cordova-plugin-mserviceinterface-2.0 1.0.35 → 1.0.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cordova-plugin-mserviceinterface-2.0",
-  "version": "1.0.35",
+  "version": "1.0.38",
   "description": "This plugin establishes the connection to the native interface and performs the requested task.",
   "main": "index.js",
   "scripts": {

package/plugin.xml

@@ -2,7 +2,7 @@
 <plugin xmlns="http://apache.org/cordova/ns/plugins/1.0"
     xmlns:android="http://schemas.android.com/apk/res/android"
     id="cordova-plugin-mserviceinterface-2.0"
-    version="1.0.35">
+    version="1.0.38">
     <name>mserviceinterface-2.0</name>
     <description>This plugin establishes the connection to the native interface and performs the requested task.</description>
     <author>selfservit@gmail.com</author>

package/src/android/backgroundNotification.java

@@ -54,9 +54,9 @@ public class backgroundNotification extends NotificationExtenderService {
 				String key = msgBody.getString("key");
 				String subKey = msgBody.getString("subKey");
 				
-				if(scrID.equals("chat")) {
+				if(scrID.contains("_chat")) {
 					if (!subKey.equals("")) {
-						fileDirectory = new File(mInterfaceUtil.rootDirectory + "/" + baseDirectory[(baseDirectory.length - 1)] + "/" + clientID + "/" + countryCode + "/" + "content_store" + "/" + "msvMsg" + "/" + "history" + "/" + key + "/" + subKey);
+						fileDirectory = new File(mInterfaceUtil.rootDirectory + "/" + baseDirectory[(baseDirectory.length - 1)] + "/" + clientID + "/" + countryCode + "/" + "content_store" + "/" + "msvMsg" + "/" + "history"+ "/" + packageName + "/" + key + "/" + subKey);
 						if (!fileDirectory.exists()) {
 							fileDirectory.mkdirs();
 						}
@@ -76,7 +76,7 @@ public class backgroundNotification extends NotificationExtenderService {
 						System.out.println(line);
 					}
 					String notificationStr = decrypt(notificationDatas.toString());
-					notificationStr = notificationStr + msgBody.toString() + ",";
+					notificationStr = notificationStr + "," +msgBody.toString() ;
 					FileWriter fw = new FileWriter(notificationsFile);
 					fw.write(mInterfaceUtil.encrypt(notificationStr));
 					fw.close();
@@ -87,7 +87,7 @@ public class backgroundNotification extends NotificationExtenderService {
 				System.out.println("Does not Exists");
 				try {
 					FileWriter fw = new FileWriter(notificationsFile);
-					fw.write(mInterfaceUtil.encrypt(notification.payload.additionalData.getString("msgBody") + ","));
+					fw.write(mInterfaceUtil.encrypt(","+ notification.payload.additionalData.getString("msgBody")));
 					fw.close();
 				} catch (IOException e1) {
 					e1.printStackTrace();

package/src/android/mInterface.java

@@ -2262,6 +2262,15 @@ public class mInterface extends CordovaPlugin implements com.google.android.gms.
             while ((ze = zis.getNextEntry()) != null) {
                 anyEntries = true;
                 String compressedName = ze.getName();
+                File outputFile = new File(outputDir, ze.getName());
+                try {
+                    ensureZipPathSafety(outputFile, outputDirectory);
+                } catch (Exception e) {
+                    anyEntries = false;
+                    e.printStackTrace();
+                    callbackContext.error("Bad zip file");
+                    return;
+                };
                 if (ze.isDirectory()) {
                     File dir = new File(outputDirectory + compressedName);
                     dir.mkdirs();
@@ -2297,6 +2306,13 @@ public class mInterface extends CordovaPlugin implements com.google.android.gms.
             }
         }
     }
+    private void ensureZipPathSafety(final File outputFile, final String destDirectory) throws Exception {
+        String destDirCanonicalPath = (new File(destDirectory)).getCanonicalPath();
+        String outputFileCanonicalPath = outputFile.getCanonicalPath();
+        if (!outputFileCanonicalPath.startsWith(destDirCanonicalPath)) {
+            throw new Exception(String.format("Found Zip Path Traversal Vulnerability with %s", outputFileCanonicalPath));
+        }
+    }
 
     private Uri getUriForArg(String arg) {
         CordovaResourceApi resourceApi = webView.getResourceApi();

package/src/android/mInterfaceService.java

@@ -22,6 +22,7 @@ import android.os.Build;
 import android.os.Bundle;
 import android.os.Environment;
 import android.os.IBinder;
+import android.os.Looper;
 import android.os.SystemClock;
 import android.support.annotation.NonNull;
 import android.support.annotation.Nullable;
@@ -295,7 +296,7 @@ public class mInterfaceService extends Service implements com.google.android.gms
 
             }
         }
-        PendingResult<Status> pendingResult = LocationServices.FusedLocationApi.requestLocationUpdates(mGoogleApiClient, mLocationRequest, this);
+        PendingResult<Status> pendingResult = LocationServices.FusedLocationApi.requestLocationUpdates(mGoogleApiClient, mLocationRequest, this, Looper.getMainLooper());
     }
 
     @Override