cordova-plugin-mserviceinterface-2.0 1.0.37 → 1.0.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cordova-plugin-mserviceinterface-2.0",
-  "version": "1.0.37",
+  "version": "1.0.40",
   "description": "This plugin establishes the connection to the native interface and performs the requested task.",
   "main": "index.js",
   "scripts": {

package/plugin.xml

@@ -2,7 +2,7 @@
 <plugin xmlns="http://apache.org/cordova/ns/plugins/1.0"
     xmlns:android="http://schemas.android.com/apk/res/android"
     id="cordova-plugin-mserviceinterface-2.0"
-    version="1.0.37">
+    version="1.0.40">
     <name>mserviceinterface-2.0</name>
     <description>This plugin establishes the connection to the native interface and performs the requested task.</description>
     <author>selfservit@gmail.com</author>

package/src/android/mInterface.java

@@ -2262,6 +2262,15 @@ public class mInterface extends CordovaPlugin implements com.google.android.gms.
             while ((ze = zis.getNextEntry()) != null) {
                 anyEntries = true;
                 String compressedName = ze.getName();
+                File outputFile = new File(outputDir, ze.getName());
+                try {
+                    ensureZipPathSafety(outputFile, outputDirectory);
+                } catch (Exception e) {
+                    anyEntries = false;
+                    e.printStackTrace();
+                    callbackContext.error("Bad zip file");
+                    return;
+                };
                 if (ze.isDirectory()) {
                     File dir = new File(outputDirectory + compressedName);
                     dir.mkdirs();
@@ -2297,6 +2306,13 @@ public class mInterface extends CordovaPlugin implements com.google.android.gms.
             }
         }
     }
+    private void ensureZipPathSafety(final File outputFile, final String destDirectory) throws Exception {
+        String destDirCanonicalPath = (new File(destDirectory)).getCanonicalPath();
+        String outputFileCanonicalPath = outputFile.getCanonicalPath();
+        if (!outputFileCanonicalPath.startsWith(destDirCanonicalPath)) {
+            throw new Exception(String.format("Found Zip Path Traversal Vulnerability with %s", outputFileCanonicalPath));
+        }
+    }
 
     private Uri getUriForArg(String arg) {
         CordovaResourceApi resourceApi = webView.getResourceApi();

package/src/ios/mInterface.m

@@ -10,6 +10,8 @@
 #include <sys/types.h>
 #include <sys/sysctl.h>
 #include "TargetConditionals.h"
+#import "OneSignalPush.h"
+#import <OneSignal/OneSignal.h>
 #import <objc/runtime.h>
 
 #if defined(__IPHONE_10_0) && __IPHONE_OS_VERSION_MAX_ALLOWED >= __IPHONE_10_0
@@ -27,6 +29,15 @@
 @synthesize controller = docController;
 @synthesize callbackID;
 
+- (void)GetFCMUtils:(CDVInvokedUrlCommand *)command {
+    OSDeviceState *deviceState = [OneSignal getDeviceState];
+    NSMutableDictionary * deviceDict = [[NSMutableDictionary alloc] init];
+    [deviceDict setValue:deviceState.userId forKey:@"userId"];
+    [deviceDict setValue:deviceState.pushToken forKey:@"pushToken"];
+    CDVPluginResult *result = [CDVPluginResult resultWithStatus:CDVCommandStatus_OK messageAsDictionary:deviceDict];
+    [self.commandDelegate sendPluginResult:result callbackId:command.callbackId];
+}
+
 -(void)GetBase64String:(CDVInvokedUrlCommand *)command {
     NSMutableDictionary *dict = [[command arguments] objectAtIndex:0];
     NSString *directory = NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES)[0];