@onekeyfe/react-native-sni-connect 1.0.0 → 3.0.69

package/ios/SniConnectClient.swift

@@ -1,30 +1,34 @@
 import Foundation
+import UIKit
 import EMASCurl
 
 /// Core HTTPS client that enforces IP direct connection with SNI.
 final class SniConnectClient {
 
-  // Logging callback
-  var onLog: ((String, String) -> Void)?
-
   // Active requests tracking for cancellation support
   private var activeTasks: [String: Task<Response, Error>] = [:]
   private let tasksQueue = DispatchQueue(label: "com.onekey.sni.connect.tasks", attributes: .concurrent)
 
+  // Token for the memory-warning observer (block-based observers are not removed
+  // by `removeObserver(self)`, so the token must be retained and removed explicitly).
+  private var memoryWarningObserver: NSObjectProtocol?
+
   init() {
     // Register for memory warnings to clean cache
-    NotificationCenter.default.addObserver(
+    memoryWarningObserver = NotificationCenter.default.addObserver(
       forName: UIApplication.didReceiveMemoryWarningNotification,
       object: nil,
       queue: .main
-    ) { [weak self] _ in
-      self?.onLog?("warning", "Memory warning received, cleaning DNS cache")
+    ) { _ in
+      SniConnectLog.info("Memory warning received, cleaning DNS cache")
       DNSResolver.cleanExpiredEntries()
     }
   }
 
   deinit {
-    NotificationCenter.default.removeObserver(self)
+    if let observer = memoryWarningObserver {
+      NotificationCenter.default.removeObserver(observer)
+    }
   }
 
   struct RequestConfig {
@@ -164,8 +168,10 @@ final class SniConnectClient {
     curlConfig.enableBuiltInRedirection = true
     curlConfig.cacheEnabled = false
 
-    // Enable full certificate validation for security
-    // The certificate will be validated against the SNI hostname, not the IP
+    // Enable full certificate validation for security.
+    // The certificate is validated against the SNI hostname, not the IP, because
+    // the custom DNS resolver only overrides address resolution — libcurl keeps the
+    // original hostname for SNI and certificate CN/SAN matching.
     curlConfig.certificateValidationEnabled = true
     curlConfig.domainNameVerificationEnabled = true
     curlConfig.dnsResolver = DNSResolver.self
@@ -178,81 +184,53 @@ final class SniConnectClient {
     private static let queue = DispatchQueue(label: "com.onekey.sni.connect.dns", attributes: .concurrent)
     private static let cache = DNSCache()
 
-    /// LRU cache for DNS mappings with size limit and TTL support
-    private class DNSCache {
-      private struct CacheEntry {
+    /// Thread-safe hostname -> IP pin with TTL.
+    ///
+    /// LIMITATION: EMASCurl only exposes a process-global DNS resolver
+    /// (`setDNSResolver:`), which receives only the hostname. There is no
+    /// per-request DNS API, so the pin is keyed by hostname and the most recent
+    /// IP for a hostname wins. Concurrent requests to the SAME hostname targeting
+    /// DIFFERENT IPs are therefore not guaranteed to each hit their own IP. Normal
+    /// usage (one IP per hostname at a time) is unaffected.
+    private final class DNSCache {
+      private struct Entry {
         let ip: String
         let timestamp: TimeInterval
       }
 
-      private var storage: [String: CacheEntry] = [:]
-      private var accessOrder: [String] = []
-
-      // Maximum cache entries (100 as specified in requirements)
+      private var hostnameToEntry: [String: Entry] = [:]
       private let maxSize = 100
-      // TTL in seconds (5 minutes default)
-      private let ttl: TimeInterval = 300
+      private let ttl: TimeInterval = 300 // 5 minutes
 
       func get(_ domain: String) -> String? {
         let key = domain.lowercased()
-        guard let entry = storage[key] else { return nil }
-
-        // Check if entry has expired
-        let now = Date().timeIntervalSince1970
-        if now - entry.timestamp > ttl {
-          remove(key)
+        guard let entry = hostnameToEntry[key] else { return nil }
+        if Date().timeIntervalSince1970 - entry.timestamp > ttl {
           return nil
         }
-
-        // Update access order (LRU)
-        if let index = accessOrder.firstIndex(of: key) {
-          accessOrder.remove(at: index)
-        }
-        accessOrder.append(key)
-
         return entry.ip
       }
 
       func set(_ ip: String, for domain: String) {
         let key = domain.lowercased()
-
-        // Evict oldest entry if cache is full
-        if storage.count >= maxSize && storage[key] == nil {
-          if let oldest = accessOrder.first {
-            storage.removeValue(forKey: oldest)
-            accessOrder.removeFirst()
+        // Evict the oldest entry when at capacity (and this is a new host).
+        if hostnameToEntry.count >= maxSize && hostnameToEntry[key] == nil {
+          if let oldest = hostnameToEntry.min(by: { $0.value.timestamp < $1.value.timestamp })?.key {
+            hostnameToEntry.removeValue(forKey: oldest)
           }
         }
-
-        // Add or update entry
-        let entry = CacheEntry(ip: ip, timestamp: Date().timeIntervalSince1970)
-        storage[key] = entry
-
-        // Update access order
-        if let index = accessOrder.firstIndex(of: key) {
-          accessOrder.remove(at: index)
-        }
-        accessOrder.append(key)
-      }
-
-      func remove(_ domain: String) {
-        let key = domain.lowercased()
-        storage.removeValue(forKey: key)
-        if let index = accessOrder.firstIndex(of: key) {
-          accessOrder.remove(at: index)
-        }
+        hostnameToEntry[key] = Entry(ip: ip, timestamp: Date().timeIntervalSince1970)
       }
 
       func clear() {
-        storage.removeAll()
-        accessOrder.removeAll()
+        hostnameToEntry.removeAll()
       }
 
       func cleanExpired() {
         let now = Date().timeIntervalSince1970
-        let expiredKeys = storage.filter { now - $0.value.timestamp > ttl }.map { $0.key }
-        for key in expiredKeys {
-          remove(key)
+        let expired = hostnameToEntry.filter { now - $0.value.timestamp > ttl }.map { $0.key }
+        for key in expired {
+          hostnameToEntry.removeValue(forKey: key)
         }
       }
     }
@@ -289,19 +267,19 @@ final class SniConnectClient {
   /// Clear all DNS cache entries
   func clearDNSCache() {
     DNSResolver.clearCache()
-    onLog?("info", "DNS cache cleared")
+    SniConnectLog.info("DNS cache cleared")
   }
 
   /// Cancel a request by ID
   func cancelRequest(requestId: String) {
     tasksQueue.async(flags: .barrier) { [weak self] in
       guard let task = self?.activeTasks[requestId] else {
-        self?.onLog?("warning", "No active request found with ID: \(requestId)")
+        SniConnectLog.warn("No active request found with ID: \(requestId)")
         return
       }
       task.cancel()
       self?.activeTasks.removeValue(forKey: requestId)
-      self?.onLog?("info", "Request cancelled: \(requestId)")
+      SniConnectLog.info("Request cancelled: \(requestId)")
     }
   }
 
@@ -314,15 +292,14 @@ final class SniConnectClient {
         task.cancel()
       }
       self.activeTasks.removeAll()
-      self.onLog?("info", "Cancelled \(count) active requests")
+      SniConnectLog.info("Cancelled \(count) active requests")
     }
   }
 
-  /// Register an active task (synchronous for immediate registration)
+  /// Register an active task immediately after creation, before JS can cancel it.
   func registerTask(_ task: Task<Response, Error>, for requestId: String) {
     tasksQueue.sync(flags: .barrier) { [weak self] in
       self?.activeTasks[requestId] = task
-      self?.onLog?("info", "Registered request: \(requestId), total active: \(self?.activeTasks.count ?? 0)")
     }
   }
 
@@ -331,7 +308,6 @@ final class SniConnectClient {
     guard let requestId = requestId else { return }
     tasksQueue.async(flags: .barrier) { [weak self] in
       self?.activeTasks.removeValue(forKey: requestId)
-      self?.onLog?("info", "Unregistered request: \(requestId)")
     }
   }
 
@@ -343,12 +319,25 @@ final class SniConnectClient {
       unregisterTask(requestId: config.requestId)
     }
 
+    // Validate every caller-controlled field before it reaches the network layer.
+    let method: String
+    let normalizedPath: String
+    do {
+      try SniConnectValidation.validatePublicIP(config.ip)
+      try SniConnectValidation.validateHostname(config.hostname)
+      try SniConnectValidation.validateHeaders(config.headers)
+      method = try SniConnectValidation.normalizeMethod(config.method)
+      normalizedPath = try SniConnectValidation.normalizePath(config.path)
+    } catch {
+      throw SniConnectError.invalidConfig("\(error)")
+    }
+
     DNSResolver.setIP(config.ip, for: config.hostname)
 
-    let url = try Self.buildURL(hostname: config.hostname, path: config.path)
+    let url = try Self.buildURL(hostname: config.hostname, normalizedPath: normalizedPath)
 
     let mutableRequest = NSMutableURLRequest(url: url)
-    mutableRequest.httpMethod = config.method.uppercased()
+    mutableRequest.httpMethod = method
 
     // Convert milliseconds to seconds for timeout values
     let totalTimeoutSeconds = config.effectiveTotalTimeout / 1000.0
@@ -373,15 +362,15 @@ final class SniConnectClient {
       mutableRequest.httpBody = bodyData
     }
 
-    // Configure connection timeout for EMASCurl
-    EMASCurlProtocol.setConnectTimeoutInterval(connectTimeoutSeconds)
+    // Per-request connect timeout (avoids the process-global setter race).
+    EMASCurlProtocol.setConnectTimeoutIntervalFor(mutableRequest, connectTimeoutInterval: connectTimeoutSeconds)
     let request = mutableRequest as URLRequest
 
     do {
       let (data, response) = try await Self.urlSession.data(for: request)
       guard let httpResponse = response as? HTTPURLResponse else {
         let errorMsg = "Invalid HTTP response type"
-        onLog?("error", errorMsg)
+        SniConnectLog.error(errorMsg)
         throw SniConnectError.invalidConfig(errorMsg)
       }
 
@@ -390,11 +379,10 @@ final class SniConnectClient {
       let (headers, multiValueHeaders) = Self.extractHeaders(from: httpResponse)
       let statusText = HTTPURLResponse.localizedString(forStatusCode: status)
 
-      // Check for HTTP errors (4xx, 5xx)
+      // 4xx/5xx are returned to JS as a normal response (the caller inspects
+      // `status`); we only record it for diagnostics.
       if status >= 400 {
-        let error = SniConnectError.httpError(code: status, message: statusText)
-        onLog?("error", "HTTP error: \(error.message)")
-        // Still return the response for client to handle
+        SniConnectLog.warn("HTTP \(status) for \(config.hostname)")
       }
 
       return Response(
@@ -405,33 +393,33 @@ final class SniConnectClient {
         multiValueHeaders: multiValueHeaders
       )
     } catch let error as SniConnectError {
-      onLog?("error", "[\(error.code)] \(error.message)")
+      SniConnectLog.error("[\(error.code)] \(error.message)")
       throw error
     } catch {
       // Convert generic errors to specific SniConnectError types
       let sniError = SniConnectError.from(error)
-      onLog?("error", "[\(sniError.code)] \(sniError.message)")
+      SniConnectLog.error("[\(sniError.code)] \(sniError.message)")
       throw sniError
     }
   }
 
-  private static func buildURL(hostname: String, path: String) throws -> URL {
-    let trimmedPath = path.trimmingCharacters(in: .whitespacesAndNewlines)
-
-    if let url = URL(string: trimmedPath), url.scheme != nil {
-      return url
-    }
-
-    let normalizedPath: String
-    if trimmedPath.isEmpty {
-      normalizedPath = "/"
-    } else if trimmedPath.hasPrefix("/") {
-      normalizedPath = trimmedPath
+  /// Build the request URL. Always `https://<hostname><path>` on port 443 — the
+  /// path has already been validated as relative (no scheme/authority), so the
+  /// caller cannot override scheme, host or port.
+  private static func buildURL(hostname: String, normalizedPath: String) throws -> URL {
+    var components = URLComponents()
+    components.scheme = "https"
+    components.host = hostname
+    // `normalizedPath` is "/...optional?query". Split off the query so URLComponents
+    // percent-encodes each part correctly.
+    if let queryIndex = normalizedPath.firstIndex(of: "?") {
+      components.percentEncodedPath = String(normalizedPath[..<queryIndex])
+      let queryStart = normalizedPath.index(after: queryIndex)
+      components.percentEncodedQuery = String(normalizedPath[queryStart...])
     } else {
-      normalizedPath = "/" + trimmedPath
+      components.percentEncodedPath = normalizedPath
     }
-
-    guard let url = URL(string: "https://\(hostname)\(normalizedPath)") else {
+    guard let url = components.url else {
       throw SniConnectError.invalidURL
     }
     return url
@@ -439,7 +427,7 @@ final class SniConnectClient {
 
   private static func parseResponseData(_ data: Data) -> Any {
     guard !data.isEmpty else {
-      return [:]
+      return ""
     }
 
     if let jsonObject = try? JSONSerialization.jsonObject(with: data, options: []) {
@@ -476,13 +464,7 @@ final class SniConnectClient {
     for (key, values) in headerGroups {
       // For backward compatibility, single-value headers use the last value
       singleValueHeaders[key] = values.last
-
-      // Multi-value headers contain all values
-      if values.count > 1 {
-        multiValueHeaders[key] = values
-      } else {
-        multiValueHeaders[key] = values
-      }
+      multiValueHeaders[key] = values
     }
 
     return (singleValueHeaders, multiValueHeaders)

package/ios/SniConnectLog.swift

@@ -0,0 +1,29 @@
+import Foundation
+
+/// Lightweight logging wrapper that dynamically dispatches to OneKeyLog through
+/// the Objective-C runtime.
+///
+/// Using reflection (instead of `import ReactNativeNativeLogger`) keeps this
+/// TurboModule from hard-linking the nitro-based native-logger module. When
+/// OneKeyLog is unavailable the logs are silently dropped. Mirrors the Android
+/// `SniConnectLogger` and the existing `BTLogger` / `SBLLogger`.
+enum SniConnectLog {
+  private static let tag = "SniConnect"
+
+  // Swift classes are exposed to the ObjC runtime as `Module.ClassName`.
+  private static let logClass: AnyObject? =
+    (NSClassFromString("ReactNativeNativeLogger.OneKeyLog")
+      ?? NSClassFromString("OneKeyLog")) as AnyObject?
+
+  static func debug(_ message: String) { dispatch("debug::", message) }
+  static func info(_ message: String) { dispatch("info::", message) }
+  static func warn(_ message: String) { dispatch("warn::", message) }
+  static func error(_ message: String) { dispatch("error::", message) }
+
+  private static func dispatch(_ selectorName: String, _ message: String) {
+    guard let cls = logClass else { return }
+    let sel = NSSelectorFromString(selectorName)
+    guard cls.responds(to: sel) else { return }
+    _ = cls.perform(sel, with: tag, with: message)
+  }
+}

package/ios/SniConnectValidation.swift

@@ -0,0 +1,151 @@
+import Foundation
+
+/// Boundary validation/normalization for SNI request inputs.
+///
+/// The module connects to a caller-supplied IP while preserving the TLS SNI/Host
+/// of `hostname`. Because the connect target is caller-controlled, every field that
+/// reaches the network layer is validated here to prevent SSRF, scheme/host/port
+/// override, cleartext downgrade and CR/LF header injection.
+enum SniConnectValidation {
+
+  enum ValidationError: Error {
+    case invalidIP(String)
+    case forbiddenIP(String)
+    case invalidHostname(String)
+    case invalidMethod(String)
+    case invalidPath(String)
+    case invalidHeader(String)
+  }
+
+  /// HTTP methods the module is allowed to issue.
+  private static let allowedMethods: Set<String> = [
+    "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS",
+  ]
+
+  /// Validate and uppercase the HTTP method.
+  static func normalizeMethod(_ method: String) throws -> String {
+    let upper = method.trimmingCharacters(in: .whitespacesAndNewlines).uppercased()
+    guard allowedMethods.contains(upper) else {
+      throw ValidationError.invalidMethod(method)
+    }
+    return upper
+  }
+
+  /// Validate `hostname` as a DNS host (used for SNI, Host header and cert matching).
+  static func validateHostname(_ hostname: String) throws {
+    guard hostname.count <= 253, !hostname.isEmpty else {
+      throw ValidationError.invalidHostname(hostname)
+    }
+    // Labels: 1-63 chars, alphanumeric + hyphen, not starting/ending with hyphen.
+    let pattern = "^(?=.{1,253}$)([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(\\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$"
+    guard hostname.range(of: pattern, options: .regularExpression) != nil else {
+      throw ValidationError.invalidHostname(hostname)
+    }
+  }
+
+  /// Validate `path`: must be a relative path/query only. Reject absolute URLs
+  /// (scheme/authority), protocol-relative URLs and control characters so the
+  /// caller cannot override scheme/host/port or downgrade to cleartext.
+  static func normalizePath(_ path: String) throws -> String {
+    let trimmed = path.trimmingCharacters(in: .whitespacesAndNewlines)
+    if containsControlCharacters(trimmed) {
+      throw ValidationError.invalidPath(path)
+    }
+    // Reject anything that looks like it carries a scheme or authority.
+    if trimmed.contains("://") || trimmed.hasPrefix("//") {
+      throw ValidationError.invalidPath(path)
+    }
+    // A bare scheme like "javascript:..." has no "//"; reject any leading scheme.
+    if let schemeRange = trimmed.range(of: "^[A-Za-z][A-Za-z0-9+.-]*:", options: .regularExpression),
+       schemeRange.lowerBound == trimmed.startIndex {
+      throw ValidationError.invalidPath(path)
+    }
+    if trimmed.isEmpty { return "/" }
+    return trimmed.hasPrefix("/") ? trimmed : "/" + trimmed
+  }
+
+  /// Validate header names/values: reject CR/LF/control characters (header
+  /// injection) and the Host header (the module sets Host itself).
+  static func validateHeaders(_ headers: [String: String]) throws {
+    for (key, value) in headers {
+      if key.isEmpty || containsControlCharacters(key) || containsControlCharacters(value) {
+        throw ValidationError.invalidHeader(key)
+      }
+    }
+  }
+
+  static func containsControlCharacters(_ s: String) -> Bool {
+    return s.unicodeScalars.contains { $0.value < 0x20 || $0.value == 0x7F }
+  }
+
+  // MARK: - IP validation
+
+  /// Validate `ip` is a literal IPv4/IPv6 address (never a hostname) and routes
+  /// to a public/global-unicast destination. Rejects loopback, private,
+  /// link-local (incl. 169.254.169.254 metadata), CGNAT, multicast and reserved.
+  static func validatePublicIP(_ ip: String) throws {
+    if let v4 = parseIPv4(ip) {
+      if isForbiddenIPv4(v4) { throw ValidationError.forbiddenIP(ip) }
+      return
+    }
+    if let v6 = parseIPv6(ip) {
+      if isForbiddenIPv6(v6) { throw ValidationError.forbiddenIP(ip) }
+      return
+    }
+    throw ValidationError.invalidIP(ip)
+  }
+
+  private static func parseIPv4(_ ip: String) -> [UInt8]? {
+    var addr = in_addr()
+    guard ip.withCString({ inet_pton(AF_INET, $0, &addr) }) == 1 else { return nil }
+    let raw = addr.s_addr.bigEndian
+    return [
+      UInt8((raw >> 24) & 0xFF),
+      UInt8((raw >> 16) & 0xFF),
+      UInt8((raw >> 8) & 0xFF),
+      UInt8(raw & 0xFF),
+    ]
+  }
+
+  private static func parseIPv6(_ ip: String) -> [UInt8]? {
+    var addr = in6_addr()
+    guard ip.withCString({ inet_pton(AF_INET6, $0, &addr) }) == 1 else { return nil }
+    return withUnsafeBytes(of: &addr) { Array($0.bindMemory(to: UInt8.self)) }
+  }
+
+  private static func isForbiddenIPv4(_ b: [UInt8]) -> Bool {
+    let a = b[0], c = b[1], d = b[2]
+    if a == 0 { return true }                         // 0.0.0.0/8 "this network"
+    if a == 10 { return true }                        // 10/8 private
+    if a == 127 { return true }                       // 127/8 loopback
+    if a == 100 && (c & 0xC0) == 0x40 { return true }  // 100.64/10 CGNAT
+    if a == 169 && c == 254 { return true }           // 169.254/16 link-local + metadata
+    if a == 172 && c >= 16 && c <= 31 { return true }  // 172.16/12 private
+    if a == 192 && c == 168 { return true }           // 192.168/16 private
+    if a == 192 && c == 0 && d == 0 { return true }    // 192.0.0/24
+    if a == 192 && c == 0 && d == 2 { return true }    // 192.0.2/24 TEST-NET-1
+    if a == 198 && (c == 18 || c == 19) { return true } // 198.18/15 benchmarking
+    if a == 198 && c == 51 && d == 100 { return true } // 198.51.100/24 TEST-NET-2
+    if a == 203 && c == 0 && d == 113 { return true }  // 203.0.113/24 TEST-NET-3
+    if a >= 224 { return true }                       // 224/4 multicast + 240/4 reserved + broadcast
+    return false
+  }
+
+  private static func isForbiddenIPv6(_ b: [UInt8]) -> Bool {
+    // Unspecified ::
+    if b.allSatisfy({ $0 == 0 }) { return true }
+    // Loopback ::1
+    if b[0...14].allSatisfy({ $0 == 0 }) && b[15] == 1 { return true }
+    // Multicast ff00::/8
+    if b[0] == 0xFF { return true }
+    // Link-local fe80::/10
+    if b[0] == 0xFE && (b[1] & 0xC0) == 0x80 { return true }
+    // Unique local fc00::/7
+    if (b[0] & 0xFE) == 0xFC { return true }
+    // IPv4-mapped ::ffff:0:0/96 — validate the embedded IPv4
+    if b[0...9].allSatisfy({ $0 == 0 }) && b[10] == 0xFF && b[11] == 0xFF {
+      return isForbiddenIPv4([b[12], b[13], b[14], b[15]])
+    }
+    return false
+  }
+}

package/lib/module/index.js

@@ -1,21 +1,6 @@
 "use strict";
 
-import { NativeEventEmitter } from 'react-native';
 import NativeSniConnect from "./NativeSniConnect.js";
-
-// Log entry type definition
-
-// Create event emitter instance
-const eventEmitter = new NativeEventEmitter(NativeSniConnect);
-
-// Simple log subscription function
-export function subscribeToLogs(callback) {
-  const subscription = eventEmitter.addListener('SniConnectLog', log => {
-    // Type assertion since we know the structure
-    callback(log);
-  });
-  return () => subscription.remove();
-}
 export function request(config) {
   return NativeSniConnect.request(config);
 }

package/lib/typescript/src/NativeSniConnect.d.ts

@@ -30,21 +30,8 @@ export interface Spec extends TurboModule {
     clearDNSCache(): Promise<{
         success: boolean;
     }>;
-    addListener(eventType: string): void;
-    removeListeners(count: Int32): void;
 }
-export type SniConnectModule = Spec & {
-    request(config: SniConnectRequest): Promise<SniConnectResponse>;
-    cancelRequest(requestId: string): Promise<{
-        success: boolean;
-    }>;
-    cancelAllRequests(): Promise<{
-        success: boolean;
-    }>;
-    clearDNSCache(): Promise<{
-        success: boolean;
-    }>;
-};
+export type SniConnectModule = Spec;
 declare const NativeSniConnect: SniConnectModule;
 export default NativeSniConnect;
 //# sourceMappingURL=NativeSniConnect.d.ts.map

package/lib/typescript/src/index.d.ts

@@ -1,10 +1,4 @@
 import { type SniConnectRequest, type SniConnectResponse } from './NativeSniConnect';
-export type LogEntry = {
-    level: string;
-    message: string;
-    timestamp: number;
-};
-export declare function subscribeToLogs(callback: (log: LogEntry) => void): () => void;
 export declare function request(config: SniConnectRequest): Promise<SniConnectResponse>;
 export declare function cancelRequest(requestId: string): Promise<{
     success: boolean;