fix path traversal vulnerability issue

Author: plrthink

android/src/main/java/com/rnziparchive/RNZipArchiveModule.java

@@ -159,6 +159,12 @@ public void onCopyProgress(long bytesRead) {
             };
 
             File fout = new File(destDirectory, entry.getName());
+            String destDirCanonicalPath = (new File(destDirectory)).getCanonicalPath();
+            String canonicalPath = fout.getCanonicalPath();
+            if (!canonicalPath.startsWith(destDirCanonicalPath)) {
+              throw new Exception(String.format("Found Zip Path Traversal Vulnerability with %s", canonicalPath));
+            }
+
             if (!fout.exists()) {
               //noinspection ResultOfMethodCallIgnored
               (new File(fout.getParent())).mkdirs();
@@ -245,6 +251,13 @@ public void run() {
             while ((entry = zipIn.getNextEntry()) != null) {
               if (entry.isDirectory()) continue;
               fout = new File(destDirectory, entry.getName());
+
+              String destDirCanonicalPath = (new File(destDirectory)).getCanonicalPath();
+              String canonicalPath = fout.getCanonicalPath();
+              if (!canonicalPath.startsWith(destDirCanonicalPath)) {
+                throw new Exception(String.format("Found Zip Path Traversal Vulnerability with %s", canonicalPath));
+              }
+
               if (!fout.exists()) {
                 //noinspection ResultOfMethodCallIgnored
                 (new File(fout.getParent())).mkdirs();

example/App.js

@@ -10,21 +10,13 @@ import {
   StyleSheet,
   View
 } from 'react-native'
-import App from './App'
 import UnzipApp from './UnzipApp'
 
-export default class example extends Component {
-  constructor () {
-    super()
-    this.state = {
-      unzipWithPassword: true
-    }
-  }
-
+export default class Example extends Component {
   render () {
     return (
       <View style={styles.container}>
-        {this.state.unzipWithPassword ? (<UnzipApp />) : (<App />)}
+        <UnzipApp />
       </View>
     )
   }
@@ -37,4 +29,4 @@ const styles = StyleSheet.create({
   }
 })
 
-AppRegistry.registerComponent('example', () => example)
+AppRegistry.registerComponent('example', () => Example)

example/android/app/build.gradle

@@ -137,10 +137,10 @@ android {
 }
 
 dependencies {
+    implementation project(':react-native-custom-tabs')
     implementation project(':react-native-zip-archive')
     implementation project(':react-native-fs')
     implementation project(':react-native-document-picker')
-    implementation project(':react-native-custom-tabs')
     implementation fileTree(dir: "libs", include: ["*.jar"])
     implementation "com.android.support:appcompat-v7:${rootProject.ext.supportLibVersion}"
     implementation "com.facebook.react:react-native:+"  // From node_modules

example/android/app/src/main/java/com/example/MainApplication.java

@@ -3,10 +3,10 @@
 import android.app.Application;
 
 import com.facebook.react.ReactApplication;
+import com.github.droibit.android.reactnative.customtabs.CustomTabsPackage;
 import com.rnziparchive.RNZipArchivePackage;
 import com.rnfs.RNFSPackage;
 import com.reactnativedocumentpicker.ReactNativeDocumentPicker;
-import com.github.droibit.android.reactnative.customtabs.CustomTabsPackage;
 import com.facebook.react.ReactNativeHost;
 import com.facebook.react.ReactPackage;
 import com.facebook.react.shell.MainReactPackage;
@@ -27,10 +27,10 @@ public boolean getUseDeveloperSupport() {
     protected List<ReactPackage> getPackages() {
       return Arrays.<ReactPackage>asList(
           new MainReactPackage(),
+            new CustomTabsPackage(),
             new RNZipArchivePackage(),
             new RNFSPackage(),
-            new ReactNativeDocumentPicker(),
-            new CustomTabsPackage()
+            new ReactNativeDocumentPicker()
       );
     }
 

example/android/build.gradle

@@ -13,7 +13,7 @@ buildscript {
         jcenter()
     }
     dependencies {
-        classpath 'com.android.tools.build:gradle:3.2.1'
+        classpath 'com.android.tools.build:gradle:3.4.1'
 
         // NOTE: Do not place your application dependencies here; they belong
         // in the individual module build.gradle files
@@ -35,8 +35,7 @@ allprojects {
     }
 }
 
-
-task wrapper(type: Wrapper) {
-    gradleVersion = '4.7'
+wrapper {
+    gradleVersion = '5.1.1'
     distributionUrl = distributionUrl.replace("bin", "all")
 }

example/android/gradle/wrapper/gradle-wrapper.jar

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-5.1.1-all.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-4.7-all.zip

example/android/gradle/wrapper/gradle-wrapper.properties

@@ -28,7 +28,7 @@ APP_NAME="Gradle"
 APP_BASE_NAME=`basename "$0"`
 
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS=""
+DEFAULT_JVM_OPTS='"-Xmx64m"'
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD="maximum"

example/android/gradlew

@@ -14,7 +14,7 @@ set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
 @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS=
+set DEFAULT_JVM_OPTS="-Xmx64m"
 
 @rem Find java.exe
 if defined JAVA_HOME goto findJavaFromJavaHome

example/android/gradlew.bat

@@ -1,11 +1,11 @@
 rootProject.name = 'example'
+include ':react-native-custom-tabs'
+project(':react-native-custom-tabs').projectDir = new File(rootProject.projectDir, '../node_modules/react-native-custom-tabs/android')
 include ':react-native-zip-archive'
 project(':react-native-zip-archive').projectDir = new File(rootProject.projectDir, '../node_modules/react-native-zip-archive/android')
 include ':react-native-fs'
 project(':react-native-fs').projectDir = new File(rootProject.projectDir, '../node_modules/react-native-fs/android')
 include ':react-native-document-picker'
 project(':react-native-document-picker').projectDir = new File(rootProject.projectDir, '../node_modules/react-native-document-picker/android')
-include ':react-native-custom-tabs'
-project(':react-native-custom-tabs').projectDir = new File(rootProject.projectDir, '../node_modules/react-native-custom-tabs/android')
 
 include ':app'