From f9d5d32785f12cdd330d88adaa18c7c4d926932f Mon Sep 17 00:00:00 2001
From: LukeMackin <luke@yuzu-gca.dev>
Date: Tue, 21 Jul 2026 20:39:47 +0800
Subject: [PATCH] =?UTF-8?q?security:=20SHA256=E5=BC=BA=E5=88=B6+dlUrl?=
 =?UTF-8?q?=E5=9F=9F=E5=90=8D=E6=A0=A1=E9=AA=8C+=E7=BC=93=E5=AD=98?=
 =?UTF-8?q?=E5=A4=A7=E5=B0=8F=E9=99=90=E5=88=B6(500KB)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- saveCache: >500KB拒绝写入
- index.html: SHA256缺失时拒绝(不再静默跳过)
- index.html: dlUrl域名校验(dlUrl.indexOf(BASE)===0)
- 审查建议全部修复
---
 .../buildOutputCleanup.lock                   | Bin 17 -> 17 bytes
 .../android/app/src/main/assets/index.html    | Bin 4398 -> 4586 bytes
 .../main/java/dev/yuzu/gca/MainActivity.kt    |   4 ++++
 3 files changed, 4 insertions(+)

diff --git a/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock b/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock
index 48c5ba21581e19cd4a97e35c7516777434a8538a..9c9f6c38d25e309f9b1c1fbbaf72bc53b539578d 100644
GIT binary patch
literal 17
UcmZQ>(-v{$|HmrA00vBQ030*|Pyhe`

literal 17
UcmZQ>(-v{$|HmrA00xYA0UYrI4gdfE

diff --git a/packages/client-android/android/app/src/main/assets/index.html b/packages/client-android/android/app/src/main/assets/index.html
index 8d9fbfffed8a16e15bff539e5fed1995d14c5422..ad320ad4628758483c9aacac3cf9bb1a8281a7a7 100644
GIT binary patch
delta 160
zcmZ3d^h$Zd8E)fDhBO8Zh7^VzhERqgAgRZY$&d%+r!rJ9_=Dw~7#tab8C)4O859|8
zfzV*`eO^gPkg76<M4*mLplSt#36r@6q&J`8Uc=0-2o?-x$Y4kWX^{<P@BkWR#9+!`
g2Gmdlw4#uq6sR4<N&#t`+{bS=`51q~Vm$#y0Qiw3ApigX

delta 43
zcmaE*yiRGu8Sc$KJZqQ*Qy6j>f*CRx5*aiZsu{Q#6ejx%SWoT{NZR~JfP)bLD8vj>

diff --git a/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt b/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
index b49ff4d..ef0e1c4 100644
--- a/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
+++ b/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
@@ -40,6 +40,10 @@ class MainActivity : AppCompatActivity() {
     inner class Bridge(private val ctx: MainActivity) {
         @android.webkit.JavascriptInterface
         fun saveCache(html: String) {
+            if (html.length > 500_000) {
+                Log.w(TAG, "Cache rejected: too large (${html.length}B)")
+                return
+            }
             ctx.cacheFile.writeText(html)
             Log.i(TAG, "Hot-update HTML saved (${html.length}B)")
         }