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
-            try handle.seek(toOffset: offset)
-            return
-        }
-
-        handle.seek(toFileOffset: offset)
-    }
-
-    static func skipBytes(_ byteCount: UInt64, in handle: FileHandle) throws {
-        guard byteCount > 0 else {
-            return
-        }
-
-        let offset = currentOffset(for: handle)
-        let (targetOffset, overflowed) = offset.addingReportingOverflow(byteCount)
-
-        guard !overflowed else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 6,
-                userInfo: [NSLocalizedDescriptionKey: "Archive offset overflow while skipping \(byteCount) bytes from offset \(offset)"]
-            )
-        }
-
-        try seek(handle, to: targetOffset)
-    }
-
-    static func normalizedRelativePath(from rawPath: String) -> String? {
-        let candidate = rawPath.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !candidate.isEmpty,
-              !candidate.contains("\0"),
-              !candidate.contains("\\"),
-              !candidate.hasPrefix("/"),
-              candidate.range(of: #"^[A-Za-z]:"#, options: .regularExpression) == nil
-        else {
-            return nil
-        }
-
-        let components = candidate
-            .split(separator: "/")
-            .map(String.init)
-
-        guard !components.isEmpty else {
-            return nil
-        }
-
-        guard components.count == candidate.split(separator: "/", omittingEmptySubsequences: false).count,
-              !components.contains(".."),
-              !components.contains(".") else {
-            return nil
-        }
-
-        return components.joined(separator: "/")
-    }
-
-    static func extractionURL(for relativePath: String, destinationRoot: String) throws -> URL {
-        let rootURL = URL(fileURLWithPath: destinationRoot, isDirectory: true)
-        let targetURL = rootURL.appendingPathComponent(relativePath)
-        let standardizedRoot = rootURL.standardizedFileURL.path
-        let standardizedTarget = targetURL.standardizedFileURL.path
-
-        guard standardizedTarget == standardizedRoot ||
-                standardizedTarget.hasPrefix(standardizedRoot + "/") else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 3,
-                userInfo: [NSLocalizedDescriptionKey: "Path traversal attempt detected: \(relativePath)"]
-            )
-        }
-
-        return targetURL
-    }
-
-    static func ensureDirectory(at url: URL, fileManager: FileManager = .default) throws {
-        var isDirectory = ObjCBool(false)
-        if fileManager.fileExists(atPath: url.path, isDirectory: &isDirectory) {
-            if isDirectory.boolValue {
-                return
-            }
-
-            try fileManager.removeItem(at: url)
-        }
-
-        try fileManager.createDirectory(at: url, withIntermediateDirectories: true, attributes: nil)
-    }
-
-    static func createOutputFile(at url: URL, fileManager: FileManager = .default) throws -> FileHandle {
-        try ensureDirectory(at: url.deletingLastPathComponent(), fileManager: fileManager)
-
-        if fileManager.fileExists(atPath: url.path) {
-            try fileManager.removeItem(at: url)
-        }
-
-        guard fileManager.createFile(atPath: url.path, contents: nil) else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 4,
-                userInfo: [NSLocalizedDescriptionKey: "Failed to create output file at \(url.path)"]
-            )
-        }
-
-        return try FileHandle(forWritingTo: url)
-    }
-}
-
-extension Data {
-    func archiveUInt16LE(at offset: Int) -> UInt16 {
-        let byte0 = UInt16(self[offset])
-        let byte1 = UInt16(self[offset + 1]) << 8
-        return byte0 | byte1
-    }
-
-    func archiveUInt32LE(at offset: Int) -> UInt32 {
-        let byte0 = UInt32(self[offset])
-        let byte1 = UInt32(self[offset + 1]) << 8
-        let byte2 = UInt32(self[offset + 2]) << 16
-        let byte3 = UInt32(self[offset + 3]) << 24
-        return byte0 | byte1 | byte2 | byte3
-    }
-}

package/ios/HotUpdater/Internal/DecompressService.swift

@@ -1,112 +0,0 @@
-import Foundation
-
-/**
- * Unified decompression service that uses Strategy pattern to handle multiple compression formats.
- * Automatically detects format by trying each strategy's validation and delegates to appropriate decompression strategy.
- */
-class DecompressService {
-    /// Strategies with reliable file signatures that can be validated cheaply.
-    private let signatureStrategies: [DecompressionStrategy]
-    /// TAR.BR has no reliable magic bytes, so it is attempted as the final fallback.
-    private let tarBrStrategy: DecompressionStrategy
-
-    init() {
-        // Order matters: Try ZIP first (clear magic bytes), then TAR.GZ (GZIP magic bytes).
-        // TAR.BR is attempted only after signature-based formats are ruled out.
-        self.signatureStrategies = [
-            ZipDecompressionStrategy(),
-            TarGzDecompressionStrategy()
-        ]
-        self.tarBrStrategy = TarBrDecompressionStrategy()
-    }
-
-    /**
-     * Extracts a compressed file to the destination directory.
-     * Automatically detects compression format by trying each strategy's validation.
-     * @param file Path to the compressed file
-     * @param destination Path to the destination directory
-     * @param progressHandler Callback for progress updates (0.0 - 1.0)
-     * @throws Error if decompression fails or no valid strategy found
-     */
-    func unzip(file: String, to destination: String, progressHandler: @escaping (Double) -> Void) throws {
-        // Collect file information for better error messages
-        let fileURL = URL(fileURLWithPath: file)
-        let fileName = fileURL.lastPathComponent
-        let fileSize = (try? FileManager.default.attributesOfItem(atPath: file)[.size] as? UInt64) ?? 0
-
-        // Try each signature-based strategy first.
-        for strategy in signatureStrategies {
-            if strategy.isValid(file: file) {
-                NSLog("[DecompressService] Using strategy for \(fileName)")
-                try strategy.decompress(file: file, to: destination, progressHandler: progressHandler)
-                return
-            }
-        }
-
-        NSLog("[DecompressService] No ZIP/TAR.GZ signature matched for \(fileName), trying TAR.BR fallback")
-
-        do {
-            try tarBrStrategy.decompress(file: file, to: destination, progressHandler: progressHandler)
-            NSLog("[DecompressService] Using TAR.BR fallback for \(fileName)")
-            return
-        } catch {
-            let invalidArchiveError = createInvalidArchiveError(
-                fileName: fileName,
-                fileSize: fileSize,
-                underlyingError: error
-            )
-            NSLog("[DecompressService] \(invalidArchiveError.localizedDescription)")
-            throw invalidArchiveError
-        }
-    }
-
-    /**
-     * Extracts a compressed file to the destination directory (without progress tracking).
-     * @param file Path to the compressed file
-     * @param destination Path to the destination directory
-     * @throws Error if decompression fails or no valid strategy found
-     */
-    func unzip(file: String, to destination: String) throws {
-        try unzip(file: file, to: destination, progressHandler: { _ in })
-    }
-
-    /**
-     * Validates if a file matches one of the signature-based archive formats.
-     * @param file Path to the file to validate
-     * @return true if the file is valid for any strategy
-     */
-    func isValid(file: String) -> Bool {
-        for strategy in signatureStrategies {
-            if strategy.isValid(file: file) {
-                return true
-            }
-        }
-        NSLog("[DecompressService] No ZIP/TAR.GZ signature matched for file: \(file). TAR.BR is handled during extraction fallback.")
-        return false
-    }
-
-    private func createInvalidArchiveError(fileName: String, fileSize: UInt64, underlyingError: Error? = nil) -> NSError {
-        let errorMessage = """
-The downloaded bundle file is not a valid compressed archive: \(fileName) (\(fileSize) bytes)
-
-Supported formats:
-- ZIP archives (.zip)
-- GZIP compressed TAR archives (.tar.gz)
-- Brotli compressed TAR archives (.tar.br)
-"""
-
-        var userInfo: [String: Any] = [
-            NSLocalizedDescriptionKey: errorMessage
-        ]
-
-        if let underlyingError {
-            userInfo[NSUnderlyingErrorKey] = underlyingError
-        }
-
-        return NSError(
-            domain: "DecompressService",
-            code: 1,
-            userInfo: userInfo
-        )
-    }
-}

package/ios/HotUpdater/Internal/DecompressionStrategy.swift

@@ -1,22 +0,0 @@
-import Foundation
-
-/**
- * Protocol for decompression strategies
- */
-protocol DecompressionStrategy {
-    /**
-     * Validates if a file can be decompressed by this strategy
-     * @param file Path to the file to validate
-     * @return true if the file is valid for this strategy
-     */
-    func isValid(file: String) -> Bool
-
-    /**
-     * Decompresses a file to the destination directory
-     * @param file Path to the compressed file
-     * @param destination Path to the destination directory
-     * @param progressHandler Callback for progress updates (0.0 - 1.0)
-     * @throws Error if decompression fails
-     */
-    func decompress(file: String, to destination: String, progressHandler: @escaping (Double) -> Void) throws
-}