react-native-update 10.59.2 → 10.60.0

package/cpp/patch_core/archive_limits.cpp

@@ -0,0 +1,194 @@
+#include "archive_limits.h"
+
+#include <dirent.h>
+#include <sys/stat.h>
+
+#include <limits>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "install_record.h"
+
+namespace pushy {
+namespace archive_limits {
+namespace {
+
+// expanded > compressed * kMaxCompressionRatio, past kRatioCheckMinBytes.
+// A non-positive compressed size bounds nothing. Exact (no integer division
+// rounding the ratio down) and overflow-free.
+bool ExceedsRatio(long long expanded, long long compressed) {
+  if (expanded <= kRatioCheckMinBytes) {
+    return false;
+  }
+  if (compressed <= 0) {
+    return true;
+  }
+  if (compressed > std::numeric_limits<long long>::max() / kMaxCompressionRatio) {
+    return false;
+  }
+  return expanded > compressed * kMaxCompressionRatio;
+}
+
+// The entry for messages: its name, or its position when the host has none
+// yet.
+std::string Label(const std::string& name, long long index) {
+  return name.empty() ? "#" + std::to_string(index) : name;
+}
+
+}  // namespace
+
+bool IsReservedEntryName(const std::string& name) {
+  const std::string prefix = install_record::kReservedPrefix;
+  size_t start = 0;
+  while (start <= name.size()) {
+    size_t end = name.find_first_of("/\\", start);
+    if (end == std::string::npos) {
+      end = name.size();
+    }
+    if (name.compare(start, prefix.size(), prefix) == 0 &&
+        end - start >= prefix.size()) {
+      return true;
+    }
+    start = end + 1;
+  }
+  return false;
+}
+
+Status CheckEntryCount(long long entries) {
+  if (entries > kMaxEntries) {
+    return Status::Error("archive has too many entries (> " +
+                         std::to_string(kMaxEntries) + ")");
+  }
+  return Status::Ok();
+}
+
+Status CheckUncompressedSize(long long archive_bytes, long long uncompressed_bytes) {
+  if (uncompressed_bytes > kMaxTotalUncompressedBytes) {
+    return Status::Error("archive expands beyond " +
+                         std::to_string(kMaxTotalUncompressedBytes) + " bytes (" +
+                         std::to_string(uncompressed_bytes) + ")");
+  }
+  if (ExceedsRatio(uncompressed_bytes, archive_bytes)) {
+    return Status::Error("archive compression ratio exceeds " +
+                         std::to_string(kMaxCompressionRatio) + ":1 (" +
+                         std::to_string(uncompressed_bytes) + "/" +
+                         std::to_string(archive_bytes) + ")");
+  }
+  return Status::Ok();
+}
+
+EntryAccumulator::EntryAccumulator(long long archive_bytes)
+    : archive_bytes_(archive_bytes) {}
+
+Status EntryAccumulator::Accept(long long uncompressed_size,
+                                long long compressed_size,
+                                bool is_symlink,
+                                const std::string& name) {
+  Status status = Add(uncompressed_size, is_symlink, name);
+  if (status.ok && ExceedsRatio(uncompressed_size, compressed_size)) {
+    return Status::Error("archive entry compression ratio too high: " +
+                         Label(name, entries_ - 1));
+  }
+  return status;
+}
+
+Status EntryAccumulator::AcceptExtracted(long long size,
+                                         bool is_symlink,
+                                         const std::string& name) {
+  return Add(size, is_symlink, name);
+}
+
+Status EntryAccumulator::Add(long long size,
+                             bool is_symlink,
+                             const std::string& name) {
+  const long long index = entries_++;
+  Status status = CheckEntryCount(entries_);
+  if (!status.ok) {
+    return status;
+  }
+  if (IsReservedEntryName(name)) {
+    return Status::Error("archive contains reserved entry " + name);
+  }
+  if (is_symlink) {
+    return Status::Error("archive entry is a symlink: " + Label(name, index));
+  }
+  if (size < 0) {
+    return Status::Error("archive entry size unknown: " + Label(name, index));
+  }
+  if (size > kMaxEntryBytes) {
+    return Status::Error("archive entry too large: " + Label(name, index) + " (" +
+                         std::to_string(size) + " bytes)");
+  }
+  total_uncompressed_ += size;
+  return CheckUncompressedSize(archive_bytes_, total_uncompressed_);
+}
+
+Status CheckExtractedDirectory(const std::string& dir, long long archive_bytes) {
+  EntryAccumulator accumulator(archive_bytes);
+  // Relative paths of the directories still to list; "" is `dir` itself.
+  std::vector<std::string> pending(1);
+  while (!pending.empty()) {
+    const std::string relative = std::move(pending.back());
+    pending.pop_back();
+    const std::string path = relative.empty() ? dir : dir + "/" + relative;
+    DIR* handle = opendir(path.c_str());
+    if (handle == nullptr) {
+      return Status::Error("cannot list extracted directory " + path);
+    }
+    Status status = Status::Ok();
+    while (status.ok) {
+      const dirent* item = readdir(handle);
+      if (item == nullptr) {
+        break;
+      }
+      const std::string name = item->d_name;
+      if (name == "." || name == "..") {
+        continue;
+      }
+      const std::string child = relative.empty() ? name : relative + "/" + name;
+      struct stat st;
+      if (lstat((dir + "/" + child).c_str(), &st) != 0) {
+        status = Status::Error("cannot stat extracted entry " + child);
+        break;
+      }
+      // Directories are walked but not counted: the zip may omit directory
+      // entries, and iOS/Android count only what the archive declares.
+      if (S_ISDIR(st.st_mode)) {
+        if (IsReservedEntryName(child)) {
+          status = Status::Error("archive contains reserved entry " + child);
+        } else {
+          pending.push_back(child);
+        }
+        continue;
+      }
+      status = accumulator.AcceptExtracted(static_cast<long long>(st.st_size),
+                                           S_ISLNK(st.st_mode), child);
+    }
+    closedir(handle);
+    if (!status.ok) {
+      return status;
+    }
+  }
+  return Status::Ok();
+}
+
+FreeSpaceProbe PlanUnknownLengthFreeSpaceProbe(long long known_total,
+                                               long long written_before,
+                                               long long chunk_bytes,
+                                               long long reserved_until) {
+  FreeSpaceProbe plan;
+  plan.reserve = chunk_bytes > kUnknownLengthFreeSpaceProbeBytes
+                     ? chunk_bytes
+                     : kUnknownLengthFreeSpaceProbeBytes;
+  plan.reserved_until = reserved_until;
+  if (known_total > 0 || written_before + chunk_bytes <= reserved_until) {
+    return plan;
+  }
+  plan.probe = true;
+  plan.reserved_until = written_before + plan.reserve;
+  return plan;
+}
+
+}  // namespace archive_limits
+}  // namespace pushy

package/cpp/patch_core/archive_limits.h

@@ -1,16 +1,31 @@
 #ifndef PUSHY_PATCH_CORE_ARCHIVE_LIMITS_H_
 #define PUSHY_PATCH_CORE_ARCHIVE_LIMITS_H_
 
+#include <string>
+
+#include "patch_core.h"
+
 // Single source of truth for the resource caps applied to an update package
-// before and while it is unpacked. A corrupt or hostile archive must be able
-// to cost at most a bounded amount of disk, memory and time — never a full
-// disk or a zip bomb. The caps are generous for real packages (a large full
-// bundle with assets is tens of MB) and exist purely as damage bounds.
+// before and while it is unpacked, and for the accounting that enforces them.
+// A corrupt or hostile archive must be able to cost at most a bounded amount
+// of disk, memory and time — never a full disk or a zip bomb. The caps are
+// generous for real packages (a large full bundle with assets is tens of MB)
+// and exist purely as damage bounds.
 //
-// Mirrors that cannot include this header MUST stay in sync by hand:
-//   - android/.../ArchiveLimits.java
-//   - harmony/pushy/src/main/ets/ArchiveLimits.ts
-// iOS (RCTPushy.mm) includes this header directly.
+// Every platform runs the rules below (archive_limits.cpp):
+//   - Android: SafeZipFile.inspect hands the central directory to
+//     CheckArchiveEntries, and DownloadTask plans its free-space probes, over
+//     JNI (cpp/android_jni/archive_limits_jni.cpp);
+//   - iOS: RCTPushyInstaller.mm feeds an EntryAccumulator from the unzip
+//     delegate, RCTPushyDownloader.mm plans its probes;
+//   - Harmony: zlib only reports the whole archive's expansion, so
+//     DownloadTask.ts checks it with CheckUncompressedSize before unpacking
+//     and CheckExtractedDirectory after, over NAPI (pushy.cpp).
+// The constants a host still compares against itself (download caps, the
+// manifest cap, the free-space margin, the streamed-bytes backstop) are
+// mirrored in android/.../ArchiveLimits.java and
+// harmony/pushy/src/main/ets/ArchiveLimits.ts;
+// scripts/check-constant-parity.js (part of `bun lint`) asserts they match.
 
 // Keep the core internal to whichever binary links it (see podspec Core).
 #pragma GCC visibility push(hidden)
@@ -18,6 +33,8 @@
 namespace pushy {
 namespace archive_limits {
 
+using delta::Status;
+
 // Downloaded archive (Content-Length up front, streamed bytes as backstop).
 constexpr long long kMaxArchiveBytes = 512LL * 1024 * 1024;
 // Sum of every entry's uncompressed size.
@@ -26,8 +43,9 @@ constexpr long long kMaxTotalUncompressedBytes = 2048LL * 1024 * 1024;
 constexpr long long kMaxEntryBytes = 512LL * 1024 * 1024;
 // Number of entries in one archive.
 constexpr long long kMaxEntries = 20000;
-// Per-entry uncompressed/compressed ratio, checked only above
-// kRatioCheckMinBytes (tiny highly-compressible files are legitimate).
+// Uncompressed/compressed ratio, of each entry and of the archive as a whole,
+// checked only above kRatioCheckMinBytes of expansion (tiny highly
+// compressible files are legitimate).
 constexpr long long kMaxCompressionRatio = 100;
 constexpr long long kRatioCheckMinBytes = 1LL * 1024 * 1024;
 // __diff.json is parsed fully in memory.
@@ -41,6 +59,77 @@ constexpr long long kFreeDiskMarginBytes = 64LL * 1024 * 1024;
 // reserves its own size), so no write can ever eat into the margin.
 constexpr long long kUnknownLengthFreeSpaceProbeBytes = 8LL * 1024 * 1024;
 
+// Whether any component of an archive path ('/' or '\\' separated) starts
+// with install_record::kReservedPrefix. Those names belong to the SDK (the
+// completion record): a package unpacking its own record next to a bundle
+// would be trusted as a finished install even if the steps after it fail.
+bool IsReservedEntryName(const std::string& name);
+
+// The entry count of a whole archive (iOS knows it before the first entry).
+Status CheckEntryCount(long long entries);
+
+// The whole archive: its total expansion and its overall ratio. An archive of
+// unknown (non-positive) size has no ratio to trust and fails it once the
+// expansion is past kRatioCheckMinBytes.
+Status CheckUncompressedSize(long long archive_bytes, long long uncompressed_bytes);
+
+// Per-entry accounting while an archive is walked, before (Android, iOS) or
+// right after (Harmony) its bytes land. Each Accept checks, in order: the
+// entry count, a reserved name, a symlink, the entry's own size (negative =
+// unknown is refused), the running total and whole-archive ratio
+// (CheckUncompressedSize), and the entry's ratio. The first failure is the
+// verdict; the caller stops there.
+class EntryAccumulator {
+ public:
+  // archive_bytes: the archive file's size, for the whole-archive ratio.
+  explicit EntryAccumulator(long long archive_bytes);
+
+  // An entry as the central directory declares it. `name` is the path inside
+  // the archive; a host that only learns it once the entry is on disk (iOS)
+  // passes "" and checks the name then with IsReservedEntryName. A
+  // non-positive compressed size with an expansion past kRatioCheckMinBytes
+  // is an unbounded ratio.
+  Status Accept(long long uncompressed_size,
+                long long compressed_size,
+                bool is_symlink,
+                const std::string& name);
+
+  // An entry already on disk whose compressed size the host never saw
+  // (Harmony): everything but the entry's own ratio; the whole archive's
+  // ratio still applies.
+  Status AcceptExtracted(long long size, bool is_symlink, const std::string& name);
+
+  long long entries() const { return entries_; }
+  long long total_uncompressed() const { return total_uncompressed_; }
+
+ private:
+  Status Add(long long size, bool is_symlink, const std::string& name);
+
+  long long archive_bytes_;
+  long long entries_ = 0;
+  long long total_uncompressed_ = 0;
+};
+
+// Walks a freshly unpacked directory (iteratively, symlinks not followed)
+// through an EntryAccumulator: every file and directory below `dir` is one
+// entry named by its path relative to `dir`, a directory weighing 0 bytes.
+Status CheckExtractedDirectory(const std::string& dir, long long archive_bytes);
+
+// Before each chunk of a download is written. `known_total` > 0 means the
+// response announced its length (checked once when it arrived: no probe);
+// written_before counts this response's body bytes before the chunk.
+struct FreeSpaceProbe {
+  // Probe the disk for `reserve` bytes (plus kFreeDiskMarginBytes) first.
+  bool probe = false;
+  long long reserve = 0;
+  // The reservation after this chunk, relative to the start of the body.
+  long long reserved_until = 0;
+};
+FreeSpaceProbe PlanUnknownLengthFreeSpaceProbe(long long known_total,
+                                               long long written_before,
+                                               long long chunk_bytes,
+                                               long long reserved_until);
+
 }  // namespace archive_limits
 }  // namespace pushy
 

package/cpp/patch_core/archive_patch_core.cpp

@@ -1,5 +1,8 @@
 #include "archive_patch_core.h"
 
+#include <unordered_map>
+#include <utility>
+
 #include "obscured_text.h"
 
 namespace pushy {
@@ -100,24 +103,105 @@ delta::Status BuildCopyGroups(
     return manifest_status;
   }
 
-  out_groups->clear();
+  // Groups in order of first appearance; the index keeps this linear in the
+  // number of copies (a package diff copies thousands of resources).
+  std::vector<CopyGroup> groups;
+  std::unordered_map<std::string, size_t> group_by_source;
   for (const delta::CopyOperation& copy : manifest.copies) {
-    bool appended = false;
-    for (CopyGroup& group : *out_groups) {
-      if (group.from == copy.from) {
-        group.to_paths.push_back(copy.to);
-        appended = true;
-        break;
-      }
-    }
-    if (!appended) {
+    const auto inserted = group_by_source.emplace(copy.from, groups.size());
+    if (inserted.second) {
       CopyGroup group;
       group.from = copy.from;
-      group.to_paths.push_back(copy.to);
-      out_groups->push_back(group);
+      groups.push_back(std::move(group));
+    }
+    CopyGroup& group = groups[inserted.first->second];
+    group.to_paths.push_back(copy.to);
+    if (copy.has_expected_crc) {
+      group.has_expected_crc = true;
+      group.expected_crc = copy.expected_crc;
     }
   }
+  *out_groups = std::move(groups);
+
+  return delta::Status::Ok();
+}
 
+delta::Status PlanArchivePatch(
+    const ArchivePatchInput& input,
+    ArchivePatchPlan* out_plan) {
+  if (out_plan == nullptr) {
+    return delta::Status::Error("Archive plan output is required");
+  }
+  if (input.type == ArchivePatchType::kFull) {
+    return BuildArchivePatchPlan(
+        input.type, delta::PatchManifest(), input.entry_names, out_plan,
+        input.bundle_patch_entry_name);
+  }
+  // Missing entries first: an archive without __diff.json has no text to
+  // parse, and the entry error is the one worth reporting.
+  if (!HasEntry(input.entry_names, kManifestEntryName)) {
+    return delta::Status::Error("diff.json not found");
+  }
+  if (!HasEntry(input.entry_names, input.bundle_patch_entry_name)) {
+    return delta::Status::Error("bundle delta not found");
+  }
+  delta::PatchManifestOptions options;
+  options.bundle_patch_entry_name = input.bundle_patch_entry_name;
+  options.copy_source_prefix = input.copy_source_prefix;
+  delta::PatchManifest manifest;
+  delta::Status status =
+      delta::ParsePatchManifest(input.manifest_json, options, &manifest);
+  if (!status.ok) {
+    return status;
+  }
+  return BuildArchivePatchPlan(
+      input.type, manifest, input.entry_names, out_plan,
+      input.bundle_patch_entry_name);
+}
+
+delta::Status ApplyArchivePatch(
+    const ArchivePatchRequest& request,
+    std::vector<CopyGroup>* out_host_copies,
+    const delta::BundleRebuilder& bundle_patcher) {
+  if (request.archive.type == ArchivePatchType::kFull) {
+    return delta::Status::Error("A full package has no delta to apply");
+  }
+  if (request.host_copies_resources && out_host_copies == nullptr) {
+    return delta::Status::Error("Host copy groups output is required");
+  }
+  if (out_host_copies != nullptr) {
+    out_host_copies->clear();
+  }
+  ArchivePatchPlan plan;
+  delta::Status status = PlanArchivePatch(request.archive, &plan);
+  if (!status.ok) {
+    return status;
+  }
+  delta::FileSourcePatchOptions options;
+  status = BuildFileSourcePatchOptions(
+      plan, request.source_root, request.target_root,
+      request.origin_bundle_path, request.bundle_patch_path,
+      request.bundle_output_path, &options);
+  if (!status.ok) {
+    return status;
+  }
+  std::vector<CopyGroup> host_copies;
+  if (request.host_copies_resources) {
+    status = BuildCopyGroups(plan.manifest, &host_copies);
+    if (!status.ok) {
+      return status;
+    }
+    options.manifest.copies.clear();
+    options.manifest.deletes.clear();
+    options.enable_merge = false;
+  }
+  status = delta::ApplyPatchFromFileSource(options, bundle_patcher);
+  if (!status.ok) {
+    return status;
+  }
+  if (out_host_copies != nullptr) {
+    *out_host_copies = std::move(host_copies);
+  }
   return delta::Status::Ok();
 }
 

package/cpp/patch_core/archive_patch_core.h

@@ -1,9 +1,11 @@
 #pragma once
 
+#include <cstdint>
 #include <string>
 #include <vector>
 
 #include "patch_core.h"
+#include "patch_manifest.h"
 
 // Keep the core internal to whichever binary links it (see podspec Core).
 #pragma GCC visibility push(hidden)
@@ -22,9 +24,13 @@ enum class EntryAction {
   kExtract = 1,
 };
 
+// Every copy of one source. The manifest parser guarantees that copies of
+// one source never declare different CRCs, so a group has at most one.
 struct CopyGroup {
   std::string from;
   std::vector<std::string> to_paths;
+  bool has_expected_crc = false;
+  uint32_t expected_crc = 0;
 };
 
 struct ArchivePatchPlan {
@@ -58,6 +64,49 @@ delta::Status BuildCopyGroups(
     const delta::PatchManifest& manifest,
     std::vector<CopyGroup>* out_groups);
 
+// What a staged patch archive declared: its entry names and the text of its
+// __diff.json (empty when the archive has none).
+struct ArchivePatchInput {
+  ArchivePatchType type = ArchivePatchType::kFull;
+  std::vector<std::string> entry_names;
+  std::string manifest_json;
+  std::string bundle_patch_entry_name = DefaultBundleDeltaEntryName();
+  // See PatchManifestOptions::copy_source_prefix (HarmonyOS rawfiles).
+  std::string copy_source_prefix;
+};
+
+// The patch types need the manifest and the bundle patch among the entries;
+// the manifest is then parsed (ParsePatchManifest) and the merge planned.
+// A full package plans nothing and ignores manifest_json.
+delta::Status PlanArchivePatch(
+    const ArchivePatchInput& input,
+    ArchivePatchPlan* out_plan);
+
+struct ArchivePatchRequest {
+  ArchivePatchInput archive;
+  std::string source_root;
+  std::string target_root;
+  std::string origin_bundle_path;
+  std::string bundle_patch_path;
+  std::string bundle_output_path;
+  // The package's resources are not files under source_root (Android APK
+  // entries, HarmonyOS rawfiles): only the bundle is rebuilt here, there is
+  // nothing to merge, and the host performs the manifest's copies itself
+  // from the groups handed back.
+  bool host_copies_resources = false;
+};
+
+// PlanArchivePatch + ApplyPatchFromFileSource: the whole native half of a
+// patch install, driven by the manifest text so the platforms never parse
+// __diff.json themselves. With host_copies_resources, *out_host_copies (which
+// must then be non-null) receives the grouped copies the host still owes;
+// otherwise it is left empty. Full packages are rejected.
+delta::Status ApplyArchivePatch(
+    const ArchivePatchRequest& request,
+    std::vector<CopyGroup>* out_host_copies,
+    const delta::BundleRebuilder& bundle_patcher =
+        delta::DefaultBundleRebuilder());
+
 delta::Status BuildFileSourcePatchOptions(
     const ArchivePatchPlan& plan,
     const std::string& source_root,

package/cpp/patch_core/digest.h

@@ -15,10 +15,11 @@ namespace digest {
 // (IO-6). Streaming because Android/Harmony read the bundle from the package
 // (AssetManager / rawfile) rather than from a plain file.
 //
-// Android intentionally does NOT use this implementation: librnpushy.so is a
-// prebuilt artifact, so the Java layer hashes with java.security.MessageDigest
-// instead. The NIST vectors in the tests anchor both implementations to the
-// same standard.
+// Android hashes in Java with java.security.MessageDigest instead (backed by
+// the platform's native crypto provider): the bytes come from AssetManager
+// streams and download sinks on the Java side, so a JNI round trip per chunk
+// would buy nothing. The NIST vectors in the tests anchor both
+// implementations to the same standard.
 class Sha256 {
  public:
   Sha256();

package/cpp/patch_core/error_codes.h

@@ -6,10 +6,12 @@
 // so the JS layer (src/error.ts UpdateErrorCode) and user loggers can
 // aggregate errors across platforms and locales.
 //
-// Mirrors that cannot include this header MUST stay in sync by hand:
-//   - src/error.ts                      (UpdateErrorCode union, JS layer)
+// Mirrors that cannot include this header MUST stay in sync by hand
+// (scripts/check-constant-parity.js, part of `bun lint`, asserts they do):
+//   - src/error.ts                      (UpdateErrorCode, JS layer)
 //   - android/.../ErrorCodes.java      (Java constants)
-// iOS (RCTPushy.mm) includes this header directly.
+//   - harmony/pushy/src/main/ets/ErrorCodes.ts
+// iOS (ios/RCTPushy/*.mm) includes this header directly.
 //
 // Human-readable messages are NOT part of this contract: they may differ per
 // platform and locale. Only the codes are stable.