craft-native 0.0.490 → 0.0.492

package/dist/android/src/testing.d.ts

@@ -1,2 +1,9 @@
 /** Uses the Android builder's Kotlin version, including its transitive compiler dependencies. */
 export declare function runKotlinFixture(source: string, libraries?: readonly string[]): Promise<void>;
+/**
+ * One member of a Kotlin class in a template, as shipped, so a fixture can run
+ * the real text rather than a copy of it: a function, or a property with its
+ * initialiser. Members sit at four spaces; the member is everything deeper,
+ * to its closing brace when it has a block body.
+ */
+export declare function liftKotlinMember(template: string, name: string): string;

package/dist/android/templates/CraftNativeCapabilities.kt.template

@@ -34,10 +34,12 @@ import org.json.JSONTokener
 import java.io.ByteArrayOutputStream
 import java.io.File
 import java.io.FileOutputStream
+import java.io.IOException
 import java.net.HttpURLConnection
 import java.net.SocketTimeoutException
 import java.net.URL
 import java.net.URLConnection
+import java.net.URLDecoder
 import java.util.UUID
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.Executors
@@ -540,8 +542,7 @@ internal class CraftNativeCapabilities(
             val options = args.optJSONObject(2) ?: JSONObject()
             val bytes = when (options.optString("encoding", "utf8")) {
                 "utf8" -> data.toByteArray(Charsets.UTF_8)
-                "base64" -> runCatching { Base64.decode(data, Base64.DEFAULT) }
-                    .getOrElse { return failure("INVALID_ARGUMENT", "files.write base64 is invalid") }
+                "base64" -> decodeBase64(data) ?: return failure("INVALID_ARGUMENT", "files.write base64 is invalid")
                 else -> return failure("INVALID_ARGUMENT", "files.write encoding is 'utf8' or 'base64'")
             }
             store(bytes, name, options.optString("type").ifBlank { URLConnection.guessContentTypeFromName(name) ?: "application/octet-stream" })
@@ -555,6 +556,30 @@ internal class CraftNativeCapabilities(
         }
     }
 
+    /**
+     * Base64 as `atob` reads it, which is what the browser host runs and what
+     * UIKit is held to: the alphabet, ASCII white space anywhere, padding
+     * optional but right when it is there, and nothing else. Android's own
+     * decoder skips any character it does not know, so the `-` and `_` of a
+     * URL-safe encoding would vanish and a wrong file be written with no
+     * error. It is handed only what has already been read as valid.
+     */
+    private fun decodeBase64(text: String): ByteArray? {
+        val data = StringBuilder(text.length)
+        var padding = 0
+        for (letter in text) {
+            when {
+                letter == ' ' || letter == '\t' || letter == '\n' || letter == '\u000C' || letter == '\r' -> Unit
+                letter == '=' -> padding += 1
+                padding > 0 -> return null
+                letter in 'A'..'Z' || letter in 'a'..'z' || letter in '0'..'9' || letter == '+' || letter == '/' -> data.append(letter)
+                else -> return null
+            }
+        }
+        if (padding > 2 || data.length % 4 == 1 || (padding > 0 && (data.length + padding) % 4 != 0)) return null
+        return runCatching { Base64.decode(data.toString(), Base64.DEFAULT) }.getOrNull()
+    }
+
     private fun download(requestToken: String, args: JSONArray): CraftNativeCapabilityResult {
         val address = args.optString(0).trim()
         val url = validURL(address) ?: return failure("INVALID_ARGUMENT", "files.download needs an absolute http or https URL")
@@ -585,18 +610,47 @@ internal class CraftNativeCapabilities(
         return try {
             val status = connection.responseCode
             if (status !in 200..299) return refusedDownload(connection, status, requestToken)
-            val name = options.optString("name").ifBlank { connection.url.path.substringAfterLast('/').ifBlank { "download" } }
+            // The name the screen asked for, else the server's, else the
+            // address's: the order UIKit's download keeps a file under.
+            val name = options.optString("name").ifBlank { downloadName(connection.getHeaderField("Content-Disposition"), connection.url.path) }
             val file = File(fileRoot, UUID.randomUUID().toString()).apply { mkdirs() }.resolve(safeFileName(name))
-            connection.inputStream.use { input -> FileOutputStream(file).use { output ->
-                val buffer = ByteArray(8192)
-                while (true) {
-                    if (cancelled.contains(requestToken)) return failure("CANCELLED", "File download was cancelled")
-                    val count = input.read(buffer)
-                    if (count < 0) break
-                    output.write(buffer, 0, count)
+            var kept = false
+            try {
+                val output = try { FileOutputStream(file) } catch (error: IOException) {
+                    return failure("WRITE_ERROR", error.message ?: "File could not be written")
                 }
-            } }
-            success(descriptor(file, connection.contentType ?: "application/octet-stream"))
+                var written = 0L
+                output.use { connection.inputStream.use { input ->
+                    val buffer = ByteArray(8192)
+                    while (true) {
+                        if (cancelled.contains(requestToken)) return failure("CANCELLED", "File download was cancelled")
+                        val count = input.read(buffer)
+                        if (count < 0) break
+                        // A full disk is not the network's failure.
+                        try { output.write(buffer, 0, count) } catch (error: IOException) {
+                            return failure("WRITE_ERROR", error.message ?: "File could not be written")
+                        }
+                        written += count
+                    }
+                } }
+                // A body shorter than the server said it would be is not the
+                // file. Android's connection fails such a read itself, and
+                // other implementations simply stop, so the length is checked
+                // here and the answer is this function's own. (When the
+                // connection decompressed the body it reports no length.)
+                val declared = connection.getHeaderField("Content-Length")?.trim()?.toLongOrNull()
+                if (declared != null && written != declared) {
+                    // A cancel can end the read early rather than fail it.
+                    return if (cancelled.contains(requestToken)) failure("CANCELLED", "File download was cancelled")
+                    else failure("NETWORK_ERROR", "File download ended after $written of $declared bytes")
+                }
+                kept = true
+                // `ok` is how a screen tells this from a refusal, which
+                // resolves `{ ok: false, status, body }` rather than rejecting.
+                success(descriptor(file, connection.contentType ?: "application/octet-stream").put("ok", true).put("status", status))
+            } finally {
+                if (!kept) removePartial(file)
+            }
         } catch (error: SocketTimeoutException) {
             failure("TIMEOUT", error.message ?: "File download timed out")
         } catch (error: Exception) {
@@ -608,6 +662,38 @@ internal class CraftNativeCapabilities(
         }
     }
 
+    /**
+     * A download that stopped part-way is not a file. Nothing was told its
+     * path, so nothing would remove it before the daily sweep.
+     */
+    private fun removePartial(file: File) {
+        runCatching { file.delete() }
+        // Its folder was made for it alone; delete refuses one that is not empty.
+        runCatching { file.parentFile?.takeIf { it != fileRoot }?.delete() }
+    }
+
+    /**
+     * The server's name for a download (`Content-Disposition`, the encoded
+     * `filename*` before the plain one), else the address's last segment as a
+     * person reads it rather than as it is percent-encoded.
+     */
+    private fun downloadName(disposition: String?, path: String): String {
+        val header = disposition.orEmpty()
+        Regex("filename\\*\\s*=\\s*UTF-8''([^;\\s]+)", RegexOption.IGNORE_CASE).find(header)?.let { match ->
+            percentDecoded(match.groupValues[1])?.takeIf { it.isNotBlank() }?.let { return it }
+        }
+        Regex("filename\\s*=\\s*(?:\"((?:[^\"\\\\]|\\\\.)*)\"|([^;]+))", RegexOption.IGNORE_CASE).find(header)?.let { match ->
+            val quoted = match.groups[1]?.value?.replace(Regex("\\\\(.)")) { it.groupValues[1] }
+            (quoted ?: match.groupValues[2]).trim().takeIf { it.isNotBlank() }?.let { return it }
+        }
+        val segment = path.substringAfterLast('/')
+        return (percentDecoded(segment) ?: segment).ifBlank { "download" }
+    }
+
+    /** Percent-decoded as UTF-8, or null when it is not validly encoded. A `+` is a plus, not a space. */
+    private fun percentDecoded(value: String): String? =
+        runCatching { URLDecoder.decode(value.replace("+", "%2B"), "UTF-8") }.getOrNull()
+
     private fun refusedDownload(
         connection: HttpURLConnection,
         status: Int,
@@ -997,9 +1083,24 @@ internal class CraftNativeCapabilities(
         return true
     }
 
+    /**
+     * A file name with no path in it that the disk will take, as UIKit's
+     * `safeName` makes one: no leading dots (so never `..`, the folder
+     * itself), and cut to fit. 255 bytes is what a name may be on disk and
+     * 120 characters is where UIKit cuts; the extension stays, since it is
+     * how a share sheet and an upload know what the file is.
+     */
     private fun safeFileName(raw: String): String {
-        val name = raw.substringAfterLast('/').substringAfterLast('\\').trim()
-        return name.ifBlank { "file" }.replace(Regex("[\\\\/:*?\"<>|\\r\\n]"), "_")
+        val name = raw.substringAfterLast('/').substringAfterLast('\\').trim().trimStart('.')
+        val safe = name.replace(Regex("[\\\\/:*?\"<>|\\r\\n\\u0000]"), "_").ifBlank { "file" }
+        fun fits(value: String) = value.codePointCount(0, value.length) <= 120 && value.toByteArray(Charsets.UTF_8).size <= 255
+        if (fits(safe)) return safe
+        val dot = safe.lastIndexOf('.')
+        val extension = if (dot > 0 && safe.length - dot <= 16) safe.substring(dot) else ""
+        var stem = safe.dropLast(extension.length)
+        stem = stem.substring(0, stem.offsetByCodePoints(0, minOf(120, stem.codePointCount(0, stem.length))))
+        while (stem.isNotEmpty() && !fits(stem + extension)) stem = stem.substring(0, stem.offsetByCodePoints(stem.length, -1))
+        return stem + extension
     }
 
     private fun jpegName(raw: String): String {
@@ -1093,10 +1194,18 @@ internal class CraftNativeCapabilities(
         }
     }
 
-    private fun secureStorage(method: String, args: JSONArray): CraftNativeCapabilityResult {
+    private fun secureStorage(method: String, args: JSONArray): CraftNativeCapabilityResult = synchronized(CraftNativeStorage.secureLock) {
+        // A write that did not reach the disk is a failure, and nothing is told
+        // it happened: the store's own memory is put back (a failed commit
+        // has already changed it), no isolate hears of it, and the caller is
+        // refused, as UIKit refuses a Keychain delete that failed. Answering
+        // `false` and telling every isolate the token was gone made a failed
+        // sign-out look like a sign-out until the next launch read the disk.
         if (method == "clear") {
             return try {
-                success(encryptedSecureStorage.edit().clear().commit().also { storeObserver?.invoke("secure", null, null) })
+                if (!CraftNativeStorage.commit(encryptedSecureStorage) { it.clear() }) return failure("SECURE_STORAGE_ERROR", "Secure storage could not be cleared")
+                storeObserver?.invoke("secure", null, null)
+                success(true)
             } catch (error: Exception) {
                 failure("SECURE_STORAGE_ERROR", error.message ?: "Secure storage could not be cleared")
             }
@@ -1106,14 +1215,18 @@ internal class CraftNativeCapabilities(
             when (method) {
                 "set" -> {
                     if (args.length() != 2 || args.opt(1) !is String) return failure("INVALID_ARGUMENT", "SecureStorage.set needs a key and string value")
-                    if (encryptedSecureStorage.edit().putString(key, args.getString(1)).commit()) {
-                        storeObserver?.invoke("secure", key, args.getString(1))
+                    val value = args.getString(1)
+                    if (CraftNativeStorage.commit(encryptedSecureStorage) { it.putString(key, value) }) {
+                        storeObserver?.invoke("secure", key, value)
                         success(true)
                     }
                     else failure("SECURE_STORAGE_ERROR", "Secure storage could not be written")
                 }
                 "get" -> success(encryptedSecureStorage.getString(key, null) ?: JSONObject.NULL)
-                "remove" -> success(encryptedSecureStorage.edit().remove(key).commit().also { storeObserver?.invoke("secure", key, null) })
+                "remove" -> if (CraftNativeStorage.commit(encryptedSecureStorage) { it.remove(key) }) {
+                    storeObserver?.invoke("secure", key, null)
+                    success(true)
+                } else failure("SECURE_STORAGE_ERROR", "Secure storage could not be removed")
                 else -> failure("UNKNOWN_ACTION", "Unsupported SecureStorage method")
             }
         } catch (error: Exception) {