react-native-update 7.4.0 → 7.4.3

package/android/src/main/java/cn/reactnative/modules/update/SafeZipFile.java

@@ -16,6 +16,40 @@ public class SafeZipFile extends ZipFile {
         super(file);
     }
 
+    @Override
+    public Enumeration<? extends ZipEntry> entries() {
+        return new SafeZipEntryIterator(super.entries());
+    }
+
+    private static class SafeZipEntryIterator implements Enumeration<ZipEntry> {
+
+        final private Enumeration<? extends ZipEntry> delegate;
+
+        private SafeZipEntryIterator(Enumeration<? extends ZipEntry> delegate) {
+            this.delegate = delegate;
+        }
+
+        @Override
+        public boolean hasMoreElements() {
+            return delegate.hasMoreElements();
+        }
+
+        @Override
+        public ZipEntry nextElement() {
+            ZipEntry entry = delegate.nextElement();
+            if (null != entry) {
+                String name = entry.getName();
+                /**
+                 * avoid ZipperDown
+                 */
+                if (null != name && (name.contains("../") || name.contains("..\\"))) {
+                    throw new SecurityException("illegal entry: " + entry.getName());
+                }
+            }
+            return entry;
+        }
+    }
+
     public void unzipToFile(ZipEntry entry, File output) throws IOException {
         InputStream inputStream = null;
         try {
@@ -29,11 +63,6 @@ public class SafeZipFile extends ZipFile {
     }
 
     private void writeOutInputStream(File file, InputStream inputStream) throws IOException {
-        // https://support.google.com/faqs/answer/9294009
-        String canonicalPath = file.getCanonicalPath();
-        if (!canonicalPath.startsWith(UpdateContext.getRootDir())) {
-            throw new SecurityException("illegal entry: " + file.getName());
-        }
         BufferedOutputStream output = null;
         try {
             output = new BufferedOutputStream(

package/android/src/main/java/cn/reactnative/modules/update/UpdateContext.java

@@ -19,14 +19,13 @@ import java.io.File;
 
 public class UpdateContext {
     private Context context;
-    private static File rootDir;
+    private File rootDir;
     private Executor executor;
 
     public static boolean DEBUG = false;
     private static ReactInstanceManager mReactInstanceManager;
     private static boolean isUsingBundleUrl = false;
 
-
     public UpdateContext(Context context) {
         this.context = context;
         this.executor = Executors.newSingleThreadExecutor();
@@ -50,7 +49,7 @@ public class UpdateContext {
         }
     }
 
-    public static String getRootDir() {
+    public String getRootDir() {
         return rootDir.toString();
     }
 

package/ios/pushy_build_time.txt

@@ -1 +1 @@
-1574665292
+1654072539

package/lib/main.js

@@ -181,11 +181,7 @@ export async function downloadUpdate(options, eventListeners) {
   }
   if (downloadedHash === options.hash) {
     logger(`duplicated downloaded hash ${downloadedHash}, ignored`);
-    return;
-  }
-  if (readyHash) {
-    logger(`hash ${readyHash} applied. reboot first`);
-    return;
+    return downloadedHash;
   }
   if (downloadingThrottling) {
     logger('repeated downloading, ignored');
@@ -261,7 +257,6 @@ export async function downloadUpdate(options, eventListeners) {
   return options.hash;
 }
 
-let readyHash;
 function assertHash(hash) {
   if (!downloadedHash) {
     logger(`no downloaded hash`);
@@ -271,11 +266,6 @@ function assertHash(hash) {
     logger(`use downloaded hash ${downloadedHash} first`);
     return;
   }
-  if (readyHash === hash) {
-    logger(`hash ${readyHash} already applied. reboot first.`);
-    return;
-  }
-  readyHash = hash;
   return true;
 }
 

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "react-native-update",
-  "version": "7.4.0",
+  "version": "7.4.3",
   "description": "react-native hot update",
   "main": "lib/index.js",
   "scripts": {
+    "prepublish": "yarn submodule",
     "submodule": "git submodule update --init --recursive",
     "test": "echo \"Error: no test specified\" && exit 1",
     "build-lib": "yarn submodule && $ANDROID_HOME/ndk/20.1.5948944/ndk-build NDK_PROJECT_PATH=android APP_BUILD_SCRIPT=android/jni/Android.mk NDK_APPLICATION_MK=android/jni/Application.mk NDK_LIBS_OUT=android/lib"