From 3244876c8c188009a7fa2324025c9263133ef638 Mon Sep 17 00:00:00 2001
From: LukeMackin <luke@yuzu-gca.dev>
Date: Sun, 19 Jul 2026 15:52:56 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20usesCleartextTraffic=E7=A7=BB?=
 =?UTF-8?q?=E9=99=A4=20+=20=E5=9F=9F=E5=90=8D=E7=99=BD=E5=90=8D=E5=8D=95?=
 =?UTF-8?q?=20+=20JSONObject=E8=A7=A3=E6=9E=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- AndroidManifest: 移除 usesCleartextTraffic=true
- downloadFile: 增加 ALLOWED_HOSTS 白名单(git.childish-ghost.com/github.com)
- manifest解析: indexOf/substring → org.json.JSONObject
---
 .../android/app/src/main/AndroidManifest.xml  |  1 -
 .../main/java/dev/yuzu/gca/MainActivity.kt    | 21 +++++++++++--------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/packages/client-android/android/app/src/main/AndroidManifest.xml b/packages/client-android/android/app/src/main/AndroidManifest.xml
index 98bbd93..da70e39 100644
--- a/packages/client-android/android/app/src/main/AndroidManifest.xml
+++ b/packages/client-android/android/app/src/main/AndroidManifest.xml
@@ -8,7 +8,6 @@
         android:label="Yuzu GCA v0.1.0"
         android:allowBackup="false"
         android:supportsRtl="true"
-        android:usesCleartextTraffic="true"
         android:theme="@style/Theme.AppCompat.DayNight">
 
         <activity
diff --git a/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt b/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
index 9dcde9c..2c6b8f5 100644
--- a/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
+++ b/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
@@ -13,6 +13,7 @@ import java.io.FileOutputStream
 import java.net.HttpURLConnection
 import java.net.URL
 import java.security.MessageDigest
+import org.json.JSONObject
 
 class MainActivity : AppCompatActivity() {
     private lateinit var logView: TextView
@@ -132,15 +133,11 @@ class MainActivity : AppCompatActivity() {
         var manifestApkUrl = ""
         var manifestTag = ""
         try {
-            fun extractJson(key: String): String {
-                val field = "\"$key\": \""
-                val start = manifestJson.indexOf(field) + field.length
-                val end = manifestJson.indexOf("\"", start)
-                return manifestJson.substring(start, end)
-            }
-            manifestSha256 = extractJson("sha256")
-            manifestApkUrl = extractJson("url")
-            manifestTag = extractJson("tag")
+            val json = JSONObject(manifestJson)
+            val android = json.getJSONObject("builds").getJSONObject("android")
+            manifestSha256 = android.getString("sha256")
+            manifestApkUrl = android.getString("url")
+            manifestTag = android.getString("tag")
             appendLog("  渠道: $channel  版本: $manifestTag")
             appendLog("  SHA256: ${manifestSha256.take(16)}...")
         } catch (e: Exception) {
@@ -180,7 +177,13 @@ class MainActivity : AppCompatActivity() {
         return conn.inputStream.bufferedReader().readText()
     }
 
+    private val ALLOWED_HOSTS = setOf("git.childish-ghost.com", "github.com")
+
     private fun downloadFile(url: String, dest: File) {
+        val host = URL(url).host
+        if (!ALLOWED_HOSTS.any { host == it || host.endsWith(".$it") }) {
+            throw SecurityException("不允许的下载域名: $host")
+        }
         val conn = URL(url).openConnection() as HttpURLConnection
         conn.connectTimeout = 30000
         conn.readTimeout = 120000