cleanup

android/build.gradle

@@ -9,6 +9,19 @@ def isNewArchitectureEnabled() {
     return project.hasProperty("newArchEnabled") && project.newArchEnabled == "true"
 }
 
+def supportsNamespace() {
+  def parsed = com.android.Version.ANDROID_GRADLE_PLUGIN_VERSION.tokenize('.')
+  def major = parsed[0].toInteger()
+  def minor = parsed[1].toInteger()
+
+  // Namespace support was added in 7.3.0
+  if (major == 7 && minor >= 3) {
+    return true
+  }
+
+  return major >= 8
+}
+
 apply plugin: 'com.android.library'
 if (isNewArchitectureEnabled()) {
     apply plugin: 'com.facebook.react'
@@ -16,6 +29,16 @@ if (isNewArchitectureEnabled()) {
 
 
 android {
+
+    if (supportsNamespace()) {
+        namespace "cn.reactnative.modules.update"
+
+        sourceSets {
+            main {
+                manifest.srcFile "src/main/AndroidManifestNew.xml"
+            }
+        }
+    }
     compileSdkVersion safeExtGet('compileSdkVersion', 28)
     buildToolsVersion safeExtGet('buildToolsVersion', '28.0.3')
 

android/proguard.pro

@@ -1,2 +1,3 @@
 -keepnames class cn.reactnative.modules.update.DownloadTask { *; }
+-keepnames class cn.reactnative.modules.update.UpdateModuleImpl { *; }
 -keepnames class com.facebook.react.ReactInstanceManager { *; }

android/src/main/AndroidManifest.xml

@@ -1,9 +1,5 @@
-<?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     package="cn.reactnative.modules.update">
-    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
-
-    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
     <application>
         <meta-data android:name="pushy_build_time" android:value="@string/pushy_build_time" />
         <provider

android/src/main/AndroidManifestNew.xml

@@ -0,0 +1,14 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <application>
+        <meta-data android:name="pushy_build_time" android:value="@string/pushy_build_time" />
+        <provider
+            android:name=".PushyFileProvider"
+            android:authorities="${applicationId}.pushy.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+            android:name="android.support.FILE_PROVIDER_PATHS"
+            android:resource="@xml/pushy_file_paths" />
+        </provider>
+    </application>
+</manifest>

android/src/main/java/cn/reactnative/modules/update/DownloadTask.java

@@ -237,19 +237,7 @@ class DownloadTask extends AsyncTask<DownloadTaskParams, long[], Void> {
         while (entries.hasMoreElements()) {
             ZipEntry ze = entries.nextElement();
 
-            String fn = ze.getName();
+            zipFile.unzipToPath(ze, param.unzipDirectory);
-            File fmd = new File(param.unzipDirectory, fn);
-
-            if (UpdateContext.DEBUG) {
-                Log.d("RNUpdate", "Unzipping " + fn);
-            }
-
-            if (ze.isDirectory()) {
-                fmd.mkdirs();
-                continue;
-            }
-
-            zipFile.unzipToFile(ze, fmd);
         }
 
         zipFile.close();
@@ -324,8 +312,15 @@ class DownloadTask extends AsyncTask<DownloadTaskParams, long[], Void> {
                     } else {
                         target = copyList.get((from));
                     }
-                    target.add(new File(param.unzipDirectory, to));
+                    File toFile = new File(param.unzipDirectory, to);
-                    //copyFromResource(from, new File(param.unzipDirectory, to));
+
+                    // Fixing a Zip Path Traversal Vulnerability
+                    // https://support.google.com/faqs/answer/9294009
+                    String canonicalPath = toFile.getCanonicalPath();
+                    if (!canonicalPath.startsWith(param.unzipDirectory.getCanonicalPath() + File.separator)) {
+                        throw new SecurityException("Illegal name: " + to);
+                    }
+                    target.add(toFile);
                 }
                 continue;
             }
@@ -339,18 +334,9 @@ class DownloadTask extends AsyncTask<DownloadTaskParams, long[], Void> {
                 fout.close();
                 continue;
             }
-            File fmd = new File(param.unzipDirectory, fn);
 
-            if (UpdateContext.DEBUG) {
-                Log.d("RNUpdate", "Unzipping " + fn);
-            }
 
-            if (ze.isDirectory()) {
+            zipFile.unzipToPath(ze, param.unzipDirectory);
-                fmd.mkdirs();
-                continue;
-            }
-
-            zipFile.unzipToFile(ze, fmd);
         }
 
         zipFile.close();
@@ -419,18 +405,8 @@ class DownloadTask extends AsyncTask<DownloadTaskParams, long[], Void> {
                 fout.close();
                 continue;
             }
-            File fmd = new File(param.unzipDirectory, fn);
 
-            if (UpdateContext.DEBUG) {
+            zipFile.unzipToPath(ze, param.unzipDirectory);
-                Log.d("RNUpdate", "Unzipping " + fn);
-            }
-
-            if (ze.isDirectory()) {
-                fmd.mkdirs();
-                continue;
-            }
-
-            zipFile.unzipToFile(ze, fmd);
         }
 
         zipFile.close();

android/src/main/java/cn/reactnative/modules/update/SafeZipFile.java

@@ -1,5 +1,7 @@
 package cn.reactnative.modules.update;
 
+import android.util.Log;
+
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
 import java.io.File;
@@ -10,12 +12,15 @@ import java.util.Enumeration;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
 
+
 public class SafeZipFile extends ZipFile {
 
     public SafeZipFile(File file) throws IOException {
         super(file);
     }
 
+    private static final int BUFFER_SIZE = 8192;
+
     @Override
     public Enumeration<? extends ZipEntry> entries() {
         return new SafeZipEntryIterator(super.entries());
@@ -43,40 +48,46 @@ public class SafeZipFile extends ZipFile {
                  * avoid ZipperDown
                  */
                 if (null != name && (name.contains("../") || name.contains("..\\"))) {
-                    throw new SecurityException("illegal entry: " + entry.getName());
+                    throw new SecurityException("illegal entry: " + name);
                 }
             }
             return entry;
         }
     }
 
-    public void unzipToFile(ZipEntry entry, File output) throws IOException {
+    public void unzipToPath(ZipEntry ze, File targetPath) throws IOException {
-        InputStream inputStream = null;
+        String name = ze.getName();
-        try {
+        File target = new File(targetPath, name);
-            inputStream = getInputStream(entry);
+
-            writeOutInputStream(output, inputStream);
+        // Fixing a Zip Path Traversal Vulnerability
-        } finally {
+        // https://support.google.com/faqs/answer/9294009
-            if (inputStream != null) {
+        String canonicalPath = target.getCanonicalPath();
-                inputStream.close();
+        if (!canonicalPath.startsWith(targetPath.getCanonicalPath() + File.separator)) {
+            throw new SecurityException("Illegal name: " + name);
+        }
+
+        if (UpdateContext.DEBUG) {
+            Log.d("RNUpdate", "Unzipping " + name);
+        }
+
+        if (ze.isDirectory()) {
+            target.mkdirs();
+            return;
+        }
+        unzipToFile(ze, target);
+    }
+
+    public void unzipToFile(ZipEntry ze, File target) throws IOException {
+        try (InputStream inputStream = getInputStream(ze)) {
+            try (BufferedOutputStream output = new BufferedOutputStream(new FileOutputStream(target));
+                 BufferedInputStream input = new BufferedInputStream(inputStream)) {
+                byte[] buffer = new byte[BUFFER_SIZE];
+                int n;
+                while ((n = input.read(buffer, 0, BUFFER_SIZE)) >= 0) {
+                    output.write(buffer, 0, n);
+                }
             }
         }
     }
 
-    private void writeOutInputStream(File file, InputStream inputStream) throws IOException {
-        BufferedOutputStream output = null;
-        try {
-            output = new BufferedOutputStream(
-                    new FileOutputStream(file));
-            BufferedInputStream input = new BufferedInputStream(inputStream);
-            byte b[] = new byte[8192];
-            int n;
-            while ((n = input.read(b, 0, 8192)) >= 0) {
-                output.write(b, 0, n);
-            }
-        } finally {
-            if (output != null) {
-                output.close();
-            }
-        }
-    }
 }

ios/RCTPushy/RCTPushy.mm

@@ -349,8 +349,7 @@ RCT_EXPORT_METHOD(reloadUpdate:(NSDictionary *)options
     }
 }
 
-RCT_EXPORT_METHOD(markSuccess:
+RCT_EXPORT_METHOD(markSuccess:(RCTPromiseResolveBlock)resolve
-                  resolver:(RCTPromiseResolveBlock)resolve
                                     rejecter:(RCTPromiseRejectBlock)reject)
 {
     

lib/endpoint.ts

@@ -1,75 +1,34 @@
+import { logger, promiseAny } from './utils';
+
 let currentEndpoint = 'https://update.react-native.cn/api';
+let backupEndpoints: string[] = [
+  'https://pushy-koa-qgbgqmcpis.cn-beijing.fcapp.run',
+  'https://update.reactnative.cn/api',
+];
+let backupEndpointsQueryUrls = [
+  'https://gitee.com/sunnylqm/react-native-pushy/raw/master/endpoints.json',
+  'https://cdn.jsdelivr.net/gh/reactnativecn/react-native-pushy@master/endpoints.json',
+];
 
-function ping(url: string, rejectImmediate?: boolean) {
+export async function updateBackupEndpoints() {
-  return new Promise((resolve, reject) => {
+  if (backupEndpointsQueryUrls) {
-    const xhr = new XMLHttpRequest();
-    xhr.onreadystatechange = (e) => {
-      if (xhr.readyState !== 4) {
-        return;
-      }
-      if (xhr.status === 200) {
-        resolve(url);
-      } else {
-        rejectImmediate ? reject() : setTimeout(reject, 5000);
-      }
-    };
-    xhr.open('HEAD', url);
-    xhr.send();
-    xhr.timeout = 5000;
-    xhr.ontimeout = reject;
-  });
-}
-
-function logger(...args: any[]) {
-  console.log('Pushy: ', ...args);
-}
-
-let backupEndpoints: string[] = [];
-let backupEndpointsQueryUrl: string | null =
-  'https://cdn.jsdelivr.net/gh/reactnativecn/react-native-pushy@master/endpoints.json';
-
-export async function tryBackupEndpoints() {
-  if (!backupEndpoints.length && !backupEndpointsQueryUrl) {
-    return;
-  }
     try {
-    await ping(getStatusUrl(), true);
+      const resp = await promiseAny(
-    logger('current endpoint ok', currentEndpoint);
+        backupEndpointsQueryUrls.map(queryUrl => fetch(queryUrl)),
-    return;
-  } catch (e) {
-    logger('current endpoint failed', currentEndpoint);
-  }
-  if (!backupEndpoints.length && backupEndpointsQueryUrl) {
-    try {
-      const resp = await fetch(backupEndpointsQueryUrl);
-      backupEndpoints = await resp.json();
-      logger('get remote endpoints:', backupEndpoints);
-    } catch (e) {
-      logger('get remote endpoints failed');
-      return;
-    }
-  }
-  await pickFatestAvailableEndpoint();
-}
-
-async function pickFatestAvailableEndpoint(endpoints = backupEndpoints) {
-  const fastestEndpoint = await Promise.race(
-    endpoints.map(pingAndReturnEndpoint),
       );
-  if (typeof fastestEndpoint === 'string') {
+      const remoteEndpoints = await resp.json();
-    logger(`pick endpoint: ${fastestEndpoint}`);
+      if (Array.isArray(remoteEndpoints)) {
-    currentEndpoint = fastestEndpoint;
+        backupEndpoints = Array.from(
-  } else {
+          new Set([...backupEndpoints, ...remoteEndpoints]),
-    logger('all remote endpoints failed');
+        );
+        logger('fetch remote endpoints:', remoteEndpoints);
+        logger('merged backup endpoints:', backupEndpoints);
+      }
+    } catch (e) {
+      logger('fetch remote endpoints failed');
     }
   }
-
+  return backupEndpoints;
-async function pingAndReturnEndpoint(endpoint = currentEndpoint) {
-  return ping(getStatusUrl(endpoint)).then(() => endpoint);
-}
-
-function getStatusUrl(endpoint = currentEndpoint) {
-  return `${endpoint}/status`;
 }
 
 export function getCheckUrl(APPKEY, endpoint = currentEndpoint) {
@@ -85,19 +44,17 @@ export function getCheckUrl(APPKEY, endpoint = currentEndpoint) {
 export function setCustomEndpoints({
   main,
   backups,
-  backupQueryUrl,
+  backupQueryUrls,
 }: {
   main: string;
   backups?: string[];
-  backupQueryUrl?: string;
+  backupQueryUrls?: string[];
 }) {
   currentEndpoint = main;
-  backupEndpointsQueryUrl = null;
   if (Array.isArray(backups) && backups.length > 0) {
     backupEndpoints = backups;
-    pickFatestAvailableEndpoint();
   }
-  if (typeof backupQueryUrl === 'string') {
+  if (Array.isArray(backupQueryUrls) && backupQueryUrls.length > 0) {
-    backupEndpointsQueryUrl = backupQueryUrl;
+    backupEndpointsQueryUrls = backupQueryUrls;
   }
 }

lib/index.web.js

@@ -14,5 +14,5 @@ export const markSuccess = noop;
 export const downloadAndInstallApk = noop;
 export const setCustomEndpoints = noop;
 export const getCurrentVersionInfo = noop;
-export const simpleUpdate = noop;
+export const simpleUpdate = (app) => app;
-export const onEvents = noop;
+export const onPushyEvents = noop;

lib/main.ts

@@ -1,5 +1,5 @@
 import {
-  tryBackupEndpoints,
+  updateBackupEndpoints,
   getCheckUrl,
   setCustomEndpoints,
 } from './endpoint';
@@ -16,6 +16,7 @@ import {
   UpdateAvailableResult,
   UpdateEventsListener,
 } from './type';
+import { assertRelease, logger, promiseAny, testUrls } from './utils';
 export { setCustomEndpoints };
 const {
   version: v,
@@ -74,14 +75,10 @@ if (!uuid) {
   PushyModule.setUuid(uuid);
 }
 
-function logger(...args: string[]) {
-  console.log('Pushy: ', ...args);
-}
-
 const noop = () => {};
 let reporter: UpdateEventsListener = noop;
 
-export function onEvents(customReporter: UpdateEventsListener) {
+export function onPushyEvents(customReporter: UpdateEventsListener) {
   reporter = customReporter;
   if (isRolledBack) {
     report({
@@ -125,19 +122,15 @@ export const cInfo = {
   uuid,
 };
 
-function assertRelease() {
+let lastChecking;
-  if (__DEV__) {
+const empty = {};
-    throw new Error('react-native-update 只能在 RELEASE 版本中运行.');
+let lastResult: CheckResult;
-  }
+export async function checkUpdate(APPKEY: string) {
-}
-
-let lastChecking = Date.now();
-export async function checkUpdate(APPKEY: string, isRetry?: boolean) {
   assertRelease();
   const now = Date.now();
-  if (now - lastChecking < 1000 * 5) {
+  if (lastResult && lastChecking && now - lastChecking < 1000 * 60) {
-    logger('repeated checking, ignored');
+    // logger('repeated checking, ignored');
-    return;
+    return lastResult;
   }
   lastChecking = now;
   if (blockUpdate && blockUpdate.until > Date.now() / 1000) {
@@ -147,12 +140,10 @@ export async function checkUpdate(APPKEY: string, isRetry?: boolean) {
         blockUpdate.until * 1000,
       ).toLocaleString()}"之后重试。`,
     });
-    return;
+    return lastResult || empty;
   }
   report({ type: 'checking' });
-  let resp;
+  const fetchPayload = {
-  try {
-    resp = await fetch(getCheckUrl(APPKEY), {
     method: 'POST',
     headers: {
       Accept: 'application/json',
@@ -164,19 +155,36 @@ export async function checkUpdate(APPKEY: string, isRetry?: boolean) {
       buildTime,
       cInfo,
     }),
-    });
+  };
+  let resp;
+  try {
+    resp = await fetch(getCheckUrl(APPKEY), fetchPayload);
   } catch (e) {
-    if (isRetry) {
+    report({
+      type: 'errorChecking',
+      message: '无法连接主更新服务器，尝试备用节点',
+    });
+    const backupEndpoints = await updateBackupEndpoints();
+    if (backupEndpoints) {
+      try {
+        resp = await promiseAny(
+          backupEndpoints.map(endpoint =>
+            fetch(getCheckUrl(APPKEY, endpoint), fetchPayload),
+          ),
+        );
+      } catch {}
+    }
+  }
+  if (!resp) {
     report({
       type: 'errorChecking',
       message: '无法连接更新服务器，请检查网络连接后重试',
     });
-      return;
+    return lastResult || empty;
-    }
-    await tryBackupEndpoints();
-    return checkUpdate(APPKEY, true);
   }
   const result: CheckResult = await resp.json();
+
+  lastResult = result;
   // @ts-ignore
   checkOperation(result.op);
 
@@ -186,7 +194,6 @@ export async function checkUpdate(APPKEY: string, isRetry?: boolean) {
       //@ts-ignore
       message: result.message,
     });
-    return;
   }
 
   return result;
@@ -198,7 +205,7 @@ function checkOperation(
   if (!Array.isArray(op)) {
     return;
   }
-  op.forEach((action) => {
+  op.forEach(action => {
     if (action.type === 'block') {
       blockUpdate = {
         reason: action.reason,
@@ -243,7 +250,7 @@ export async function downloadUpdate(
       const downloadCallback = eventListeners.onDownloadProgress;
       progressHandler = eventEmitter.addListener(
         'RCTPushyDownloadProgress',
-        (progressData) => {
+        progressData => {
           if (progressData.hash === options.hash) {
             downloadCallback(progressData);
           }
@@ -253,11 +260,12 @@ export async function downloadUpdate(
   }
   let succeeded = false;
   report({ type: 'downloading' });
-  if (options.diffUrl) {
+  const diffUrl = (await testUrls(options.diffUrls)) || options.diffUrl;
+  if (diffUrl) {
     logger('downloading diff');
     try {
       await PushyModule.downloadPatchFromPpk({
-        updateUrl: options.diffUrl,
+        updateUrl: diffUrl,
         hash: options.hash,
         originHash: currentVersion,
       });
@@ -266,11 +274,13 @@ export async function downloadUpdate(
       logger(`diff error: ${e.message}, try pdiff`);
     }
   }
-  if (!succeeded && options.pdiffUrl) {
+  if (!succeeded) {
+    const pdiffUrl = (await testUrls(options.pdiffUrls)) || options.pdiffUrl;
+    if (pdiffUrl) {
       logger('downloading pdiff');
       try {
         await PushyModule.downloadPatchFromPackage({
-        updateUrl: options.pdiffUrl,
+          updateUrl: pdiffUrl,
           hash: options.hash,
         });
         succeeded = true;
@@ -278,11 +288,14 @@ export async function downloadUpdate(
         logger(`pdiff error: ${e.message}, try full patch`);
       }
     }
-  if (!succeeded && options.updateUrl) {
+  }
+  if (!succeeded) {
+    const updateUrl = (await testUrls(options.updateUrls)) || options.updateUrl;
+    if (updateUrl) {
       logger('downloading full patch');
       try {
         await PushyModule.downloadFullUpdate({
-        updateUrl: options.updateUrl,
+          updateUrl: updateUrl,
           hash: options.hash,
         });
         succeeded = true;
@@ -290,6 +303,7 @@ export async function downloadUpdate(
         logger(`full patch error: ${e.message}`);
       }
     }
+  }
   progressHandler && progressHandler.remove();
   if (!succeeded) {
     return report({ type: 'errorUpdate', data: { newVersion: options.hash } });

lib/simpleUpdate.tsx

@@ -16,20 +16,20 @@ import {
   switchVersionLater,
   markSuccess,
   downloadAndInstallApk,
-  onEvents,
+  onPushyEvents,
 } from './main';
 import { UpdateEventsListener } from './type';
 
 export function simpleUpdate(
   WrappedComponent: ComponentType,
-  options: { appKey?: string; onEvents?: UpdateEventsListener } = {},
+  options: { appKey?: string; onPushyEvents?: UpdateEventsListener } = {},
 ) {
-  const { appKey, onEvents: eventListeners } = options;
+  const { appKey, onPushyEvents: eventListeners } = options;
   if (!appKey) {
     throw new Error('appKey is required for simpleUpdate()');
   }
   if (typeof eventListeners === 'function') {
-    onEvents(eventListeners);
+    onPushyEvents(eventListeners);
   }
   return __DEV__
     ? WrappedComponent

lib/type.ts

@@ -19,14 +19,18 @@ export interface UpdateAvailableResult {
   description: string;
   metaInfo: string;
   pdiffUrl: string;
+  pdiffUrls?: string[];
   diffUrl?: string;
+  diffUrls?: string[];
   updateUrl?: string;
+  updateUrls?: string[];
 }
 
 export type CheckResult =
   | ExpiredResult
   | UpTodateResult
-  | UpdateAvailableResult;
+  | UpdateAvailableResult
+  | {};
 
 export interface ProgressData {
   hash: string;

lib/utils.ts

@@ -0,0 +1,75 @@
+import { Platform } from 'react-native';
+
+export function logger(...args: any[]) {
+  console.log('Pushy: ', ...args);
+}
+
+export function promiseAny<T>(promises: Promise<T>[]) {
+  return new Promise<T>((resolve, reject) => {
+    let count = 0;
+
+    promises.forEach((promise) => {
+      Promise.resolve(promise)
+        .then(resolve)
+        .catch(() => {
+          count++;
+          if (count === promises.length) {
+            reject(new Error('All promises were rejected'));
+          }
+        });
+    });
+  });
+}
+
+export function assertRelease() {
+  if (__DEV__) {
+    throw new Error('react-native-update 只能在 RELEASE 版本中运行.');
+  }
+}
+
+const ping =
+  Platform.OS === 'web'
+    ? Promise.resolve
+    : async (url: string) => {
+        let pingFinished = false;
+        return Promise.race([
+          fetch(url, {
+            method: 'HEAD',
+          })
+            .then(({ status, statusText }) => {
+              pingFinished = true;
+              if (status === 200) {
+                return url;
+              }
+              logger('ping failed', url, status, statusText);
+              throw new Error('Ping failed');
+            })
+            .catch((e) => {
+              pingFinished = true;
+              logger('ping error', url, e);
+              throw e;
+            }),
+          new Promise((_, reject) =>
+            setTimeout(() => {
+              reject(new Error('Ping timeout'));
+              if (!pingFinished) {
+                logger('ping timeout', url);
+              }
+            }, 2000),
+          ),
+        ]);
+      };
+
+export const testUrls = async (urls?: string[]) => {
+  if (!urls?.length) {
+    return null;
+  }
+  try {
+    const ret = await promiseAny(urls.map(ping));
+    if (ret) {
+      return ret;
+    }
+  } catch {}
+  logger('all ping failed, use first url:', urls[0]);
+  return urls[0];
+};

package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update",
-  "version": "9.0.1",
+  "version": "9.2.5",
   "description": "react-native hot update",
   "main": "lib/index.ts",
   "scripts": {
@@ -39,7 +39,7 @@
     "url": "https://github.com/reactnativecn/react-native-pushy/issues"
   },
   "peerDependencies": {
-    "react-native": ">=0.27.0"
+    "react-native": ">=0.57.0"
   },
   "homepage": "https://github.com/reactnativecn/react-native-pushy#readme",
   "dependencies": {
@@ -57,12 +57,16 @@
   "devDependencies": {
     "@types/fs-extra": "^9.0.13",
     "@types/jest": "^29.2.1",
+    "@types/node": "^20.8.9",
+    "@types/react": "^18.2.33",
     "detox": "^20.5.0",
     "firebase-tools": "^11.24.1",
     "fs-extra": "^9.1.0",
     "jest": "^29.2.1",
     "pod-install": "^0.1.37",
+    "react-native": "^0.72.6",
     "ts-jest": "^29.0.3",
-    "typescript": "^4.1.3"
+    "typescript": "^5.2.2"
-  }
+  },
+  "packageManager": "yarn@1.22.21+sha1.1959a18351b811cdeedbd484a8f86c3cc3bbaf72"
 }