fix(android): validate ZIP entry paths against destination (Zip Slip)

Prior to this commit, HybridUnzipTask.kt's Android extraction path resolved
every entry as `File(destDir, entry.name)` and wrote to that path without
checking that the resolved file actually sits inside destDir. A malicious
ZIP containing an entry named `../../databases/poi.db` would resolve to
`destDir/../../databases/poi.db` and FileOutputStream would happily write
to it — the classic Zip Slip vulnerability.

Fix: introduce a canonical-path validation helper that's called once per
entry in pass 1 (header collection) and again per entry in pass 2 (file
write) for defence in depth. The check resolves the candidate path under
the canonical destDir and rejects anything that doesn't start with the
destDir prefix. Absolute paths, `..` traversal, and exotic separators all
canonicalise into something the prefix check catches.

Same validation applied to the zip4j password-protected path before
delegating to zip4j.extractFile() — zip4j 2.10+ has its own check but
defence in depth is cheap and shields against older transitive versions.

iOS path is unaffected: SSZipArchive ~> 2.5 validates paths since 2.4.0.

Bumps to 0.3.1.

Author: isaacrowntree

android/src/main/java/com/margelo/nitro/unzip/HybridUnzipTask.kt

@@ -71,6 +71,9 @@ class HybridUnzipTask(
     if (!destDir.exists()) {
       destDir.mkdirs()
     }
+    // Canonicalize the destination once for Zip Slip validation. Any entry
+    // whose resolved path doesn't start with this prefix is rejected.
+    val canonicalDestDir = destDir.canonicalFile
 
     val sourceFile = File(cleanZip)
     if (!sourceFile.exists()) {
@@ -84,6 +87,10 @@ class HybridUnzipTask(
     ZipInputStream(BufferedInputStream(sourceFile.inputStream(), BUFFER_SIZE)).use { zis ->
       var entry = zis.nextEntry
       while (entry != null) {
+        // Reject malicious entries before either pass touches the filesystem.
+        // Zip Slip: an entry named `../../foo` would resolve outside destDir
+        // and write to arbitrary app-private paths.
+        assertSafeEntryPath(canonicalDestDir, entry.name)
         if (entry.isDirectory) {
           directoriesToCreate.add(entry.name)
         } else {
@@ -112,6 +119,10 @@ class HybridUnzipTask(
 
       while (entry != null && isActive && !shouldCancel) {
         if (!entry.isDirectory) {
+          // Defence in depth: re-validate per entry in case the archive
+          // shuffles between passes (shouldn't, but ZIP central directory
+          // and local headers can disagree on malformed archives).
+          assertSafeEntryPath(canonicalDestDir, entry.name)
           val entryFile = File(destDir, entry.name)
 
           BufferedOutputStream(FileOutputStream(entryFile), BUFFER_SIZE).use { output ->
@@ -185,6 +196,7 @@ class HybridUnzipTask(
     if (!destDir.exists()) {
       destDir.mkdirs()
     }
+    val canonicalDestDir = destDir.canonicalFile
 
     val sourceFile = File(cleanZip)
     if (!sourceFile.exists()) {
@@ -195,6 +207,13 @@ class HybridUnzipTask(
     zipFile.setPassword(password!!.toCharArray())
 
     val fileHeaders = zipFile.fileHeaders
+    // Zip Slip mitigation — validate every entry's resolved path before
+    // delegating to zip4j. zip4j 2.10+ has its own check but defence in depth
+    // is cheap, and it shields against older versions if the resolved
+    // dependency tree slips.
+    for (header in fileHeaders) {
+      assertSafeEntryPath(canonicalDestDir, header.fileName)
+    }
     val totalEntries = fileHeaders.size
     var extractedCount = 0
     var lastProgressUpdate = System.currentTimeMillis()
@@ -251,5 +270,26 @@ class HybridUnzipTask(
   companion object {
     private const val BUFFER_SIZE = 65536
     private const val PROGRESS_THROTTLE_MS = 1000L
+
+    /**
+     * Zip Slip mitigation — reject any entry whose resolved canonical path
+     * doesn't sit inside the destination directory. Catches the classic
+     * `../../foo` payload as well as absolute paths (`/etc/passwd`) and
+     * exotic separators that resolve through `..` after canonicalisation.
+     *
+     * Throws SecurityException with the offending entry name so callers can
+     * fail loudly (and report to crash analytics) when malformed archives
+     * appear in production.
+     */
+    internal fun assertSafeEntryPath(canonicalDestDir: File, entryName: String) {
+      val resolved = File(canonicalDestDir, entryName).canonicalFile
+      val destPrefix = canonicalDestDir.path + File.separator
+      if (resolved.path != canonicalDestDir.path &&
+          !resolved.path.startsWith(destPrefix)) {
+        throw SecurityException(
+          "Refusing to extract entry outside destination: $entryName (resolves to ${resolved.path})"
+        )
+      }
+    }
   }
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-nitro-unzip",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "High-performance ZIP extraction for React Native, powered by Nitro Modules",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",