@onekeyfe/react-native-native-list 3.0.136 → 3.0.137

package/android/src/main/java/com/onekey/nativelist/NativeListModels.kt

@@ -2,6 +2,9 @@ package com.margelo.nitro.nativelist
 
 import org.json.JSONArray
 import org.json.JSONObject
+import java.nio.ByteBuffer
+import java.security.MessageDigest
+import java.util.Locale
 
 internal fun isNativeListRowPressEnabled(
   type: String,
@@ -22,6 +25,28 @@ internal fun isNativeListWholeRowInteractive(
   pressDisabled = pressDisabled,
 )
 
+// The image fallback-state cache is process-wide, so it is keyed by a digest of the request
+// identity instead of the raw headers, which can carry credentials such as Authorization.
+internal fun nativeListSourceFallbackStateKey(uri: String, headers: Map<String, String>): String? {
+  val trimmedUri = uri.trim().takeIf(String::isNotEmpty) ?: return null
+  val digest = MessageDigest.getInstance("SHA-256")
+  updateLengthPrefixed(digest, trimmedUri)
+  headers.entries
+    .map { it.key.lowercase(Locale.ROOT) to it.value }
+    .sortedWith(compareBy<Pair<String, String>>({ it.first }, { it.second }))
+    .forEach { (name, value) ->
+      updateLengthPrefixed(digest, name)
+      updateLengthPrefixed(digest, value)
+    }
+  return digest.digest().joinToString("") { "%02x".format(Locale.ROOT, it.toInt() and 0xff) }
+}
+
+private fun updateLengthPrefixed(digest: MessageDigest, value: String) {
+  val bytes = value.toByteArray(Charsets.UTF_8)
+  digest.update(ByteBuffer.allocate(Int.SIZE_BYTES).putInt(bytes.size).array())
+  digest.update(bytes)
+}
+
 internal data class NativeListItem(
   val key: String,
   val type: String,

package/android/src/main/java/com/onekey/nativelist/NativeListRowView.kt

@@ -3538,9 +3538,12 @@ internal class NativeListRowView(
   }
 
   private fun sourceFallbackStateKey(source: JSONObject): String? =
-    source.optString("uri").trim().takeIf(String::isNotEmpty)?.let { uri ->
-      "$uri\u0000${source.optJSONObject("headers")?.toString().orEmpty()}"
-    }
+    nativeListSourceFallbackStateKey(
+      uri = source.optString("uri"),
+      headers = source.optJSONObject("headers")?.let { headers ->
+        headers.keys().asSequence().associateWith { headers.optString(it) }
+      }.orEmpty(),
+    )
 
   private fun leadingImageLayout(
     index: Int,

package/android/src/test/java/com/margelo/nitro/nativelist/NativeListSourceFallbackStateKeyTest.kt

@@ -0,0 +1,43 @@
+package com.margelo.nitro.nativelist
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class NativeListSourceFallbackStateKeyTest {
+  private val uri = "https://example.com/token.png"
+
+  @Test
+  fun keyIsADigestThatDoesNotRetainHeaderValues() {
+    val key = nativeListSourceFallbackStateKey(uri, mapOf("Authorization" to "Bearer secret-token"))
+
+    assertTrue(key.orEmpty().matches(Regex("[0-9a-f]{64}")))
+    assertFalse(key.orEmpty().contains("secret-token"))
+  }
+
+  @Test
+  fun keyIgnoresHeaderOrderAndNameCase() {
+    assertEquals(
+      nativeListSourceFallbackStateKey(uri, linkedMapOf("Authorization" to "Bearer a", "X-Trace" to "1")),
+      nativeListSourceFallbackStateKey(uri, linkedMapOf("x-trace" to "1", "authorization" to "Bearer a")),
+    )
+  }
+
+  @Test
+  fun keyDistinguishesSourcesThatDifferOnlyByHeaders() {
+    val keys = listOf(
+      nativeListSourceFallbackStateKey(uri, emptyMap()),
+      nativeListSourceFallbackStateKey(uri, mapOf("Authorization" to "Bearer a")),
+      nativeListSourceFallbackStateKey(uri, mapOf("Authorization" to "Bearer b")),
+    )
+
+    assertEquals(keys.size, keys.toSet().size)
+  }
+
+  @Test
+  fun blankUriHasNoKey() {
+    assertNull(nativeListSourceFallbackStateKey("  ", mapOf("Authorization" to "Bearer a")))
+  }
+}

package/ios/NativeListCell.swift

@@ -1,6 +1,7 @@
 import Foundation
 // OneKey patch: preserve native font faces while enabling tabular number features.
 import CoreText
+import CryptoKit
 import OneKeyImage
 import UIKit
 
@@ -3694,15 +3695,21 @@ final class NativeListCell: UICollectionViewCell {
   private func sourceFallbackStateKey(_ source: [String: Any]) -> String? {
     let uri = source.string("uri").trimmingCharacters(in: .whitespacesAndNewlines)
     guard !uri.isEmpty else { return nil }
-    let headersJson: String
-    if let headers = source.dictionary("headers"),
-       JSONSerialization.isValidJSONObject(headers),
-       let data = try? JSONSerialization.data(withJSONObject: headers, options: [.sortedKeys]) {
-      headersJson = String(data: data, encoding: .utf8) ?? ""
-    } else {
-      headersJson = ""
+    // The fallback-state cache is process-wide, so key it by a digest of the request identity
+    // instead of retaining raw header values, which can carry credentials such as Authorization.
+    let headers = source.dictionary("headers") ?? [:]
+    let fields: [(name: String, value: String)] = headers.map { key, value in
+      (name: key.lowercased(), value: String(describing: value))
+    }
+    let sortedFields = fields.sorted { lhs, rhs in
+      lhs.name == rhs.name ? lhs.value < rhs.value : lhs.name < rhs.name
+    }
+    var canonicalValue = "\(uri.utf8.count):\(uri)"
+    for field in sortedFields {
+      canonicalValue += "\(field.name.utf8.count):\(field.name)\(field.value.utf8.count):\(field.value)"
     }
-    return "\(uri)\u{0}\(headersJson)"
+    let digest = SHA256.hash(data: Data(canonicalValue.utf8))
+    return digest.map { String(format: "%02x", $0) }.joined()
   }
 
   private func leadingConstraints(
@@ -4147,8 +4154,10 @@ final class NativeListCell: UICollectionViewCell {
       },
       onError: retryLimit == 0 ? handleError : { [weak self, weak imageView] in
         guard let self, self.bindingEpoch == expectedEpoch, let imageView else { return }
-        guard retryAttempt < retryLimit else { handleError?(); return }
-        guard self.selectorImageRetries[imageID] == nil else { return }
+        // Report every failed attempt: a rebind during the retry delay cancels the pending retry,
+        // so deferring to the last attempt would never record the source fallback state.
+        handleError?()
+        guard retryAttempt < retryLimit, self.selectorImageRetries[imageID] == nil else { return }
         let retry = DispatchWorkItem { [weak self, weak imageView] in
           guard let self, self.bindingEpoch == expectedEpoch, let imageView else { return }
           self.selectorImageRetries.removeValue(forKey: imageID)

package/lib/module/web/NativeListWebEngine.js

@@ -537,8 +537,10 @@ export const WEB_LIST_CSS = `
 .ok-native-list-account-row[data-native-list-selector="accountSelector"]>.ok-native-list-accessories[data-native-list-account-control="createAddress"]{position:absolute;top:18px;right:12px}
 .ok-native-list-account-row[data-native-list-selector="accountSelector"] .ok-native-list-accessories>[data-native-list-account-control="createAddress"]{flex-basis:36px;width:36px;height:36px;padding:6px;border-radius:8px}
 .ok-native-list-account-action-row{padding-left:12px;padding-right:12px}.ok-native-list-account-action-row .ok-native-list-action-title{font-size:16px;line-height:24px;font-weight:400}.ok-native-list-account-action-row .ok-native-list-action-title[data-tone="primary"]{color:var(--nl-primary)}
-/* OneKey patch: account selector wallets and accounts keep the default cursor instead of pointer or grab affordances. */
-.ok-native-list-root .ok-native-list-item>.ok-native-list-wallet-row,.ok-native-list-root .ok-native-list-wallet-member>.ok-native-list-wallet-row,.ok-native-list-root .ok-native-list-item>.ok-native-list-account-row,.ok-native-list-root .ok-native-list-item>.ok-native-list-account-action-row,.ok-native-list-wallet-member,.ok-native-list-wallet-row *,.ok-native-list-account-row *,.ok-native-list-account-action-row *{cursor:default}
+/* OneKey patch: account selector wallets and accounts keep the default cursor instead of pointer or grab affordances.
+   Only the row surface is matched: cursor inherits, so plain children follow the row, while icon buttons,
+   checkboxes, and action buttons keep advertising themselves with their own pointer cursor. */
+.ok-native-list-root .ok-native-list-item>.ok-native-list-wallet-row,.ok-native-list-root .ok-native-list-wallet-member>.ok-native-list-wallet-row,.ok-native-list-root .ok-native-list-item>.ok-native-list-account-row,.ok-native-list-root .ok-native-list-item>.ok-native-list-account-action-row,.ok-native-list-wallet-member{cursor:default}
 /* OneKey patch: Add account hover and pressed backgrounds keep the account row corner radius. */
 .ok-native-list-account-action-row{border-radius:12px}
 `;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-native-list",
-  "version": "3.0.136",
+  "version": "3.0.137",
   "description": "Template-driven native RecyclerView and UICollectionView for React Native",
   "source": "./src/index.ts",
   "main": "./lib/module/index.js",
@@ -83,8 +83,8 @@
     "typescript": "^5.9.2"
   },
   "peerDependencies": {
-    "@onekeyfe/react-native-image": "3.0.136",
-    "@onekeyfe/react-native-native-logger": "3.0.136",
+    "@onekeyfe/react-native-image": "3.0.137",
+    "@onekeyfe/react-native-native-logger": "3.0.137",
     "react": "*",
     "react-native": "*",
     "react-native-nitro-modules": "0.37.0"

package/src/web/NativeListWebEngine.ts

@@ -965,8 +965,10 @@ export const WEB_LIST_CSS = `
 .ok-native-list-account-row[data-native-list-selector="accountSelector"]>.ok-native-list-accessories[data-native-list-account-control="createAddress"]{position:absolute;top:18px;right:12px}
 .ok-native-list-account-row[data-native-list-selector="accountSelector"] .ok-native-list-accessories>[data-native-list-account-control="createAddress"]{flex-basis:36px;width:36px;height:36px;padding:6px;border-radius:8px}
 .ok-native-list-account-action-row{padding-left:12px;padding-right:12px}.ok-native-list-account-action-row .ok-native-list-action-title{font-size:16px;line-height:24px;font-weight:400}.ok-native-list-account-action-row .ok-native-list-action-title[data-tone="primary"]{color:var(--nl-primary)}
-/* OneKey patch: account selector wallets and accounts keep the default cursor instead of pointer or grab affordances. */
-.ok-native-list-root .ok-native-list-item>.ok-native-list-wallet-row,.ok-native-list-root .ok-native-list-wallet-member>.ok-native-list-wallet-row,.ok-native-list-root .ok-native-list-item>.ok-native-list-account-row,.ok-native-list-root .ok-native-list-item>.ok-native-list-account-action-row,.ok-native-list-wallet-member,.ok-native-list-wallet-row *,.ok-native-list-account-row *,.ok-native-list-account-action-row *{cursor:default}
+/* OneKey patch: account selector wallets and accounts keep the default cursor instead of pointer or grab affordances.
+   Only the row surface is matched: cursor inherits, so plain children follow the row, while icon buttons,
+   checkboxes, and action buttons keep advertising themselves with their own pointer cursor. */
+.ok-native-list-root .ok-native-list-item>.ok-native-list-wallet-row,.ok-native-list-root .ok-native-list-wallet-member>.ok-native-list-wallet-row,.ok-native-list-root .ok-native-list-item>.ok-native-list-account-row,.ok-native-list-root .ok-native-list-item>.ok-native-list-account-action-row,.ok-native-list-wallet-member{cursor:default}
 /* OneKey patch: Add account hover and pressed backgrounds keep the account row corner radius. */
 .ok-native-list-account-action-row{border-radius:12px}
 `;