mirror/react-native-update
1
0
Fork 0
mirror of https://gitcode.com/gh_mirrors/re/react-native-pushy.git synced 2025-10-31 21:33:12 +08:00
Code Issues Packages Projects Releases Wiki Activity GitHub Gitee

Try fix safezip for google play

Browse Source
This commit is contained in:
sunnylqm
2022-01-19 21:29:35 +08:00
parent 2ae4180840
commit 3ebf6e95c9
2 changed files with 8 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
android/src/main/java/cn/reactnative/modules/update/SafeZipFile.java
View File

@@ -16,40 +16,6 @@ public class SafeZipFile extends ZipFile {
super(file); super(file);
} }
@Override
public Enumeration<? extends ZipEntry> entries() {
return new SafeZipEntryIterator(super.entries());
}
private static class SafeZipEntryIterator implements Enumeration<ZipEntry> {
final private Enumeration<? extends ZipEntry> delegate;
private SafeZipEntryIterator(Enumeration<? extends ZipEntry> delegate) {
this.delegate = delegate;
}
@Override
public boolean hasMoreElements() {
return delegate.hasMoreElements();
}
@Override
public ZipEntry nextElement() {
ZipEntry entry = delegate.nextElement();
if (null != entry) {
String name = entry.getName();
/**
* avoid ZipperDown
*/
if (null != name && (name.contains("../") || name.contains("..\\"))) {
throw new SecurityException("illegal entry: " + entry.getName());
}
}
return entry;
}
}
public void unzipToFile(ZipEntry entry, File output) throws IOException { public void unzipToFile(ZipEntry entry, File output) throws IOException {
InputStream inputStream = null; InputStream inputStream = null;
try { try {
@@ -63,6 +29,11 @@ public class SafeZipFile extends ZipFile {
} }
private void writeOutInputStream(File file, InputStream inputStream) throws IOException { private void writeOutInputStream(File file, InputStream inputStream) throws IOException {
// https://support.google.com/faqs/answer/9294009
String canonicalPath = file.getCanonicalPath();
if (!canonicalPath.startsWith(UpdateContext.getRootDir())) {
throw new SecurityException("illegal entry: " + file.getName());
}
BufferedOutputStream output = null; BufferedOutputStream output = null;
try { try {
output = new BufferedOutputStream( output = new BufferedOutputStream(

5
android/src/main/java/cn/reactnative/modules/update/UpdateContext.java
View File

@@ -19,13 +19,14 @@ import java.io.File;
public class UpdateContext { public class UpdateContext {
private Context context; private Context context;
private File rootDir; private static File rootDir;
private Executor executor; private Executor executor;
public static boolean DEBUG = false; public static boolean DEBUG = false;
private static ReactInstanceManager mReactInstanceManager; private static ReactInstanceManager mReactInstanceManager;
private static boolean isUsingBundleUrl = false; private static boolean isUsingBundleUrl = false;
public UpdateContext(Context context) { public UpdateContext(Context context) {
this.context = context; this.context = context;
this.executor = Executors.newSingleThreadExecutor(); this.executor = Executors.newSingleThreadExecutor();
@@ -49,7 +50,7 @@ public class UpdateContext {
} }
} }
public String getRootDir() { public static String getRootDir() {
return rootDir.toString(); return rootDir.toString();
} }