@otakit/capacitor-updater 2.3.0 → 2.3.2

package/Package.swift

@@ -22,6 +22,13 @@ let package = Package(
                 .product(name: "ZIPFoundation", package: "ZIPFoundation")
             ],
             path: "ios/Sources/UpdaterPlugin",
-            exclude: ["UpdaterPlugin.m"])
+            exclude: ["UpdaterPlugin.m"]),
+        .testTarget(
+            name: "UpdaterPluginTests",
+            dependencies: [
+                "UpdaterPlugin",
+                .product(name: "ZIPFoundation", package: "ZIPFoundation")
+            ],
+            path: "ios/Tests/UpdaterPluginTests")
     ]
 )

package/README.md

@@ -162,6 +162,11 @@ If a bundle is applied and never calls `notifyAppReady()`:
 The last failed applied bundle is persisted so the plugin does not immediately
 download and apply the same broken release again.
 
+On top of this per-device rollback, a release published with the auto-revert
+flag is reverted fleet-wide by the server when too many devices report
+rollbacks within a 24-hour window, so remaining devices never download the
+broken bundle.
+
 ## Automatic flow
 
 For the normal hosted path, most apps only need:

package/android/src/main/java/com/otakit/updater/ZipUtils.java

@@ -24,7 +24,9 @@ final class ZipUtils {
       ZipEntry entry;
       while ((entry = zis.getNextEntry()) != null) {
         String name = entry.getName();
-        if (name.contains("..") || name.startsWith("/") || name.startsWith("\\")) {
+        if (
+          containsParentDirectoryComponent(name) || name.startsWith("/") || name.startsWith("\\")
+        ) {
           throw new SecurityException("Zip path traversal attempt: " + name);
         }
 
@@ -69,4 +71,13 @@ final class ZipUtils {
       }
     }
   }
+
+  static boolean containsParentDirectoryComponent(String path) {
+    for (String component : path.split("/", -1)) {
+      if (component.equals("..")) {
+        return true;
+      }
+    }
+    return false;
+  }
 }

package/ios/Sources/UpdaterPlugin/DeltaAssembler.swift

@@ -206,16 +206,23 @@ final class DeltaAssembler {
     }
     try fileManager.createDirectory(at: destination, withIntermediateDirectories: true)
 
-    let destinationPrefix = destination.standardizedFileURL.path.hasSuffix("/")
-      ? destination.standardizedFileURL.path
-      : destination.standardizedFileURL.path + "/"
+    // Resolve the destination's symlinks ONCE and derive every target from the
+    // resolved base. iOS's temp dir is /var/… (a symlink to /private/var/…);
+    // standardizedFileURL resolved it inconsistently between the base and the
+    // appended path, so the containment check compared /var vs /private/var and
+    // rejected every file. Building targets from the already-resolved base makes
+    // the prefix check exact (mirrors Android's getCanonicalPath() on both sides).
+    let canonicalDestination = destination.resolvingSymlinksInPath()
+    let destinationPrefix = canonicalDestination.path.hasSuffix("/")
+      ? canonicalDestination.path
+      : canonicalDestination.path + "/"
 
     for entry in entries {
       try await ensureCached(entry)
 
-      let target = destination.appendingPathComponent(entry.path, isDirectory: false)
+      let target = canonicalDestination.appendingPathComponent(entry.path, isDirectory: false)
       // Defense in depth alongside isValidEntryPath (mirrors ZipUtils).
-      guard target.standardizedFileURL.path.hasPrefix(destinationPrefix) else {
+      guard target.path.hasPrefix(destinationPrefix) else {
         throw DeltaAssemblerError.invalidPath(entry.path)
       }
       let parent = target.deletingLastPathComponent()

package/ios/Sources/UpdaterPlugin/ZipUtils.swift

@@ -1,7 +1,7 @@
 import Foundation
 import ZIPFoundation
 
-enum ZipUtilsError: Error {
+enum ZipUtilsError: LocalizedError {
   case invalidZip
   case pathTraversal(String)
   case absolutePath(String)
@@ -9,6 +9,25 @@ enum ZipUtilsError: Error {
   case unsupportedEntry(String)
   case fileCountExceeded(Int)
   case totalSizeExceeded(UInt64)
+
+  var errorDescription: String? {
+    switch self {
+    case .invalidZip:
+      return "Downloaded bundle is not a readable ZIP archive"
+    case let .pathTraversal(path):
+      return "ZIP entry contains a parent-directory path component: \(path)"
+    case let .absolutePath(path):
+      return "ZIP entry uses an absolute path: \(path)"
+    case let .symlinkNotAllowed(path):
+      return "ZIP entry is a symbolic link: \(path)"
+    case let .unsupportedEntry(path):
+      return "ZIP entry has an unsupported type: \(path)"
+    case let .fileCountExceeded(count):
+      return "ZIP archive contains too many files: \(count)"
+    case let .totalSizeExceeded(size):
+      return "ZIP archive expands beyond the size limit: \(size) bytes"
+    }
+  }
 }
 
 final class ZipUtils {
@@ -16,51 +35,14 @@ final class ZipUtils {
   private let maxTotalSize: UInt64 = 500_000_000 // 500 MB
 
   func extractSecurely(zipURL: URL, to destination: URL) throws {
-    guard let archive = Archive(url: zipURL, accessMode: .read) else {
+    let archive: Archive
+    do {
+      archive = try Archive(url: zipURL, accessMode: .read, pathEncoding: nil)
+    } catch {
       throw ZipUtilsError.invalidZip
     }
 
-    let destinationPath = destination.standardizedFileURL.path
-    let destinationPrefix =
-      destinationPath.hasSuffix("/") ? destinationPath : "\(destinationPath)/"
-
-    var fileCount = 0
-    var totalSize: UInt64 = 0
-
-    for entry in archive {
-      if entry.path.hasPrefix("/") {
-        throw ZipUtilsError.absolutePath(entry.path)
-      }
-      if entry.path.contains("..") {
-        throw ZipUtilsError.pathTraversal(entry.path)
-      }
-      if entry.type == .symlink {
-        throw ZipUtilsError.symlinkNotAllowed(entry.path)
-      }
-      if entry.type != .directory && entry.type != .file {
-        throw ZipUtilsError.unsupportedEntry(entry.path)
-      }
-
-      let outputURL = destination
-        .appendingPathComponent(entry.path)
-        .standardizedFileURL
-      let outputPath = outputURL.path
-      if !(outputPath == destinationPath || outputPath.hasPrefix(destinationPrefix))
-      {
-        throw ZipUtilsError.pathTraversal(entry.path)
-      }
-
-      if entry.type == .file {
-        fileCount += 1
-        if fileCount > maxFiles {
-          throw ZipUtilsError.fileCountExceeded(fileCount)
-        }
-        totalSize += entry.uncompressedSize
-        if totalSize > maxTotalSize {
-          throw ZipUtilsError.totalSizeExceeded(totalSize)
-        }
-      }
-    }
+    try validateEntries(in: archive, destination: destination)
 
     try FileManager.default.createDirectory(
       at: destination,
@@ -87,4 +69,62 @@ final class ZipUtils {
       }
     }
   }
+
+  private func validateEntries(in archive: Archive, destination: URL) throws {
+    let destinationPath = destination.standardizedFileURL.path
+    let destinationPrefix =
+      destinationPath.hasSuffix("/") ? destinationPath : "\(destinationPath)/"
+    var fileCount = 0
+    var totalSize: UInt64 = 0
+
+    for entry in archive {
+      try validateEntry(
+        entry,
+        destination: destination,
+        destinationPath: destinationPath,
+        destinationPrefix: destinationPrefix
+      )
+      guard entry.type == .file else { continue }
+
+      fileCount += 1
+      if fileCount > maxFiles {
+        throw ZipUtilsError.fileCountExceeded(fileCount)
+      }
+      totalSize += entry.uncompressedSize
+      if totalSize > maxTotalSize {
+        throw ZipUtilsError.totalSizeExceeded(totalSize)
+      }
+    }
+  }
+
+  private func validateEntry(
+    _ entry: Entry,
+    destination: URL,
+    destinationPath: String,
+    destinationPrefix: String
+  ) throws {
+    if entry.path.hasPrefix("/") {
+      throw ZipUtilsError.absolutePath(entry.path)
+    }
+    if Self.containsParentDirectoryComponent(in: entry.path) {
+      throw ZipUtilsError.pathTraversal(entry.path)
+    }
+    if entry.type == .symlink {
+      throw ZipUtilsError.symlinkNotAllowed(entry.path)
+    }
+    if entry.type != .directory && entry.type != .file {
+      throw ZipUtilsError.unsupportedEntry(entry.path)
+    }
+
+    let outputPath = destination
+      .appendingPathComponent(entry.path)
+      .standardizedFileURL.path
+    if !(outputPath == destinationPath || outputPath.hasPrefix(destinationPrefix)) {
+      throw ZipUtilsError.pathTraversal(entry.path)
+    }
+  }
+
+  static func containsParentDirectoryComponent(in path: String) -> Bool {
+    path.split(separator: "/", omittingEmptySubsequences: false).contains("..")
+  }
 }

package/ios/Tests/UpdaterPluginTests/ZipUtilsTests.swift

@@ -0,0 +1,227 @@
+import Foundation
+import XCTest
+import ZIPFoundation
+@testable import UpdaterPlugin
+
+final class ZipUtilsTests: XCTestCase {
+  private struct EntrySpec {
+    let path: String
+    let type: Entry.EntryType
+    let data: Data
+
+    init(_ path: String, type: Entry.EntryType = .file, contents: String = "fixture") {
+      self.path = path
+      self.type = type
+      data = Data(contents.utf8)
+    }
+  }
+
+  private struct Fixture {
+    let root: URL
+    let archive: URL
+    let destination: URL
+
+    func cleanup() {
+      try? FileManager.default.removeItem(at: root)
+    }
+  }
+
+  func testExtractsYazlArchiveWithAdjacentDotsInsideFilename() throws {
+    // Generated by @otakit/cli's yazl 2.5.1 writer. Both entries use ZIP data
+    // descriptors, matching the archive shape reported in OtaKit issue #15.
+    let archiveData = try XCTUnwrap(Data(
+      base64Encoded: """
+        UEsDBBQACAgIAMSuG10AAAAAAAAAAAAAAAAKAAAAaW5kZXguaHRtbLNRTMlPLqksSFXI
+        KMnNsbMpySzJSbUrSi0oyrfRh3AAUEsHCFi8GEAgAAAAIwAAAFBLAwQUAAgICADE
+        rhtdAAAAAAAAAAAAAAAADgAAAHNhZmUuLmNodW5rLmpzS87PK87PSdXLyU/XUCpO
+        TEtV0gQAUEsHCJNQbzkVAAAAEwAAAFBLAQI/AxQACAgIAMSuG11YvBhAIAAAACMA
+        AAAKAAAAAAAAAAAAAACkgQAAAABpbmRleC5odG1sUEsBAj8DFAAICAgAxK4bXZNQ
+        bzkVAAAAEwAAAA4AAAAAAAAAAAAAAKSBWAAAAHNhZmUuLmNodW5rLmpzUEsFBgAA
+        AAACAAIAdAAAAKkAAAAAAA==
+        """,
+      options: .ignoreUnknownCharacters
+    ))
+    XCTAssertEqual(archiveData[6] & 0x08, 0x08, "Fixture must retain yazl's data descriptor flag")
+    let fixture = try makeFixture(archiveData: archiveData)
+    defer { fixture.cleanup() }
+
+    try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+
+    XCTAssertEqual(
+      try String(
+        contentsOf: fixture.destination.appendingPathComponent("safe..chunk.js"),
+        encoding: .utf8
+      ),
+      "console.log(\"safe\")"
+    )
+    XCTAssertTrue(
+      FileManager.default.fileExists(
+        atPath: fixture.destination.appendingPathComponent("index.html").path
+      )
+    )
+  }
+
+  func testParentDirectoryCheckUsesPathComponentsNotSubstrings() {
+    let safePaths = [
+      "asset..js",
+      "...",
+      ".well-known/config.json",
+      "dir/..hidden/file.js",
+      "dir/name...js",
+      "dir/%2E%2E/file.js"
+    ]
+    for path in safePaths {
+      XCTAssertFalse(
+        ZipUtils.containsParentDirectoryComponent(in: path),
+        "Expected safe path: \(path)"
+      )
+    }
+
+    let unsafePaths = [
+      "..",
+      "../escape.js",
+      "dir/../escape.js",
+      "dir/..",
+      "/../escape.js",
+      "dir//../escape.js"
+    ]
+    for path in unsafePaths {
+      XCTAssertTrue(
+        ZipUtils.containsParentDirectoryComponent(in: path),
+        "Expected parent-directory path component: \(path)"
+      )
+    }
+  }
+
+  func testExtractsNestedUnicodeAndDotNamedFiles() throws {
+    let fixture = try makeFixture(entries: [
+      EntrySpec("index.html", contents: "home"),
+      EntrySpec("assets/.well-known/name...üñícode.js", contents: "payload"),
+      EntrySpec("assets/empty.txt", contents: "")
+    ])
+    defer { fixture.cleanup() }
+
+    try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+
+    XCTAssertEqual(
+      try String(
+        contentsOf: fixture.destination
+          .appendingPathComponent("assets/.well-known/name...üñícode.js"),
+        encoding: .utf8
+      ),
+      "payload"
+    )
+    XCTAssertEqual(
+      try Data(contentsOf: fixture.destination.appendingPathComponent("assets/empty.txt")),
+      Data()
+    )
+  }
+
+  func testRejectsExactParentDirectorySegmentBeforeExtractingAnything() throws {
+    let fixture = try makeFixture(entries: [
+      EntrySpec("index.html", contents: "must not be written"),
+      EntrySpec("assets/../escape.js")
+    ])
+    defer { fixture.cleanup() }
+
+    XCTAssertThrowsError(
+      try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+    ) { error in
+      guard case let ZipUtilsError.pathTraversal(path) = error else {
+        return XCTFail("Expected pathTraversal, got \(String(reflecting: error))")
+      }
+      XCTAssertEqual(path, "assets/../escape.js")
+      XCTAssertEqual(
+        error.localizedDescription,
+        "ZIP entry contains a parent-directory path component: assets/../escape.js"
+      )
+    }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: fixture.destination.path))
+  }
+
+  func testRejectsAbsolutePathBeforeExtractingAnything() throws {
+    let fixture = try makeFixture(entries: [EntrySpec("/escape.js")])
+    defer { fixture.cleanup() }
+
+    XCTAssertThrowsError(
+      try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+    ) { error in
+      guard case let ZipUtilsError.absolutePath(path) = error else {
+        return XCTFail("Expected absolutePath, got \(String(reflecting: error))")
+      }
+      XCTAssertEqual(path, "/escape.js")
+    }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: fixture.destination.path))
+  }
+
+  func testRejectsSymbolicLinkBeforeExtractingAnything() throws {
+    let fixture = try makeFixture(entries: [
+      EntrySpec("index.html", contents: "must not be written"),
+      EntrySpec("link", type: .symlink, contents: "../outside")
+    ])
+    defer { fixture.cleanup() }
+
+    XCTAssertThrowsError(
+      try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+    ) { error in
+      guard case let ZipUtilsError.symlinkNotAllowed(path) = error else {
+        return XCTFail("Expected symlinkNotAllowed, got \(String(reflecting: error))")
+      }
+      XCTAssertEqual(path, "link")
+    }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: fixture.destination.path))
+  }
+
+  func testRejectsUnreadableArchiveWithClearError() throws {
+    let fixture = try makeFixture(archiveData: Data("not a zip".utf8))
+    defer { fixture.cleanup() }
+
+    XCTAssertThrowsError(
+      try ZipUtils().extractSecurely(zipURL: fixture.archive, to: fixture.destination)
+    ) { error in
+      guard case ZipUtilsError.invalidZip = error else {
+        return XCTFail("Expected invalidZip, got \(String(reflecting: error))")
+      }
+      XCTAssertEqual(
+        error.localizedDescription,
+        "Downloaded bundle is not a readable ZIP archive"
+      )
+    }
+    XCTAssertFalse(FileManager.default.fileExists(atPath: fixture.destination.path))
+  }
+
+  private func makeFixture(archiveData: Data) throws -> Fixture {
+    let fixture = try emptyFixture()
+    try archiveData.write(to: fixture.archive)
+    return fixture
+  }
+
+  private func makeFixture(entries: [EntrySpec]) throws -> Fixture {
+    let fixture = try emptyFixture()
+    let archive = try Archive(url: fixture.archive, accessMode: .create, pathEncoding: nil)
+    for entry in entries {
+      try archive.addEntry(
+        with: entry.path,
+        type: entry.type,
+        uncompressedSize: Int64(entry.data.count),
+        compressionMethod: entry.type == .file ? .deflate : .none
+      ) { position, size in
+        let lowerBound = Int(position)
+        let upperBound = min(lowerBound + size, entry.data.count)
+        return entry.data.subdata(in: lowerBound..<upperBound)
+      }
+    }
+    return fixture
+  }
+
+  private func emptyFixture() throws -> Fixture {
+    let root = FileManager.default.temporaryDirectory
+      .appendingPathComponent("otakit-zip-tests-\(UUID().uuidString)", isDirectory: true)
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    return Fixture(
+      root: root,
+      archive: root.appendingPathComponent("fixture.zip"),
+      destination: root.appendingPathComponent("extracted", isDirectory: true)
+    )
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otakit/capacitor-updater",
-  "version": "2.3.0",
+  "version": "2.3.2",
   "description": "Capacitor plugin for OTA updates",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",