@onekeyfe/react-native-zip-archive 3.0.52 → 3.0.54

package/android/src/main/java/com/margelo/nitro/reactnativeziparchive/ReactNativeZipArchive.kt

@@ -38,16 +38,24 @@ class ReactNativeZipArchive : HybridReactNativeZipArchiveSpec() {
   override fun unzip(from: String, to: String): Promise<String> {
     return Promise.async {
       val destDir = File(to)
-      if (!destDir.exists()) destDir.mkdirs()
+      if (!destDir.exists() && !destDir.mkdirs()) {
+        throw Exception("Failed to create unzip destination: $to")
+      }
+      val canonicalDestDir = destDir.canonicalFile
 
       ZipInputStream(BufferedInputStream(FileInputStream(from))).use { zis ->
         var entry: ZipEntry? = zis.nextEntry
         while (entry != null) {
-          val outFile = File(destDir, entry.name)
+          val outFile = safeZipEntryFile(canonicalDestDir, entry)
           if (entry.isDirectory) {
-            outFile.mkdirs()
+            if (!outFile.exists() && !outFile.mkdirs()) {
+              throw Exception("Failed to create unzip directory: ${outFile.absolutePath}")
+            }
           } else {
-            outFile.parentFile?.mkdirs()
+            val parent = outFile.parentFile
+            if (parent != null && !parent.exists() && !parent.mkdirs()) {
+              throw Exception("Failed to create unzip directory: ${parent.absolutePath}")
+            }
             FileOutputStream(outFile).use { fos ->
               val buffer = ByteArray(BUFFER_SIZE)
               var len: Int
@@ -64,6 +72,15 @@ class ReactNativeZipArchive : HybridReactNativeZipArchiveSpec() {
     }
   }
 
+  private fun safeZipEntryFile(destDir: File, entry: ZipEntry): File {
+    val outFile = File(destDir, entry.name).canonicalFile
+    val destPath = destDir.path + File.separator
+    if (outFile.path != destDir.path && !outFile.path.startsWith(destPath)) {
+      throw Exception("Unsafe zip entry path: ${entry.name}")
+    }
+    return outFile
+  }
+
   override fun unzipWithPassword(from: String, to: String, password: String): Promise<String> {
     return Promise.async {
       // java.util.zip does not support password-protected zip extraction.

package/ios/ReactNativeZipArchive.swift

@@ -36,12 +36,14 @@ final class ReactNativeZipArchive: HybridReactNativeZipArchiveSpec {
       if success {
         return to
       }
-      throw NSError(
+      // Preserve the underlying NSError (domain + code) so callers can tell a
+      // corrupt archive apart from a wrong password or an I/O failure. Only fall
+      // back to the generic "ZipArchive" error when SSZipArchive reported failure
+      // without populating an error.
+      throw error ?? NSError(
         domain: "ZipArchive",
         code: -1,
-        userInfo: [
-          NSLocalizedDescriptionKey: error?.localizedDescription ?? "unable to unzip"
-        ]
+        userInfo: [NSLocalizedDescriptionKey: "unable to unzip"]
       )
     }
   }
@@ -64,7 +66,11 @@ final class ReactNativeZipArchive: HybridReactNativeZipArchiveSpec {
       if success {
         return to
       }
-      throw NSError(
+      // Preserve the underlying NSError (domain + code) so callers can tell a
+      // corrupt archive apart from a wrong password or an I/O failure. Only fall
+      // back to the generic "ZipArchive" error when SSZipArchive reported failure
+      // without populating an error.
+      throw error ?? NSError(
         domain: "ZipArchive",
         code: -1,
         userInfo: [NSLocalizedDescriptionKey: "unable to unzip"]
@@ -121,10 +127,13 @@ final class ReactNativeZipArchive: HybridReactNativeZipArchiveSpec {
       // NSErrorPointer because the return is unannotated/non-nullable).
       var error: NSError?
       let wantedFileSize = SSZipArchive.payloadSizeForArchive(atPath: path, error: &error)
-      if error == nil {
-        return wantedFileSize.doubleValue
+      if let error {
+        // Contract: return -1 on failure. Log the underlying error so a missing
+        // file can be told apart from a corrupt archive when investigating.
+        NSLog("[ZipArchive] getUncompressedSize failed for \(path): \(error)")
+        return -1
       }
-      return -1
+      return wantedFileSize.doubleValue
     }
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@onekeyfe/react-native-zip-archive",
-  "version": "3.0.52",
-  "description": "react-native-zip-archive TurboModule for OneKey",
+  "version": "3.0.54",
+  "description": "react-native-zip-archive Nitro HybridObject for OneKey",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",
   "exports": {