@hot-updater/react-native 1.0.0-rc.14 → 1.0.0-rc.16

package/android/src/main/java/com/hotupdater/TarBrDecompressionStrategy.kt

@@ -1,117 +0,0 @@
-package com.hotupdater
-
-import android.util.Log
-import com.hotupdater.vendor.brotli.dec.BrotliInputStream
-import java.io.BufferedInputStream
-import java.io.File
-import java.io.FileInputStream
-import java.io.FileOutputStream
-
-/**
- * Strategy for handling TAR+Brotli compressed files
- * Uses native Brotli decoder and custom TAR parser
- */
-class TarBrDecompressionStrategy : DecompressionStrategy {
-    companion object {
-        private const val TAG = "TarBrStrategy"
-        private const val MIN_FILE_SIZE = 10L
-    }
-
-    override fun isValid(filePath: String): Boolean {
-        val file = File(filePath)
-
-        if (!file.exists() || file.length() < MIN_FILE_SIZE) {
-            Log.d(TAG, "Invalid file: doesn't exist or too small (${file.length()} bytes)")
-            return false
-        }
-
-        return try {
-            FileInputStream(file).use { fileInputStream ->
-                BufferedInputStream(fileInputStream).use { bufferedInputStream ->
-                    BrotliInputStream(bufferedInputStream).use { brotliInputStream ->
-                        TarArchiveInputStream(brotliInputStream).use { tarInputStream ->
-                            val firstEntry = tarInputStream.getNextEntry()
-                            val isValid = firstEntry != null
-
-                            if (!isValid) {
-                                Log.d(TAG, "Invalid file: tar archive has no entries")
-                            }
-
-                            isValid
-                        }
-                    }
-                }
-            }
-        } catch (e: Exception) {
-            Log.d(TAG, "Invalid file: Brotli/TAR validation failed - ${e.message}")
-            false
-        }
-    }
-
-    override fun decompress(
-        filePath: String,
-        destinationPath: String,
-        progressCallback: (Double) -> Unit,
-    ): Boolean =
-        try {
-            val destinationDir = File(destinationPath)
-            if (!destinationDir.exists()) {
-                destinationDir.mkdirs()
-            }
-
-            val sourceFile = File(filePath)
-            val totalSize = sourceFile.length()
-            var processedBytes = 0L
-
-            Log.d(TAG, "Extracting tar.br file: $filePath")
-
-            FileInputStream(filePath).use { fileInputStream ->
-                BufferedInputStream(fileInputStream).use { bufferedInputStream ->
-                    BrotliInputStream(bufferedInputStream).use { brotliInputStream ->
-                        TarArchiveInputStream(brotliInputStream).use { tarInputStream ->
-                            var entry = tarInputStream.getNextEntry()
-
-                            while (entry != null) {
-                                val file = RelativePathResolver.resolveInside(destinationDir, entry.name)
-
-                                if (file == null) {
-                                    Log.w(TAG, "Skipping potentially malicious tar entry: ${entry.name}")
-                                    entry = tarInputStream.getNextEntry()
-                                    continue
-                                }
-
-                                if (entry.isDirectory) {
-                                    file.mkdirs()
-                                } else {
-                                    file.parentFile?.mkdirs()
-
-                                    FileOutputStream(file).use { output ->
-                                        val buffer = ByteArray(8 * 1024)
-                                        var bytesRead: Int
-
-                                        while (tarInputStream.read(buffer).also { bytesRead = it } != -1) {
-                                            output.write(buffer, 0, bytesRead)
-                                            processedBytes += bytesRead
-                                        }
-                                    }
-                                }
-
-                                val progress = processedBytes.toDouble() / (totalSize * 2.0)
-                                progressCallback.invoke(progress.coerceIn(0.0, 1.0))
-
-                                entry = tarInputStream.getNextEntry()
-                            }
-                        }
-                    }
-                }
-            }
-
-            Log.d(TAG, "Successfully extracted tar.br file")
-            progressCallback.invoke(1.0)
-            true
-        } catch (e: Exception) {
-            Log.d(TAG, "Failed to extract tar.br file: ${e.message}")
-            e.printStackTrace()
-            false
-        }
-}

package/android/src/main/java/com/hotupdater/TarGzDecompressionStrategy.kt

@@ -1,117 +0,0 @@
-package com.hotupdater
-
-import android.util.Log
-import java.io.BufferedInputStream
-import java.io.File
-import java.io.FileInputStream
-import java.io.FileOutputStream
-import java.util.zip.GZIPInputStream
-
-/**
- * Strategy for handling TAR+GZIP compressed files
- * Uses native GZIP decoder and custom TAR parser
- */
-class TarGzDecompressionStrategy : DecompressionStrategy {
-    companion object {
-        private const val TAG = "TarGzStrategy"
-        private const val MIN_FILE_SIZE = 10L
-    }
-
-    override fun isValid(filePath: String): Boolean {
-        val file = File(filePath)
-
-        if (!file.exists() || file.length() < MIN_FILE_SIZE) {
-            Log.d(TAG, "Invalid file: doesn't exist or too small (${file.length()} bytes)")
-            return false
-        }
-
-        try {
-            FileInputStream(file).use { fis ->
-                val header = ByteArray(2)
-                if (fis.read(header) != 2) {
-                    Log.d(TAG, "Invalid file: cannot read header")
-                    return false
-                }
-
-                // Check GZIP magic bytes (0x1F 0x8B)
-                val isGzip = header[0] == 0x1F.toByte() && header[1] == 0x8B.toByte()
-                if (!isGzip) {
-                    Log.d(
-                        TAG,
-                        "Invalid file: wrong magic bytes (expected 0x1F 0x8B, got 0x${header[0].toString(16)} 0x${header[1].toString(16)})",
-                    )
-                }
-                return isGzip
-            }
-        } catch (e: Exception) {
-            Log.d(TAG, "Invalid file: error reading header: ${e.message}")
-            return false
-        }
-    }
-
-    override fun decompress(
-        filePath: String,
-        destinationPath: String,
-        progressCallback: (Double) -> Unit,
-    ): Boolean =
-        try {
-            val destinationDir = File(destinationPath)
-            if (!destinationDir.exists()) {
-                destinationDir.mkdirs()
-            }
-
-            val sourceFile = File(filePath)
-            val totalSize = sourceFile.length()
-            var processedBytes = 0L
-
-            Log.d(TAG, "Extracting tar.gz file: $filePath")
-
-            FileInputStream(filePath).use { fileInputStream ->
-                BufferedInputStream(fileInputStream).use { bufferedInputStream ->
-                    GZIPInputStream(bufferedInputStream).use { gzipInputStream ->
-                        TarArchiveInputStream(gzipInputStream).use { tarInputStream ->
-                            var entry = tarInputStream.getNextEntry()
-
-                            while (entry != null) {
-                                val file = RelativePathResolver.resolveInside(destinationDir, entry.name)
-
-                                if (file == null) {
-                                    Log.w(TAG, "Skipping potentially malicious tar entry: ${entry.name}")
-                                    entry = tarInputStream.getNextEntry()
-                                    continue
-                                }
-
-                                if (entry.isDirectory) {
-                                    file.mkdirs()
-                                } else {
-                                    file.parentFile?.mkdirs()
-
-                                    FileOutputStream(file).use { output ->
-                                        val buffer = ByteArray(8 * 1024)
-                                        var bytesRead: Int
-
-                                        while (tarInputStream.read(buffer).also { bytesRead = it } != -1) {
-                                            output.write(buffer, 0, bytesRead)
-                                            processedBytes += bytesRead
-                                        }
-                                    }
-                                }
-
-                                val progress = processedBytes.toDouble() / (totalSize * 2.0)
-                                progressCallback.invoke(progress.coerceIn(0.0, 1.0))
-
-                                entry = tarInputStream.getNextEntry()
-                            }
-                        }
-                    }
-                }
-            }
-
-            Log.d(TAG, "Successfully extracted tar.gz file")
-            progressCallback.invoke(1.0)
-            true
-        } catch (e: Exception) {
-            Log.e(TAG, "Error extracting tar.gz file: ${e.message}", e)
-            false
-        }
-}

package/android/src/main/java/com/hotupdater/ZipDecompressionStrategy.kt

@@ -1,192 +0,0 @@
-package com.hotupdater
-
-import android.util.Log
-import java.io.BufferedInputStream
-import java.io.File
-import java.io.FileInputStream
-import java.io.FileOutputStream
-import java.io.IOException
-import java.util.zip.CRC32
-import java.util.zip.ZipEntry
-import java.util.zip.ZipException
-import java.util.zip.ZipFile
-import java.util.zip.ZipInputStream
-
-/**
- * Strategy for handling ZIP compressed files
- */
-class ZipDecompressionStrategy : DecompressionStrategy {
-    companion object {
-        private const val TAG = "ZipStrategy"
-        private const val MIN_ZIP_SIZE = 22L
-    }
-
-    override fun isValid(filePath: String): Boolean {
-        val file = File(filePath)
-
-        if (!file.exists() || file.length() < MIN_ZIP_SIZE) {
-            Log.d(TAG, "Invalid ZIP: file doesn't exist or too small (${file.length()} bytes)")
-            return false
-        }
-
-        try {
-            FileInputStream(file).use { fis ->
-                val header = ByteArray(4)
-                if (fis.read(header) != 4) {
-                    Log.d(TAG, "Invalid ZIP: cannot read header")
-                    return false
-                }
-
-                // ZIP magic bytes: 0x50 0x4B 0x03 0x04 ("PK\u0003\u0004")
-                val expectedMagic = byteArrayOf(0x50.toByte(), 0x4B.toByte(), 0x03.toByte(), 0x04.toByte())
-
-                if (!header.contentEquals(expectedMagic)) {
-                    val headerHex = header.joinToString(" ") { "0x%02X".format(it) }
-                    Log.d(TAG, "Invalid ZIP: wrong magic bytes (expected 0x50 0x4B 0x03 0x04, got $headerHex)")
-                    return false
-                }
-            }
-        } catch (e: Exception) {
-            Log.d(TAG, "Invalid ZIP: error reading file: ${e.message}")
-            return false
-        }
-
-        try {
-            ZipFile(file).use { zipFile ->
-                val entries = zipFile.entries()
-                if (!entries.hasMoreElements()) {
-                    Log.d(TAG, "Invalid ZIP: no entries found")
-                    return false
-                }
-
-                val firstEntry = entries.nextElement()
-                zipFile.getInputStream(firstEntry).use { stream ->
-                    val buffer = ByteArray(1024)
-                    stream.read(buffer)
-                }
-            }
-            return true
-        } catch (e: ZipException) {
-            Log.d(TAG, "Invalid ZIP: ZIP structure error: ${e.message}")
-            return false
-        } catch (e: Exception) {
-            Log.d(TAG, "Invalid ZIP: validation error: ${e.message}")
-            return false
-        }
-    }
-
-    override fun decompress(
-        filePath: String,
-        destinationPath: String,
-        progressCallback: (Double) -> Unit,
-    ): Boolean {
-        return try {
-            val destinationDir = File(destinationPath)
-            if (!destinationDir.exists()) {
-                destinationDir.mkdirs()
-            }
-
-            // Calculate total bytes to extract for accurate progress reporting
-            val totalBytes =
-                try {
-                    ZipFile(File(filePath)).use { zipFile ->
-                        zipFile
-                            .entries()
-                            .asSequence()
-                            .filter { !it.isDirectory }
-                            .sumOf { it.size }
-                    }
-                } catch (e: Exception) {
-                    Log.d(TAG, "Failed to calculate total bytes: ${e.message}")
-                    0L
-                }
-
-            if (totalBytes == 0L) {
-                Log.d(TAG, "No content found in ZIP")
-                return false
-            }
-
-            Log.d(TAG, "Extracting $totalBytes bytes from ZIP")
-
-            var extractedFileCount = 0
-            var extractedBytes = 0L
-            var lastReportedProgress = 0.0
-
-            FileInputStream(filePath).use { fileInputStream ->
-                BufferedInputStream(fileInputStream).use { bufferedInputStream ->
-                    ZipInputStream(bufferedInputStream).use { zipInputStream ->
-                        var entry: ZipEntry? = zipInputStream.nextEntry
-                        while (entry != null) {
-                            val file =
-                                try {
-                                    RelativePathResolver.resolveInside(destinationDir, entry.name)
-                                } catch (e: IOException) {
-                                    Log.w(TAG, "Failed to resolve canonical path for zip entry: ${entry.name}", e)
-                                    null
-                                }
-
-                            if (file == null) {
-                                Log.w(TAG, "Skipping potentially malicious zip entry: ${entry.name}")
-                                entry = zipInputStream.nextEntry
-                                continue
-                            }
-
-                            if (entry.isDirectory) {
-                                file.mkdirs()
-                            } else {
-                                file.parentFile?.mkdirs()
-
-                                val crc = CRC32()
-                                FileOutputStream(file).use { output ->
-                                    val buffer = ByteArray(8 * 1024)
-                                    var bytesRead: Int
-
-                                    while (zipInputStream.read(buffer).also { bytesRead = it } != -1) {
-                                        output.write(buffer, 0, bytesRead)
-                                        crc.update(buffer, 0, bytesRead)
-
-                                        // Track bytes written for byte-based progress
-                                        extractedBytes += bytesRead
-
-                                        // Report progress more frequently (every 1%)
-                                        val currentProgress = extractedBytes.toDouble() / totalBytes
-                                        if (currentProgress - lastReportedProgress >= 0.01) {
-                                            progressCallback.invoke(currentProgress)
-                                            lastReportedProgress = currentProgress
-                                        }
-                                    }
-                                }
-
-                                if (entry.crc != -1L && crc.value != entry.crc) {
-                                    Log.w(TAG, "CRC mismatch for ${entry.name}: expected ${entry.crc}, got ${crc.value}")
-                                    file.delete()
-                                    return false
-                                }
-
-                                extractedFileCount++
-                            }
-
-                            zipInputStream.closeEntry()
-                            entry = zipInputStream.nextEntry
-                        }
-                    }
-                }
-            }
-
-            if (extractedFileCount == 0) {
-                Log.d(TAG, "No files extracted from ZIP")
-                return false
-            }
-
-            Log.d(TAG, "Successfully extracted $extractedFileCount files ($extractedBytes bytes)")
-            progressCallback.invoke(1.0)
-            true
-        } catch (e: ZipException) {
-            Log.d(TAG, "ZIP extraction failed: ${e.message}")
-            false
-        } catch (e: Exception) {
-            Log.d(TAG, "Failed to unzip file: ${e.message}")
-            false
-        }
-    }
-}

package/android/src/test/java/com/hotupdater/TarArchiveInputStreamTest.kt

@@ -1,68 +0,0 @@
-package com.hotupdater
-
-import org.apache.commons.compress.archivers.tar.TarArchiveOutputStream
-import org.junit.Assert.assertArrayEquals
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertThrows
-import org.junit.Test
-import java.io.ByteArrayInputStream
-import java.io.ByteArrayOutputStream
-import org.apache.commons.compress.archivers.tar.TarArchiveEntry as CommonsTarArchiveEntry
-
-class TarArchiveInputStreamTest {
-    @Test
-    fun `reads a long basename from a POSIX PAX header`() {
-        val path = "raw/${"long-name-".repeat(14)}asset.bmp"
-        val contents = "pax asset".toByteArray()
-        val archive = createPaxArchive(path, contents)
-
-        TarArchiveInputStream(ByteArrayInputStream(archive)).use { tar ->
-            val entry = tar.getNextEntry()
-
-            assertEquals(path, entry?.name)
-            assertArrayEquals(contents, tar.readBytes())
-            assertNull(tar.getNextEntry())
-        }
-    }
-
-    @Test
-    fun `rejects path traversal from a POSIX PAX header`() {
-        val path = "../${"long-name-".repeat(14)}asset.bmp"
-        val archive =
-            createPaxArchive(
-                path = path,
-                contents = "malicious".toByteArray(),
-                headerPath = "safe.bmp",
-            )
-
-        val error =
-            assertThrows(SecurityException::class.java) {
-                TarArchiveInputStream(ByteArrayInputStream(archive)).use { tar ->
-                    tar.getNextEntry()
-                }
-            }
-
-        assertEquals("Path traversal detected: $path", error.message)
-    }
-
-    private fun createPaxArchive(
-        path: String,
-        contents: ByteArray,
-        headerPath: String = path,
-    ): ByteArray {
-        val output = ByteArrayOutputStream()
-        TarArchiveOutputStream(output).use { tar ->
-            tar.setLongFileMode(TarArchiveOutputStream.LONGFILE_POSIX)
-            val entry =
-                CommonsTarArchiveEntry(headerPath).apply {
-                    size = contents.size.toLong()
-                    if (path != headerPath) addPaxHeader("path", path)
-                }
-            tar.putArchiveEntry(entry)
-            tar.write(contents)
-            tar.closeArchiveEntry()
-        }
-        return output.toByteArray()
-    }
-}

package/ios/HotUpdater/Internal/ArchiveExtractionUtilities.swift

@@ -1,178 +0,0 @@
-import Foundation
-
-enum ArchiveExtractionUtilities {
-    static let bufferSize = 64 * 1024
-
-    static func readUpToCount(from handle: FileHandle, count: Int) throws -> Data? {
-        guard count >= 0 else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 5,
-                userInfo: [NSLocalizedDescriptionKey: "Invalid read size: \(count)"]
-            )
-        }
-
-        if count == 0 {
-            return Data()
-        }
-
-        if #available(macOS 10.15.4, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
-            return try handle.read(upToCount: count)
-        }
-
-        return handle.readData(ofLength: count)
-    }
-
-    static func readExactly(from handle: FileHandle, count: Int) throws -> Data {
-        guard count >= 0 else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 1,
-                userInfo: [NSLocalizedDescriptionKey: "Invalid read size: \(count)"]
-            )
-        }
-
-        if count == 0 {
-            return Data()
-        }
-
-        guard let data = try readUpToCount(from: handle, count: count), data.count == count else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 2,
-                userInfo: [NSLocalizedDescriptionKey: "Unexpected end of archive while reading \(count) bytes"]
-            )
-        }
-
-        return data
-    }
-
-    static func currentOffset(for handle: FileHandle) -> UInt64 {
-        if #available(macOS 10.15.4, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
-            return (try? handle.offset()) ?? 0
-        }
-
-        return handle.offsetInFile
-    }
-
-    static func seek(_ handle: FileHandle, to offset: UInt64) throws {
-        if #available(macOS 10.15.4, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
-            try handle.seek(toOffset: offset)
-            return
-        }
-
-        handle.seek(toFileOffset: offset)
-    }
-
-    static func skipBytes(_ byteCount: UInt64, in handle: FileHandle) throws {
-        guard byteCount > 0 else {
-            return
-        }
-
-        let offset = currentOffset(for: handle)
-        let (targetOffset, overflowed) = offset.addingReportingOverflow(byteCount)
-
-        guard !overflowed else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 6,
-                userInfo: [NSLocalizedDescriptionKey: "Archive offset overflow while skipping \(byteCount) bytes from offset \(offset)"]
-            )
-        }
-
-        try seek(handle, to: targetOffset)
-    }
-
-    static func normalizedRelativePath(from rawPath: String) -> String? {
-        let candidate = rawPath.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !candidate.isEmpty,
-              !candidate.contains("\0"),
-              !candidate.contains("\\"),
-              !candidate.hasPrefix("/"),
-              candidate.range(of: #"^[A-Za-z]:"#, options: .regularExpression) == nil
-        else {
-            return nil
-        }
-
-        let components = candidate
-            .split(separator: "/")
-            .map(String.init)
-
-        guard !components.isEmpty else {
-            return nil
-        }
-
-        guard components.count == candidate.split(separator: "/", omittingEmptySubsequences: false).count,
-              !components.contains(".."),
-              !components.contains(".") else {
-            return nil
-        }
-
-        return components.joined(separator: "/")
-    }
-
-    static func extractionURL(for relativePath: String, destinationRoot: String) throws -> URL {
-        let rootURL = URL(fileURLWithPath: destinationRoot, isDirectory: true)
-        let targetURL = rootURL.appendingPathComponent(relativePath)
-        let standardizedRoot = rootURL.standardizedFileURL.path
-        let standardizedTarget = targetURL.standardizedFileURL.path
-
-        guard standardizedTarget == standardizedRoot ||
-                standardizedTarget.hasPrefix(standardizedRoot + "/") else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 3,
-                userInfo: [NSLocalizedDescriptionKey: "Path traversal attempt detected: \(relativePath)"]
-            )
-        }
-
-        return targetURL
-    }
-
-    static func ensureDirectory(at url: URL, fileManager: FileManager = .default) throws {
-        var isDirectory = ObjCBool(false)
-        if fileManager.fileExists(atPath: url.path, isDirectory: &isDirectory) {
-            if isDirectory.boolValue {
-                return
-            }
-
-            try fileManager.removeItem(at: url)
-        }
-
-        try fileManager.createDirectory(at: url, withIntermediateDirectories: true, attributes: nil)
-    }
-
-    static func createOutputFile(at url: URL, fileManager: FileManager = .default) throws -> FileHandle {
-        try ensureDirectory(at: url.deletingLastPathComponent(), fileManager: fileManager)
-
-        if fileManager.fileExists(atPath: url.path) {
-            try fileManager.removeItem(at: url)
-        }
-
-        guard fileManager.createFile(atPath: url.path, contents: nil) else {
-            throw NSError(
-                domain: "ArchiveExtractionUtilities",
-                code: 4,
-                userInfo: [NSLocalizedDescriptionKey: "Failed to create output file at \(url.path)"]
-            )
-        }
-
-        return try FileHandle(forWritingTo: url)
-    }
-}
-
-extension Data {
-    func archiveUInt16LE(at offset: Int) -> UInt16 {
-        let byte0 = UInt16(self[offset])
-        let byte1 = UInt16(self[offset + 1]) << 8
-        return byte0 | byte1
-    }
-
-    func archiveUInt32LE(at offset: Int) -> UInt32 {
-        let byte0 = UInt32(self[offset])
-        let byte1 = UInt32(self[offset + 1]) << 8
-        let byte2 = UInt32(self[offset + 2]) << 16
-        let byte3 = UInt32(self[offset + 3]) << 24
-        return byte0 | byte1 | byte2 | byte3
-    }
-}