Bump 1.6.1

Fix zip path traversal issue(we are likely unaffected since we do not unzip arbitrary zip files, just certificates_zip. Update certificates_zip.
2022-01-06 19:32:45 -05:00 · 2022-01-06 19:31:25 -05:00
2 changed files with 6 additions and 2 deletions
--- a/app/src/main/java/net/i2p/android/InitActivities.java
+++ b/app/src/main/java/net/i2p/android/InitActivities.java
@ -209,7 +209,11 @@ class InitActivities {
                    }
                    String name = ze.getName();
                    File f = new File(myDir + "/" + folder +"/" + name);
-                    if (ze.isDirectory()) {
+                    String canonicalPath = f.getCanonicalPath();
+                    if (!canonicalPath.startsWith(myDir)) {
+                        // If these don't match, there's a path-traversal possibility.
+                        // So ignore it.
+                    } else if (ze.isDirectory()) {
                        Util.d("Creating directory " + myDir + "/" + folder +"/" + name + " from resource");
                        f.mkdir();
                    } else {
--- a/gradle.properties
+++ b/gradle.properties
@ -17,4 +17,4 @@ POM_DEVELOPER_EMAIL=hankhill19580@gmail.com
 ANDROID_BUILD_TARGET_SDK_VERSION=29
 ANDROID_BUILD_SDK_VERSION=28

-I2P_VERSION=1.6.0
+I2P_VERSION=1.6.1
Author	SHA1	Message	Date
idk	84e73a693c	Bump 1.6.1	2022-01-06 19:32:45 -05:00
idk	c0ad7dfc09	Fix zip path traversal issue(we are likely unaffected since we do not unzip arbitrary zip files, just certificates_zip. Update certificates_zip.	2022-01-06 19:31:25 -05:00