@onekeyfe/react-native-range-downloader 6.7.0-alpha.310 → 6.7.0-alpha.311

package/android/src/main/java/com/margelo/nitro/reactnativerangedownloader/ConcurrentRangeDownloader.kt

@@ -148,12 +148,15 @@ class ConcurrentRangeDownloader(
      * Fills [partialFilePath] completely with the resource at [url] using
      * concurrent ranges. See [Outcome]. Throws on a transient/IO error after
      * per-segment retries, leaving the segment files in place so a later attempt
-     * resumes.
+     * resumes. [maxTotalBytes] rejects a known oversized probe before workers
+     * or artifact writes; callers with unknown single-stream sizes enforce their
+     * own streaming limit.
      */
     fun download(
         url: String,
         partialFilePath: String,
         cancelHandle: CancelHandle? = null,
+        maxTotalBytes: Long = Long.MAX_VALUE,
         onProgress: (transferred: Long, total: Long) -> Unit,
     ): Outcome {
         val partialFile = File(partialFilePath)
@@ -168,6 +171,9 @@ class ConcurrentRangeDownloader(
         }
 
         val probe = probe(url) ?: return Outcome.FALLBACK
+        if (probe.totalSize > maxTotalBytes) {
+            throw SecurityException("Range download exceeds caller size limit")
+        }
         if (!probe.supportsRange || probe.totalSize < minConcurrentBytes) {
             log("concurrent: not eligible (supportsRange=${probe.supportsRange}, size=${probe.totalSize})")
             return Outcome.FALLBACK

package/android/src/test/java/com/margelo/nitro/reactnativerangedownloader/ConcurrentRangeDownloaderOcdsTest.kt

@@ -2,6 +2,9 @@ package com.margelo.nitro.reactnativerangedownloader
 
 import okhttp3.OkHttpClient
 import okhttp3.mockwebserver.MockWebServer
+import okhttp3.mockwebserver.Dispatcher
+import okhttp3.mockwebserver.MockResponse
+import okhttp3.mockwebserver.RecordedRequest
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
@@ -82,6 +85,52 @@ class ConcurrentRangeDownloaderOcdsTest {
     }
   }
 
+  @Test
+  fun oversizedProbedTotalRejectsBeforeRangeWorkers() {
+    val cap = content.size.toLong()
+    server = MockWebServer()
+    server.dispatcher = object : Dispatcher() {
+      override fun dispatch(request: RecordedRequest) = MockResponse()
+        .setResponseCode(206)
+        .addHeader("Content-Range", "bytes 0-0/${cap + 1}")
+        .setBody("x")
+    }
+    server.start()
+
+    val partial = partialPath()
+    val failure = runCatching {
+      newDownloader().download(
+        url = url(),
+        partialFilePath = partial,
+        maxTotalBytes = cap,
+        onProgress = { _, _ -> },
+      )
+    }.exceptionOrNull()
+
+    assertTrue("oversized total must reject", failure is SecurityException)
+    assertEquals("only the probe may reach the server", 1, server.requestCount)
+    assertEquals("bytes=0-0", server.takeRequest().getHeader("Range"))
+    assertNoArtifactsLeft(partial)
+  }
+
+  @Test
+  fun probedTotalAtLimitCanComplete() {
+    val fs = RangeFaultServer(content)
+    startServer(fs)
+
+    val partial = partialPath()
+    val outcome = newDownloader().download(
+      url = url(),
+      partialFilePath = partial,
+      maxTotalBytes = content.size.toLong(),
+      onProgress = { _, _ -> },
+    )
+
+    assertEquals(ConcurrentRangeDownloader.Outcome.COMPLETED, outcome)
+    assertEquals(content.size.toLong(), File(partial).length())
+    assertEquals(sha256(content), sha256(File(partial)))
+  }
+
   // ------------------------------------------------------------------------
   // OCDS-T1: drop one segment's connection mid-body a couple of times.
   //   Only that segment is re-fetched (retries stay in its own window); the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-range-downloader",
-  "version": "6.7.0-alpha.310",
+  "version": "6.7.0-alpha.311",
   "description": "react-native-range-downloader",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",