LukeMackin/Yuzu-GCA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): usesCleartextTraffic移除 + 域名白名单 + JSONObject解析

Browse Source 
- AndroidManifest: 移除 usesCleartextTraffic=true
- downloadFile: 增加 ALLOWED_HOSTS 白名单(git.childish-ghost.com/github.com)
- manifest解析: indexOf/substring → org.json.JSONObject
This commit is contained in:
LukeMackin
2026-07-19 15:52:56 +08:00
parent fcc51f4356
commit 3244876c8c
2 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
packages/client-android/android/app/src/main/AndroidManifest.xml
View File

@@ -8,7 +8,6 @@
android:label="Yuzu GCA v0.1.0" android:label="Yuzu GCA v0.1.0"
android:allowBackup="false" android:allowBackup="false"
android:supportsRtl="true" android:supportsRtl="true"
android:usesCleartextTraffic="true"
android:theme="@style/Theme.AppCompat.DayNight"> android:theme="@style/Theme.AppCompat.DayNight">
<activity <activity

21
packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
View File

@@ -13,6 +13,7 @@ import java.io.FileOutputStream
import java.net.HttpURLConnection import java.net.HttpURLConnection
import java.net.URL import java.net.URL
import java.security.MessageDigest import java.security.MessageDigest
import org.json.JSONObject
class MainActivity : AppCompatActivity() { class MainActivity : AppCompatActivity() {
private lateinit var logView: TextView private lateinit var logView: TextView
@@ -132,15 +133,11 @@ class MainActivity : AppCompatActivity() {
var manifestApkUrl = "" var manifestApkUrl = ""
var manifestTag = "" var manifestTag = ""
try { try {
fun extractJson(key: String): String { val json = JSONObject(manifestJson)
val field = "\"$key\": \"" val android = json.getJSONObject("builds").getJSONObject("android")
val start = manifestJson.indexOf(field) + field.length manifestSha256 = android.getString("sha256")
val end = manifestJson.indexOf("\"", start) manifestApkUrl = android.getString("url")
return manifestJson.substring(start, end) manifestTag = android.getString("tag")
}
manifestSha256 = extractJson("sha256")
manifestApkUrl = extractJson("url")
manifestTag = extractJson("tag")
appendLog(" 渠道: $channel 版本: $manifestTag") appendLog(" 渠道: $channel 版本: $manifestTag")
appendLog(" SHA256: ${manifestSha256.take(16)}...") appendLog(" SHA256: ${manifestSha256.take(16)}...")
} catch (e: Exception) { } catch (e: Exception) {
@@ -180,7 +177,13 @@ class MainActivity : AppCompatActivity() {
return conn.inputStream.bufferedReader().readText() return conn.inputStream.bufferedReader().readText()
} }
private val ALLOWED_HOSTS = setOf("git.childish-ghost.com", "github.com")
private fun downloadFile(url: String, dest: File) { private fun downloadFile(url: String, dest: File) {
val host = URL(url).host
if (!ALLOWED_HOSTS.any { host == it || host.endsWith(".$it") }) {
throw SecurityException("不允许的下载域名: $host")
}
val conn = URL(url).openConnection() as HttpURLConnection val conn = URL(url).openConnection() as HttpURLConnection
conn.connectTimeout = 30000 conn.connectTimeout = 30000
conn.readTimeout = 120000 conn.readTimeout = 120000