react-native-update 10.59.1 → 10.60.0

package/android/src/main/java/cn/reactnative/modules/update/SafeZipFile.java

@@ -1,11 +1,14 @@
 package cn.reactnative.modules.update;
 
-import java.io.BufferedInputStream;
-import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.OutputStream;
+import java.security.DigestOutputStream;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.Collections;
 import java.util.Enumeration;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
@@ -17,73 +20,30 @@ public class SafeZipFile extends ZipFile {
         super(file);
     }
 
-    private static final int BUFFER_SIZE = 8192;
-
-    // Bytes written by unzipToFile across the archive: the sum of the central
-    // directory's declared sizes is checked up front (inspect), the actual
+    // Bytes written by unzipToFile across the archive: the central
+    // directory's declared sizes are checked up front (inspect), the actual
     // stream is re-checked here — headers can lie.
     private long totalWritten = 0;
 
-    static final class Inspection {
-        long entries;
-        long totalUncompressed;
-    }
-
     /**
-     * Walks the central directory once, enforcing the archive_limits caps
-     * (entry count, per-entry size, total size, compression ratio) and the
-     * reserved-name / traversal rules, before a single byte is extracted.
+     * Walks the central directory once and hands it to the shared accounting
+     * (ArchiveLimits.checkEntries: entry count, per-entry and total size,
+     * compression ratios, reserved `.pushy-` names) before a single byte is
+     * extracted. Returns the total uncompressed size.
      */
-    Inspection inspect() throws IOException {
-        Inspection result = new Inspection();
-        Enumeration<? extends ZipEntry> entries = entries();
-        while (entries.hasMoreElements()) {
-            ZipEntry entry = entries.nextElement();
-            result.entries++;
-            if (result.entries > ArchiveLimits.MAX_ENTRIES) {
-                throw new IOException(
-                    "archive has too many entries (> " + ArchiveLimits.MAX_ENTRIES + ")");
-            }
-            long size = entry.getSize();
-            long compressed = entry.getCompressedSize();
-            if (size > ArchiveLimits.MAX_ENTRY_BYTES) {
-                throw new IOException(
-                    "archive entry too large: " + entry.getName() + " (" + size + " bytes)");
-            }
-            if (size > 0) {
-                result.totalUncompressed += size;
-                if (result.totalUncompressed > ArchiveLimits.MAX_TOTAL_UNCOMPRESSED_BYTES) {
-                    throw new IOException("archive expands beyond "
-                        + ArchiveLimits.MAX_TOTAL_UNCOMPRESSED_BYTES + " bytes");
-                }
-                if (compressed > 0 && size > ArchiveLimits.RATIO_CHECK_MIN_BYTES
-                    && size / compressed > ArchiveLimits.MAX_COMPRESSION_RATIO) {
-                    throw new IOException(
-                        "archive entry compression ratio too high: " + entry.getName());
-                }
-            }
+    long inspect(long archiveBytes) throws IOException {
+        ArrayList<? extends ZipEntry> entries = Collections.list(entries());
+        int count = entries.size();
+        String[] names = new String[count];
+        long[] sizes = new long[count];
+        long[] compressedSizes = new long[count];
+        for (int i = 0; i < count; i++) {
+            ZipEntry entry = entries.get(i);
+            names[i] = entry.getName();
+            sizes[i] = entry.getSize();
+            compressedSizes[i] = entry.getCompressedSize();
         }
-        return result;
-    }
-
-    // Files the SDK itself writes into a version directory to record its own
-    // decisions (the ".pushy-complete" install marker today). An archive
-    // must never be able to ship one: a package that unzips its own marker
-    // next to a bundle would be trusted as a finished install even when the
-    // patch step that follows fails.
-    static final String RESERVED_ENTRY_PREFIX = ".pushy-";
-
-    static boolean isReservedEntryName(String name) {
-        if (name == null) {
-            return false;
-        }
-        String normalized = name.replace('\\', '/');
-        while (normalized.endsWith("/")) {
-            normalized = normalized.substring(0, normalized.length() - 1);
-        }
-        int slash = normalized.lastIndexOf('/');
-        String baseName = slash >= 0 ? normalized.substring(slash + 1) : normalized;
-        return baseName.startsWith(RESERVED_ENTRY_PREFIX);
+        return ArchiveLimits.checkEntries(archiveBytes, names, sizes, compressedSizes);
     }
 
     @Override
@@ -115,15 +75,17 @@ public class SafeZipFile extends ZipFile {
                 if (null != name && (name.contains("../") || name.contains("..\\"))) {
                     throw new SecurityException("illegal entry: " + name);
                 }
-                if (isReservedEntryName(name)) {
-                    throw new SecurityException("reserved entry: " + name);
-                }
             }
             return entry;
         }
     }
 
     public void unzipToPath(ZipEntry ze, File targetPath) throws IOException {
+        unzipToPath(ze, targetPath, null);
+    }
+
+    /** As above; a non-null digest is fed every byte written for the entry. */
+    void unzipToPath(ZipEntry ze, File targetPath, MessageDigest digest) throws IOException {
         String name = ze.getName();
         File target = new File(targetPath, name);
 
@@ -133,22 +95,19 @@ public class SafeZipFile extends ZipFile {
         if (!canonicalPath.startsWith(targetPath.getCanonicalPath() + File.separator)) {
             throw new SecurityException("Illegal name: " + name);
         }
-        if (isReservedEntryName(name)) {
-            throw new SecurityException("reserved entry: " + name);
-        }
-
         if (ze.isDirectory()) {
             target.mkdirs();
             return;
         }
-        unzipToFile(ze, target);
+        unzipToFile(ze, target, digest);
     }
 
     public void unzipToFile(ZipEntry ze, File target) throws IOException {
-        File parent = target.getParentFile();
-        if (parent != null && !parent.exists() && !parent.mkdirs() && !parent.exists()) {
-            throw new IOException("Failed to create parent dir for " + target);
-        }
+        unzipToFile(ze, target, null);
+    }
+
+    private void unzipToFile(ZipEntry ze, File target, MessageDigest digest) throws IOException {
+        UpdateFileUtils.ensureParentDirectory(target);
 
         // The declared size is the budget when known; otherwise the global
         // per-entry cap. Either way the stream may not exceed it.
@@ -157,12 +116,15 @@ public class SafeZipFile extends ZipFile {
             ? Math.min(declared, ArchiveLimits.MAX_ENTRY_BYTES)
             : ArchiveLimits.MAX_ENTRY_BYTES;
         long written = 0;
-        try (InputStream inputStream = getInputStream(ze)) {
-            try (BufferedOutputStream output = new BufferedOutputStream(new FileOutputStream(target));
-                 BufferedInputStream input = new BufferedInputStream(inputStream)) {
-                byte[] buffer = new byte[BUFFER_SIZE];
+        // One 64KB buffer, no extra buffered wrappers: every read/write is
+        // already a large block.
+        try (InputStream input = getInputStream(ze)) {
+            try (OutputStream output = digest == null
+                     ? new FileOutputStream(target)
+                     : new DigestOutputStream(new FileOutputStream(target), digest)) {
+                byte[] buffer = new byte[UpdateFileUtils.BUFFER_SIZE];
                 int n;
-                while ((n = input.read(buffer, 0, BUFFER_SIZE)) >= 0) {
+                while ((n = input.read(buffer, 0, buffer.length)) >= 0) {
                     written += n;
                     totalWritten += n;
                     if (written > budget) {

package/android/src/main/java/cn/reactnative/modules/update/StateSerialRunner.java

@@ -1,64 +1,47 @@
 package cn.reactnative.modules.update;
 
-import android.util.Log;
-import androidx.annotation.Nullable;
 import com.facebook.react.bridge.Promise;
-
+import com.facebook.react.bridge.UiThreadUtil;
 import java.util.concurrent.Executor;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ThreadFactory;
 
 /**
- * Runs state-persistence operations (switchVersion / markSuccess / setUuid /
- * setLocalHashInfo) on a dedicated single background thread.
- *
- * These operations only read/modify SharedPreferences via a synchronous
- * commit(); they were previously dispatched to the UI thread purely to
- * serialize them. markSuccess in particular runs on every cold start, so doing
- * its blocking disk write on the main thread caused jank/ANR on low-end
- * devices. A single-thread executor preserves the same serialization guarantee
- * while keeping the disk I/O off the UI thread.
+ * Runs a module operation on a given executor and rejects its promise with
+ * the operation's error code when it throws; the operation resolves the
+ * promise itself.
  *
- * Note: reload/restart operations must still run on the UI thread and therefore
- * keep using {@link UiThreadRunner}.
+ * State-persistence operations (switchVersion / markSuccess / setUuid /
+ * setLocalHashInfo / reset / config) go to {@link #STATE_SERIAL}, a single
+ * background thread: they only read/modify SharedPreferences via a
+ * synchronous commit(), and were once dispatched to the UI thread purely to
+ * serialize them. markSuccess runs on every cold start, so its blocking disk
+ * write on the main thread caused jank/ANR on low-end devices; one worker
+ * keeps the serialization in submission order without that. Only the React
+ * reload itself still hops to {@link #UI_THREAD}.
  */
 final class StateSerialRunner {
     interface Operation {
         void run() throws Throwable;
     }
 
-    // Single worker thread -> operations stay serialized in submission order,
-    // matching the previous UI-thread behavior. The thread is named so it is
-    // identifiable in thread dumps / ANR traces when diagnosing persistence.
-    private static final Executor EXECUTOR = Executors.newSingleThreadExecutor(
-        new ThreadFactory() {
-            @Override
-            public Thread newThread(Runnable r) {
-                return new Thread(r, "pushy-state-serial");
-            }
-        });
+    // Named so it is identifiable in thread dumps / ANR traces.
+    static final Executor STATE_SERIAL = Threads.single("pushy-state-serial", false);
+    static final Executor UI_THREAD = UiThreadUtil::runOnUiThread;
 
     private StateSerialRunner() {
     }
 
     static void run(
-        @Nullable final Promise promise,
+        Executor executor,
+        final Promise promise,
         final String errorCode,
         final String operationName,
         final Operation operation
     ) {
-        EXECUTOR.execute(new Runnable() {
-            @Override
-            public void run() {
-                try {
-                    operation.run();
-                } catch (Throwable error) {
-                    if (promise != null) {
-                        promise.reject(errorCode, operationName + " failed", error);
-                    } else {
-                        Log.e(Texts.LOG_TAG, operationName + " failed", error);
-                    }
-                }
+        executor.execute(() -> {
+            try {
+                operation.run();
+            } catch (Throwable error) {
+                promise.reject(errorCode, operationName + " failed", error);
             }
         });
     }