react-native-update 7.4.0 → 7.4.1

package/android/src/main/java/cn/reactnative/modules/update/SafeZipFile.java

@@ -16,6 +16,40 @@ public class SafeZipFile extends ZipFile {
         super(file);
     }
 
+    @Override
+    public Enumeration<? extends ZipEntry> entries() {
+        return new SafeZipEntryIterator(super.entries());
+    }
+
+    private static class SafeZipEntryIterator implements Enumeration<ZipEntry> {
+
+        final private Enumeration<? extends ZipEntry> delegate;
+
+        private SafeZipEntryIterator(Enumeration<? extends ZipEntry> delegate) {
+            this.delegate = delegate;
+        }
+
+        @Override
+        public boolean hasMoreElements() {
+            return delegate.hasMoreElements();
+        }
+
+        @Override
+        public ZipEntry nextElement() {
+            ZipEntry entry = delegate.nextElement();
+            if (null != entry) {
+                String name = entry.getName();
+                /**
+                 * avoid ZipperDown
+                 */
+                if (null != name && (name.contains("../") || name.contains("..\\"))) {
+                    throw new SecurityException("illegal entry: " + entry.getName());
+                }
+            }
+            return entry;
+        }
+    }
+
     public void unzipToFile(ZipEntry entry, File output) throws IOException {
         InputStream inputStream = null;
         try {
@@ -29,11 +63,6 @@ public class SafeZipFile extends ZipFile {
     }
 
     private void writeOutInputStream(File file, InputStream inputStream) throws IOException {
-        // https://support.google.com/faqs/answer/9294009
-        String canonicalPath = file.getCanonicalPath();
-        if (!canonicalPath.startsWith(UpdateContext.getRootDir())) {
-            throw new SecurityException("illegal entry: " + file.getName());
-        }
         BufferedOutputStream output = null;
         try {
             output = new BufferedOutputStream(

package/android/src/main/java/cn/reactnative/modules/update/UpdateContext.java

@@ -19,14 +19,13 @@ import java.io.File;
 
 public class UpdateContext {
     private Context context;
-    private static File rootDir;
+    private File rootDir;
     private Executor executor;
 
     public static boolean DEBUG = false;
     private static ReactInstanceManager mReactInstanceManager;
     private static boolean isUsingBundleUrl = false;
 
-
     public UpdateContext(Context context) {
         this.context = context;
         this.executor = Executors.newSingleThreadExecutor();
@@ -50,7 +49,7 @@ public class UpdateContext {
         }
     }
 
-    public static String getRootDir() {
+    public String getRootDir() {
         return rootDir.toString();
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update",
-  "version": "7.4.0",
+  "version": "7.4.1",
   "description": "react-native hot update",
   "main": "lib/index.js",
   "scripts": {