v7.4.0

Update https://registry.npm.taobao.org to https://registry.npmmirror.com

Example/testHotUpdate/.npmrc

@@ -1 +1 @@
-registry=https://registry.npm.taobao.org/
+registry=https://registry.npmmirror.com/

Example/testHotUpdate/src/index.js

@@ -68,6 +68,9 @@ export default class App extends Component {
           });
         },
       });
+      if (!hash) {
+        return;
+      }
       Alert.alert('提示', '下载完毕,是否重启应用?', [
         {
           text: '是',

android/src/main/java/cn/reactnative/modules/update/SafeZipFile.java

@@ -16,40 +16,6 @@ public class SafeZipFile extends ZipFile {
         super(file);
     }
 
-    @Override
-    public Enumeration<? extends ZipEntry> entries() {
-        return new SafeZipEntryIterator(super.entries());
-    }
-
-    private static class SafeZipEntryIterator implements Enumeration<ZipEntry> {
-
-        final private Enumeration<? extends ZipEntry> delegate;
-
-        private SafeZipEntryIterator(Enumeration<? extends ZipEntry> delegate) {
-            this.delegate = delegate;
-        }
-
-        @Override
-        public boolean hasMoreElements() {
-            return delegate.hasMoreElements();
-        }
-
-        @Override
-        public ZipEntry nextElement() {
-            ZipEntry entry = delegate.nextElement();
-            if (null != entry) {
-                String name = entry.getName();
-                /**
-                 * avoid ZipperDown
-                 */
-                if (null != name && (name.contains("../") || name.contains("..\\"))) {
-                    throw new SecurityException("illegal entry: " + entry.getName());
-                }
-            }
-            return entry;
-        }
-    }
-
     public void unzipToFile(ZipEntry entry, File output) throws IOException {
         InputStream inputStream = null;
         try {
@@ -63,6 +29,11 @@ public class SafeZipFile extends ZipFile {
     }
 
     private void writeOutInputStream(File file, InputStream inputStream) throws IOException {
+        // https://support.google.com/faqs/answer/9294009
+        String canonicalPath = file.getCanonicalPath();
+        if (!canonicalPath.startsWith(UpdateContext.getRootDir())) {
+            throw new SecurityException("illegal entry: " + file.getName());
+        }
         BufferedOutputStream output = null;
         try {
             output = new BufferedOutputStream(

android/src/main/java/cn/reactnative/modules/update/UpdateContext.java

@@ -19,13 +19,14 @@ import java.io.File;
 
 public class UpdateContext {
     private Context context;
-    private File rootDir;
+    private static File rootDir;
     private Executor executor;
 
     public static boolean DEBUG = false;
     private static ReactInstanceManager mReactInstanceManager;
     private static boolean isUsingBundleUrl = false;
 
+
     public UpdateContext(Context context) {
         this.context = context;
         this.executor = Executors.newSingleThreadExecutor();
@@ -49,7 +50,7 @@ public class UpdateContext {
         }
     }
 
-    public String getRootDir() {
+    public static String getRootDir() {
         return rootDir.toString();
     }
 

android/src/main/java/cn/reactnative/modules/update/UpdateModule.java

@@ -70,7 +70,7 @@ public class UpdateModule extends ReactContextBaseJavaModule {
     }
 
     @ReactMethod
-    public void downloadUpdate(ReadableMap options, final Promise promise) {
+    public void downloadFullUpdate(ReadableMap options, final Promise promise) {
         String url = options.getString("updateUrl");
         String hash = options.getString("hash");
         updateContext.downloadFullUpdate(url, hash, new UpdateContext.DownloadFileListener() {

ios/RCTPushy/RCTPushy.m

@@ -224,7 +224,7 @@ RCT_EXPORT_METHOD(getLocalHashInfo:(NSString *)hash
     resolve([defaults stringForKey:[keyHashInfo stringByAppendingString:hash]]);
 }
 
-RCT_EXPORT_METHOD(downloadUpdate:(NSDictionary *)options
+RCT_EXPORT_METHOD(downloadFullUpdate:(NSDictionary *)options
                   resolver:(RCTPromiseResolveBlock)resolve
                   rejecter:(RCTPromiseRejectBlock)reject)
 {

lib/main.js

@@ -95,7 +95,7 @@ export const cInfo = {
 
 function assertRelease() {
   if (__DEV__) {
-    throw new Error('react-native-update can only run on RELEASE version.');
+    throw new Error('react-native-update 只能在 RELEASE 版本中运行.');
   }
 }
 
@@ -138,7 +138,7 @@ export async function checkUpdate(APPKEY, isRetry) {
     });
   } catch (e) {
     if (isRetry) {
-      throw new Error('Could not connect to pushy server');
+      throw new Error('无法连接更新服务器，请检查网络连接后重试');
     }
     await tryBackupEndpoints(APPKEY);
     return checkUpdate(APPKEY, true);
@@ -175,8 +175,8 @@ export async function downloadUpdate(options, eventListeners) {
   if (!options.update) {
     return;
   }
-  if (rolledbackVersion === options.hash) {
-    logger(`rolledback hash ${rolledbackVersion}, ignored`);
+  if (rolledBackVersion === options.hash) {
+    logger(`rolledback hash ${rolledBackVersion}, ignored`);
     return;
   }
   if (downloadedHash === options.hash) {
@@ -209,6 +209,7 @@ export async function downloadUpdate(options, eventListeners) {
       );
     }
   }
+  let succeeded = false;
   if (options.diffUrl) {
     logger('downloading diff');
     try {
@@ -217,38 +218,45 @@ export async function downloadUpdate(options, eventListeners) {
         hash: options.hash,
         originHash: currentVersion,
       });
+      succeeded = true;
     } catch (e) {
       logger(`diff error: ${e.message}, try pdiff`);
-      try {
-        await Pushy.downloadPatchFromPackage({
-          updateUrl: options.pdiffUrl,
-          hash: options.hash,
-        });
-      } catch (e) {
-        progressHandler && progressHandler.remove();
-        report(options.hash, 'error');
-        return;
-      }
     }
-  } else if (options.pdiffUrl) {
+  }
+  if (!succeeded && options.pdiffUrl) {
     logger('downloading pdiff');
     try {
       await Pushy.downloadPatchFromPackage({
         updateUrl: options.pdiffUrl,
         hash: options.hash,
       });
+      succeeded = true;
     } catch (e) {
-      progressHandler && progressHandler.remove();
-      report(options.hash, 'error');
-      return;
+      logger(`pdiff error: ${e.message}, try full patch`);
     }
   }
+  if (!succeeded && options.updateUrl) {
+    logger('downloading full patch');
+    try {
+      await Pushy.downloadFullUpdate({
+        updateUrl: options.updateUrl,
+        hash: options.hash,
+      });
+      succeeded = true;
+    } catch (e) {
+      logger(`full patch error: ${e.message}`);
+    }
+  }
+  progressHandler && progressHandler.remove();
+  if (!succeeded) {
+    report(options.hash, 'error');
+    throw new Error('all update attempts failed');
+  }
   setLocalHashInfo(options.hash, {
     name: options.name,
     description: options.description,
     metaInfo: options.metaInfo,
   });
-  progressHandler && progressHandler.remove();
   downloadedHash = options.hash;
   return options.hash;
 }
@@ -268,20 +276,23 @@ function assertHash(hash) {
     return;
   }
   readyHash = hash;
+  return true;
 }
 
 export function switchVersion(hash) {
   assertRelease();
-  assertHash(hash);
-  logger('switchVersion: ' + hash);
-  Pushy.reloadUpdate({ hash });
+  if (assertHash(hash)) {
+    logger('switchVersion: ' + hash);
+    Pushy.reloadUpdate({ hash });
+  }
 }
 
 export function switchVersionLater(hash) {
   assertRelease();
-  assertHash(hash);
-  logger('switchVersionLater: ' + hash);
-  Pushy.setNeedUpdate({ hash });
+  if (assertHash(hash)) {
+    logger('switchVersionLater: ' + hash);
+    Pushy.setNeedUpdate({ hash });
+  }
 }
 
 let marked = false;

lib/simpleUpdate.js

@@ -36,12 +36,15 @@ export function simpleUpdate(WrappedComponent) {
           this.checkUpdate();
         }
         componentWillUnmount() {
-          this.stateListener.remove();
+          this.stateListener && this.stateListener.remove();
         }
         doUpdate = async (info) => {
           try {
             const hash = await downloadUpdate(info);
-            this.stateListener.remove();
+            if (!hash) {
+              return;
+            }
+            this.stateListener && this.stateListener.remove();
             Alert.alert('提示', '下载完毕，是否立即更新?', [
               {
                 text: '以后再说',
@@ -91,7 +94,7 @@ export function simpleUpdate(WrappedComponent) {
                 },
               },
             ]);
-          } else {
+          } else if (info.update) {
             Alert.alert(
               '提示',
               '检查到新的版本' + info.name + ',是否下载?\n' + info.description,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update",
-  "version": "7.2.0",
+  "version": "7.4.0",
   "description": "react-native hot update",
   "main": "lib/index.js",
   "scripts": {
@@ -28,6 +28,6 @@
   },
   "homepage": "https://github.com/reactnativecn/react-native-pushy#readme",
   "dependencies": {
-    "nanoid": "^3.1.28"
+    "nanoid": "^3.3.3"
   }
 }

yarn.lock

@@ -2,7 +2,7 @@
 # yarn lockfile v1
 
 
-nanoid@^3.1.28:
-  version "3.1.28"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.1.28.tgz#3c01bac14cb6c5680569014cc65a2f26424c6bd4"
-  integrity sha512-gSu9VZ2HtmoKYe/lmyPFES5nknFrHa+/DT9muUFWFMi6Jh9E1I7bkvlQ8xxf1Kos9pi9o8lBnIOkatMhKX/YUw==
+nanoid@^3.3.3:
+  version "3.3.3"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.3.tgz#fd8e8b7aa761fe807dba2d1b98fb7241bb724a25"
+  integrity sha512-p1sjXuopFs0xg+fPASzQ28agW1oHD7xDsd9Xkf3T15H3c/cifrFHVwrh74PdoklAPi+i7MdRsE47vm2r6JoB+w==