feat: harden firmware upgrade pipeline

apps/cli/package.json

@@ -44,9 +44,9 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^1.3.0",
-    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.69",
-    "@onekeyfe/hd-core": "1.2.0-alpha.69",
-    "@onekeyfe/hd-transport-usb": "1.2.0-alpha.69",
+    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.77",
+    "@onekeyfe/hd-core": "1.2.0-alpha.77",
+    "@onekeyfe/hd-transport-usb": "1.2.0-alpha.77",
     "proper-lockfile": "^4.1.2"
   }
 }

apps/desktop/app/app.ts

@@ -57,6 +57,10 @@
 import { ipcMessageKeys } from './config';
 import { ElectronTranslations, i18nText, initLocale } from './i18n';
 import { scheduleCrashDumpCleanup } from './libs/crashDumpCleanup';
+import {
+  DESKTOP_API_ALLOWED_MODULES,
+  isDesktopApiMethodAllowed,
+} from './libs/desktopApiModuleAllowlist';
 import {
   applyDesktopNetworkThrottleToKnownSessions,
   applyDesktopNetworkThrottleToWebContents,
@@ -325,7 +329,7 @@
         e,
       );
     }
     mainWindow = await createMainWindow({ isSoftRestart: true });
     showMainWindow();
     logger.info('[softRestart] done: renderer recreated with new bundle', {
       durationMs: Date.now() - startedAt,
@@ -920,7 +924,7 @@
 
   browserWindow.webContents.on('unresponsive', () => {
     logger.warn('[CPU Watchdog] renderer webContents unresponsive');
     triggerCpuWatchdog({ reason: 'unresponsive' });
   });
   browserWindow.webContents.on('responsive', () => {
     logger.info('[CPU Watchdog] renderer webContents responsive again');
@@ -1132,23 +1136,7 @@
 
   // New invoke-based handler for contextIsolation-compatible API calls
   ipcMain.removeHandler('DESKTOP_API_CALL');
-  const allowedModules = new Set([
-    'system',
-    'security',
-    'storage',
-    'webview',
-    'notification',
-    'dev',
-    'inAppPurchase',
-    'bluetooth',
-    'appUpdate',
-    'bundleUpdate',
-    'cloudKit',
-    'keychain',
-    'sniRequest',
-    'oauthLocalServer',
-    'appleAuth',
-  ]);
+  const allowedModules = new Set<string>(DESKTOP_API_ALLOWED_MODULES);
   ipcMain.handle(
     'DESKTOP_API_CALL',
     async (
@@ -1176,14 +1164,7 @@
           `DESKTOP_API_CALL: unknown module "${module}"`,
         );
       }
-      // Block inherited prototype methods and private methods
-      if (
-        typeof method !== 'string' ||
-        method.startsWith('_') ||
-        ['constructor', 'toString', 'valueOf', 'hasOwnProperty'].includes(
-          method,
-        )
-      ) {
+      if (!isDesktopApiMethodAllowed(module, method)) {
         throw new OneKeyLocalError(
           `DESKTOP_API_CALL: disallowed method "${method}"`,
         );

apps/desktop/app/libs/desktopApiModuleAllowlist.test.ts

@@ -0,0 +1,50 @@
+import {
+  DESKTOP_API_ALLOWED_MODULES,
+  isDesktopApiMethodAllowed,
+  isDesktopApiModuleAllowed,
+} from './desktopApiModuleAllowlist';
+
+describe('desktop API module allowlist', () => {
+  it('allows the firmware artifact module required by desktop upgrades', () => {
+    expect(DESKTOP_API_ALLOWED_MODULES).toContain('firmwareArtifact');
+    expect(isDesktopApiModuleAllowed('firmwareArtifact')).toBe(true);
+  });
+
+  it('rejects modules outside the explicit allowlist', () => {
+    expect(isDesktopApiModuleAllowed('__proto__')).toBe(false);
+  });
+
+  it.each([
+    'getCapabilities',
+    'download',
+    'cancelDownloads',
+    'materialize',
+    'open',
+    'read',
+    'close',
+    'createLease',
+    'retain',
+    'releaseLease',
+    'sweepOrphans',
+  ])('allows firmwareArtifact.%s', (method) => {
+    expect(isDesktopApiMethodAllowed('firmwareArtifact', method)).toBe(true);
+  });
+
+  it.each([
+    'validateDownloadInput',
+    'downloadLocked',
+    'streamResponseToFile',
+    'writeResponseBody',
+    'promoteArtifact',
+    'resolveArtifactPath',
+    '__proto__',
+    'constructor',
+  ])('rejects firmwareArtifact.%s', (method) => {
+    expect(isDesktopApiMethodAllowed('firmwareArtifact', method)).toBe(false);
+  });
+
+  it('keeps the legacy method policy for existing modules', () => {
+    expect(isDesktopApiMethodAllowed('system', 'getSystemInfo')).toBe(true);
+    expect(isDesktopApiMethodAllowed('system', '_privateMethod')).toBe(false);
+  });
+});

apps/desktop/app/libs/desktopApiModuleAllowlist.ts

@@ -0,0 +1,68 @@
+export const DESKTOP_API_ALLOWED_MODULES = Object.freeze([
+  'system',
+  'security',
+  'storage',
+  'webview',
+  'notification',
+  'dev',
+  'inAppPurchase',
+  'bluetooth',
+  'appUpdate',
+  'bundleUpdate',
+  'cloudKit',
+  'keychain',
+  'sniRequest',
+  'oauthLocalServer',
+  'appleAuth',
+  'firmwareArtifact',
+] as const);
+
+const DESKTOP_API_ALLOWED_METHODS_BY_MODULE: Readonly<
+  Partial<
+    Record<(typeof DESKTOP_API_ALLOWED_MODULES)[number], readonly string[]>
+  >
+> = Object.freeze({
+  firmwareArtifact: Object.freeze([
+    'getCapabilities',
+    'download',
+    'cancelDownloads',
+    'materialize',
+    'open',
+    'read',
+    'close',
+    'createLease',
+    'retain',
+    'releaseLease',
+    'sweepOrphans',
+  ]),
+});
+
+const DESKTOP_API_DISALLOWED_METHODS = new Set([
+  'constructor',
+  'toString',
+  'valueOf',
+  'hasOwnProperty',
+]);
+
+export const isDesktopApiModuleAllowed = (module: string): boolean =>
+  DESKTOP_API_ALLOWED_MODULES.includes(
+    module as (typeof DESKTOP_API_ALLOWED_MODULES)[number],
+  );
+
+export const isDesktopApiMethodAllowed = (
+  module: string,
+  method: unknown,
+): boolean => {
+  if (
+    typeof method !== 'string' ||
+    method.startsWith('_') ||
+    DESKTOP_API_DISALLOWED_METHODS.has(method)
+  ) {
+    return false;
+  }
+  const allowedMethods =
+    DESKTOP_API_ALLOWED_METHODS_BY_MODULE[
+      module as (typeof DESKTOP_API_ALLOWED_MODULES)[number]
+    ];
+  return allowedMethods ? allowedMethods.includes(method) : true;
+};

apps/mobile/ios/AppDelegate.swift

@@ -249,16 +249,8 @@ public class AppDelegate: ExpoAppDelegate {
   }
 
   // Background URLSession events (concurrent/background downloads).
-  // When the app is relaunched in the background to finish a background
-  // download, hand the completion handler to the downloader via a notification.
-  // We post rather than call directly because the Nitro module's C++ umbrella
-  // header can't be imported into this Swift AppDelegate (see the
-  // NSClassFromString bridges above). If the downloader instance isn't live yet
-  // the events are processed on the next foreground launch instead — the
-  // download itself still completed in the background.
-  //
   // Posted under a generic name (RangeDownloaderBackgroundEvents) so any number
-  // of channels (bundle / apk / chart) route through one notification; the
+  // of channels route through one notification; the
   // shared range-downloader filters by its own session identifier prefix (and
   // still recognizes the legacy identifier prefix for in-flight downloads that
   // span an app update).

apps/mobile/ios/Podfile.lock

@@ -4006,7 +4006,7 @@ PODS:
     - ReactNativeNativeLogger
     - SocketRocket
     - Yoga
-  - ReactNativeRangeDownloader (3.0.78):
+  - ReactNativeRangeDownloader (3.0.81-alpha.11):
     - boost
     - DoubleConversion
     - fast_float
@@ -4036,6 +4036,7 @@ PODS:
     - ReactCommon/turbomodule/core
     - ReactNativeNativeLogger
     - SocketRocket
+    - SSZipArchive (= 2.5.5)
     - Yoga
   - ReactNativeSplashScreen (3.0.78):
     - boost
@@ -4710,7 +4711,7 @@ PODS:
     - ReactCommon/turbomodule/core
     - SocketRocket
     - Yoga
-  - SniConnect (3.0.78):
+  - SniConnect (3.0.81-alpha.9):
     - boost
     - DoubleConversion
     - EMASCurl (= 1.5.5)
@@ -5564,7 +5565,7 @@ SPEC CHECKSUMS:
   ReactNativePasskeys: 9e950e8cbf0e7d6aad9df4dcd21cee0efeb4e5cd
   ReactNativePerfMemory: 7ef4df212ac2a19e5125deb9f2067ee110235e48
   ReactNativePerfStats: d1368e3a14b5387dea7cc87bca9a566810636f5e
-  ReactNativeRangeDownloader: fb71689f6c2ccf99ad63b59411a84ee1581bc7ac
+  ReactNativeRangeDownloader: 93e90ff445d0404cb97a6eea7a617b4b4b209c12
   ReactNativeSplashScreen: 0bc82cdce113b2f60366b3d0f2a495ff86e13022
   ReactNativeZipArchive: bb4a2b338281c0166bee97142bf59ef9cd124c62
   RealmJS: 1c37c6bdfe060f4caa0f9175aa0eedb962622ee1
@@ -5588,7 +5589,7 @@ SPEC CHECKSUMS:
   SegmentSlider: e3507345e9bf6a48fd301181765d056a70420512
   Sentry: b53951377b78e21a734f5dc8318e333dbfc682d7
   Skeleton: e04f3e3d91865cdb03ef256a095d128688acf3fb
-  SniConnect: 4093cf48264f2b78081f8cfa8482d7a6453803c5
+  SniConnect: eb28a03028065e205739894cb10be4c80b8cabd5
   SocketRocket: d4aabe649be1e368d1318fdf28a022d714d65748
   SPAlert: 735da1f16a887e294719217572ce1f936d8c8782
   SPIndicator: 93e0a4fb23de51294ac48e874c0f081a5e293e4f

apps/mobile/package.json

@@ -71,11 +71,11 @@
     "@onekeyfe/react-native-perf-memory": "3.0.78",
     "@onekeyfe/react-native-perf-stats": "3.0.78",
     "@onekeyfe/react-native-perp-depth-bar": "3.0.78",
-    "@onekeyfe/react-native-range-downloader": "3.0.78",
+    "@onekeyfe/react-native-range-downloader": "3.0.81-alpha.11",
     "@onekeyfe/react-native-scroll-guard": "3.0.78",
     "@onekeyfe/react-native-segment-slider": "3.0.78",
     "@onekeyfe/react-native-skeleton": "3.0.78",
-    "@onekeyfe/react-native-sni-connect": "3.0.78",
+    "@onekeyfe/react-native-sni-connect": "3.0.81-alpha.9",
     "@onekeyfe/react-native-splash-screen": "3.0.78",
     "@onekeyfe/react-native-split-bundle-loader": "3.0.78",
     "@onekeyfe/react-native-tab-view": "3.0.78",

development/perf-ci/thresholds/web.cold.json

@@ -50,7 +50,7 @@
     "swap": {
       "resourceCount": 220,
       "scriptCount": 169,
-      "jsDecodedBytes": 17458790,
+      "jsDecodedBytes": 17475174,
       "longTaskTotalMs": 1200
     },
     "defi": {

package.json

@@ -158,21 +158,21 @@
     "@onekeyfe/cross-inpage-provider-injected": "2.2.73",
     "@onekeyfe/cross-inpage-provider-types": "2.2.73",
     "@onekeyfe/extension-bridge-hosted": "2.2.73",
-    "@onekeyfe/hd-ble-sdk": "1.2.0-alpha.69",
-    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.69",
-    "@onekeyfe/hd-core": "1.2.0-alpha.69",
-    "@onekeyfe/hd-shared": "1.2.0-alpha.69",
-    "@onekeyfe/hd-transport": "1.2.0-alpha.69",
-    "@onekeyfe/hd-transport-electron": "1.2.0-alpha.69",
-    "@onekeyfe/hd-web-sdk": "1.2.0-alpha.69",
-    "@onekeyfe/hwk-adapter-core": "1.2.0-alpha.69",
-    "@onekeyfe/hwk-ledger-adapter": "1.2.0-alpha.69",
-    "@onekeyfe/hwk-ledger-connector-ble": "1.2.0-alpha.69",
-    "@onekeyfe/hwk-ledger-connector-webhid": "1.2.0-alpha.69",
-    "@onekeyfe/hwk-trezor-adapter": "1.2.0-alpha.69",
-    "@onekeyfe/hwk-trezor-connector-electron-ble": "1.2.0-alpha.69",
-    "@onekeyfe/hwk-trezor-connector-rn-ble": "1.2.0-alpha.69",
-    "@onekeyfe/hwk-trezor-connector-webusb": "1.2.0-alpha.69",
+    "@onekeyfe/hd-ble-sdk": "1.2.0-alpha.77",
+    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.77",
+    "@onekeyfe/hd-core": "1.2.0-alpha.77",
+    "@onekeyfe/hd-shared": "1.2.0-alpha.77",
+    "@onekeyfe/hd-transport": "1.2.0-alpha.77",
+    "@onekeyfe/hd-transport-electron": "1.2.0-alpha.77",
+    "@onekeyfe/hd-web-sdk": "1.2.0-alpha.77",
+    "@onekeyfe/hwk-adapter-core": "1.2.0-alpha.77",
+    "@onekeyfe/hwk-ledger-adapter": "1.2.0-alpha.77",
+    "@onekeyfe/hwk-ledger-connector-ble": "1.2.0-alpha.77",
+    "@onekeyfe/hwk-ledger-connector-webhid": "1.2.0-alpha.77",
+    "@onekeyfe/hwk-trezor-adapter": "1.2.0-alpha.77",
+    "@onekeyfe/hwk-trezor-connector-electron-ble": "1.2.0-alpha.77",
+    "@onekeyfe/hwk-trezor-connector-rn-ble": "1.2.0-alpha.77",
+    "@onekeyfe/hwk-trezor-connector-webusb": "1.2.0-alpha.77",
     "@onekeyfe/onekey-cross-webview": "2.2.73",
     "@polkadot/extension-inject": "0.54.1",
     "@polkadot/types": "14.3.1",
@@ -416,11 +416,11 @@
     "@reown/appkit-ethers5-react-native": "https://github.com/OneKeyHQ/app-modules#9d96daccc13625e5b3c8b236f9357956b049b884",
     "@reown/appkit-scaffold-react-native": "https://github.com/OneKeyHQ/app-modules#ef39e1c6682f8b50dc019a851f6e2211392d353a",
     "@reown/appkit-scaffold-utils-react-native": "https://github.com/OneKeyHQ/app-modules#aa31ef69e5058bb822c40f0a706ee9bdd191b005",
-    "@onekeyfe/hd-core": "1.2.0-alpha.69",
-    "@onekeyfe/hd-shared": "1.2.0-alpha.69",
-    "@onekeyfe/hd-transport": "1.2.0-alpha.69",
-    "@onekeyfe/hd-transport-http": "1.2.0-alpha.69",
-    "@onekeyfe/hd-transport-web-device": "1.2.0-alpha.69",
+    "@onekeyfe/hd-core": "1.2.0-alpha.77",
+    "@onekeyfe/hd-shared": "1.2.0-alpha.77",
+    "@onekeyfe/hd-transport": "1.2.0-alpha.77",
+    "@onekeyfe/hd-transport-http": "1.2.0-alpha.77",
+    "@onekeyfe/hd-transport-web-device": "1.2.0-alpha.77",
     "promise": "^8.3.0",
     "metro": "0.83.2",
     "metro-babel-transformer": "0.83.2",

packages/kit-bg/package.json

@@ -9,7 +9,11 @@
     "idb": "^7.1.1",
     "ipaddr.js": "^2.3.0",
     "jpeg-js": "^0.4.4",
-    "miscreant": "^0.3.2"
+    "miscreant": "^0.3.2",
+    "yauzl": "2.10.0"
+  },
+  "devDependencies": {
+    "@types/yauzl": "2.10.3"
   },
   "scripts": {
     "keyless:mock-server:build": "tsc -p tsconfig.keyless-mock-server.json",