moliparty/peko-android
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[BugFix]修复压缩路径遍历和谷歌支付问题

Browse Source
This commit is contained in:
wushaocheng
2023-03-16 17:06:51 +08:00
parent ead01644f3
commit f2a426fa2b
2 changed files with 49 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/src/main/java/com/yizhuan/erban/ui/pay/BillingManager.java
View File

@@ -38,7 +38,7 @@ public class BillingManager implements PurchasesUpdatedListener {
private static final String TAG = "BillingManager";
/*购买key*/
private static final String BASE_64_ENCODED_PUBLIC_KEY = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs1/xs5aYKXp5iWlhuM763hAaNt3GneWBf2I4DjM2vTf43UWs1wgAnTpMIgoI80epnVPvdqbInu9fPMU7dp8d2XmjOF0GKydvnwUN0BpWKtg0kAcMCd7TW2s+FoZRmii2RkX2VGYMxLsCaN4P++DcpXQ8v8UyfvMNcLiVBeERM8+/FYfB94cA6OEoILb1bYwn4pGb7UlY7h11Zu0Hzmp2g209rfAmVRtO4SnEbvTicQI2l3mC6ggZi3pz5ffZxkWY7D3Y+NPgNogL/ZVZd8S8tt7lwpnmuF9s3fKcj3c6zun+B599YYxDVmZR688f5a43jc81/BHQwWKuMVCyCIPIFwIDAQAB";
private static final String BASE_64_ENCODED_PUBLIC_KEY = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAotfZw5IAGCV4V/L/AblIO5DL/hrLTwC9MDlVoEEcL8rgrF4GIZrzhInQhqwjoY8FelThezK68ccMz4i+hi3Mup9kHNhYjlZo+A14gXV+omEzAFiWtqOsISvifSxrMi849LQuXfImqlKNRLzp+YSkr4oJq7OE7QmxlLwpAzFj623c6Z9NSj+NdoE3bRrS2F1SSGYYyHEMyV005TdzKnqtjwtkga2RPNZCnyepU6OuF/HrIUoBTIVpgd4aZC2lKSBY9GNBMxZLd0yCsXNLXRXnR0itaNh0clYkxUSa3PemqjBsr79hLFn2yQKDsBwSCBAfBsgbpAA84PF5Jl4dw6rl0wIDAQAB";
/*客户端*/
private BillingClient billingClient;

82
core/src/main/java/com/yizhuan/xchat_android_core/noble/NobleDataManager.java
View File

@@ -7,8 +7,8 @@ import androidx.collection.LongSparseArray;
import com.google.gson.Gson;
import com.google.gson.reflect.TypeToken;
import com.yizhuan.xchat_android_core.R;
import com.yizhuan.xchat_android_core.DemoCache;
import com.yizhuan.xchat_android_core.R;
import com.yizhuan.xchat_android_core.bean.response.ServiceResult;
import com.yizhuan.xchat_android_core.initial.InitialModel;
import com.yizhuan.xchat_android_core.initial.NobleResourceComponent;
@@ -218,39 +218,40 @@ public class NobleDataManager {
isRequesting = false;
}
}).flatMap(new Function<ResponseBody, SingleSource<Boolean>>() {
@Override
public SingleSource<Boolean> apply(ResponseBody responseBody) throws Exception {
InputStream inputStream = responseBody.byteStream();
if (inputStream == null) return Single.error(new Exception(ResUtil.getString(R.string.xchat_android_core_noble_nobledatamanager_01)));
if (nobleZipPath.exists()) {
// 删除旧的zip包
nobleZipPath.delete();
} else {
// 创建其父目录
if (!nobleZipPath.getParentFile().exists()) {
nobleZipPath.getParentFile().mkdirs();
@Override
public SingleSource<Boolean> apply(ResponseBody responseBody) throws Exception {
InputStream inputStream = responseBody.byteStream();
if (inputStream == null)
return Single.error(new Exception(ResUtil.getString(R.string.xchat_android_core_noble_nobledatamanager_01)));
if (nobleZipPath.exists()) {
// 删除旧的zip包
nobleZipPath.delete();
} else {
// 创建其父目录
if (!nobleZipPath.getParentFile().exists()) {
nobleZipPath.getParentFile().mkdirs();
}
}
OutputStream fileOutputStream = new FileOutputStream(nobleZipPath);
byte[] bytes = new byte[1024];
int read;
while ((read = inputStream.read(bytes, 0, bytes.length)) != -1) {
fileOutputStream.write(bytes, 0, read);
}
fileOutputStream.flush();
fileOutputStream.close();
inputStream.close();
// 解压缩是否成功
return Single.just(unzipNobleZipFile());
}
}
OutputStream fileOutputStream = new FileOutputStream(nobleZipPath);
byte[] bytes = new byte[1024];
int read;
while ((read = inputStream.read(bytes, 0, bytes.length)) != -1) {
fileOutputStream.write(bytes, 0, read);
}
fileOutputStream.flush();
fileOutputStream.close();
inputStream.close();
// 解压缩是否成功
return Single.just(unzipNobleZipFile());
}
}).observeOn(AndroidSchedulers.mainThread()).subscribe(new Consumer<Boolean>() {
@Override
public void accept(Boolean aBoolean) throws Exception {
if (!aBoolean) return;
IMNetEaseManager.get().getChatRoomEventObservable()
.onNext(new RoomEvent().setEvent(RoomEvent.ON_NOBLE_CAN_USE));
}
});
}).observeOn(AndroidSchedulers.mainThread()).subscribe(new Consumer<Boolean>() {
@Override
public void accept(Boolean aBoolean) throws Exception {
if (!aBoolean) return;
IMNetEaseManager.get().getChatRoomEventObservable()
.onNext(new RoomEvent().setEvent(RoomEvent.ON_NOBLE_CAN_USE));
}
});
}
@@ -321,6 +322,12 @@ public class NobleDataManager {
continue;
}
file = new File(parent, entry.getName());
try {
ensureZipPathSafety(file, parent);
} catch (Exception e) {
e.printStackTrace();
return false;
}
if (!file.exists()) {
(new File(file.getParent())).mkdirs();
} else if (file.exists() && file.isFile() && file.length() > 0) {
@@ -347,6 +354,13 @@ public class NobleDataManager {
return true;
}
private void ensureZipPathSafety(final File outputFile, final String destDirectory) throws Exception {
String destDirCanonicalPath = (new File(destDirectory)).getCanonicalPath();
String outputFileCanonicalPath = outputFile.getCanonicalPath();
if (!outputFileCanonicalPath.startsWith(destDirCanonicalPath)) {
throw new Exception(String.format("Found Zip Path Traversal Vulnerability with %s", destDirCanonicalPath));
}
}
public NobleInfo getNobleByUid(String uid) {
if (TextUtils.isEmpty(uid)) return null;
@@ -399,7 +413,7 @@ public class NobleDataManager {
.observeOn(AndroidSchedulers.mainThread());
}
public File getUserLevelPath(){
public File getUserLevelPath() {
return userLevelPath;
}