v7.4.0-beta.0

android/src/main/java/cn/reactnative/modules/update/SafeZipFile.java

@@ -16,40 +16,6 @@ public class SafeZipFile extends ZipFile {
         super(file);
     }
 
-    @Override
-    public Enumeration<? extends ZipEntry> entries() {
-        return new SafeZipEntryIterator(super.entries());
-    }
-
-    private static class SafeZipEntryIterator implements Enumeration<ZipEntry> {
-
-        final private Enumeration<? extends ZipEntry> delegate;
-
-        private SafeZipEntryIterator(Enumeration<? extends ZipEntry> delegate) {
-            this.delegate = delegate;
-        }
-
-        @Override
-        public boolean hasMoreElements() {
-            return delegate.hasMoreElements();
-        }
-
-        @Override
-        public ZipEntry nextElement() {
-            ZipEntry entry = delegate.nextElement();
-            if (null != entry) {
-                String name = entry.getName();
-                /**
-                 * avoid ZipperDown
-                 */
-                if (null != name && (name.contains("../") || name.contains("..\\"))) {
-                    throw new SecurityException("illegal entry: " + entry.getName());
-                }
-            }
-            return entry;
-        }
-    }
-
     public void unzipToFile(ZipEntry entry, File output) throws IOException {
         InputStream inputStream = null;
         try {
@@ -63,6 +29,11 @@ public class SafeZipFile extends ZipFile {
     }
 
     private void writeOutInputStream(File file, InputStream inputStream) throws IOException {
+        // https://support.google.com/faqs/answer/9294009
+        String canonicalPath = file.getCanonicalPath();
+        if (!canonicalPath.startsWith(UpdateContext.getRootDir())) {
+            throw new SecurityException("illegal entry: " + file.getName());
+        }
         BufferedOutputStream output = null;
         try {
             output = new BufferedOutputStream(

android/src/main/java/cn/reactnative/modules/update/UpdateContext.java

@@ -19,13 +19,14 @@ import java.io.File;
 
 public class UpdateContext {
     private Context context;
-    private File rootDir;
+    private static File rootDir;
     private Executor executor;
 
     public static boolean DEBUG = false;
     private static ReactInstanceManager mReactInstanceManager;
     private static boolean isUsingBundleUrl = false;
 
+
     public UpdateContext(Context context) {
         this.context = context;
         this.executor = Executors.newSingleThreadExecutor();
@@ -49,7 +50,7 @@ public class UpdateContext {
         }
     }
 
-    public String getRootDir() {
+    public static String getRootDir() {
         return rootDir.toString();
     }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update",
-  "version": "7.3.8",
+  "version": "7.4.0-beta.0",
   "description": "react-native hot update",
   "main": "lib/index.js",
   "scripts": {

yarn.lock

@@ -2,7 +2,7 @@
 # yarn lockfile v1
 
 
-nanoid@^3.1.28:
+nanoid@^3.1.30:
-  version "3.1.28"
+  version "3.1.30"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.1.28.tgz#3c01bac14cb6c5680569014cc65a2f26424c6bd4"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.1.30.tgz#63f93cc548d2a113dc5dfbc63bfa09e2b9b64362"
-  integrity sha512-gSu9VZ2HtmoKYe/lmyPFES5nknFrHa+/DT9muUFWFMi6Jh9E1I7bkvlQ8xxf1Kos9pi9o8lBnIOkatMhKX/YUw==
+  integrity sha512-zJpuPDwOv8D2zq2WRoMe1HsfZthVewpel9CAvTfc/2mBD1uUT/agc5f7GHGWXlYkFvi1mVxe4IjvP2HNrop7nQ==