fix: resolve #1102 — tinker补丁zip解压缩漏洞

[Nam0101]

Summary

fix: resolve #1102 — tinker补丁zip解压缩漏洞

Problem

Severity: High | File: tinker-android/tinker-android-lib/src/main/java/com/tencent/tinker/lib/patch/BsDiffPatchInternal.java

This sibling class extracts native library entries from the same patch zip. It is subject to the same Zip Slip vector if it uses ZipEntry.getName() to construct destination paths under the patch lib directory.

Solution

Refactor the entry-name validator into a shared utility (see suggested PatchEntryUtils below) and call it for every ZipEntry consumed in patchFastExtractDiffInternals / similar methods. Also perform the canonical-path containment check before writing each extracted file.

Changes

• tinker-android/tinker-android-lib/src/main/java/com/tencent/tinker/lib/patch/PatchEntryUtils.java (new)
• tinker-android/tinker-android-lib/src/main/java/com/tencent/tinker/lib/patch/ResDiffPatchInternal.java (modified)
• tinker-android/tinker-android-lib/src/main/java/com/tencent/tinker/lib/util/PatchEntryUtils.java (new)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced

---

Note: this change was drafted with AI assistance and reviewed locally before submission.

[tencent-adm]

All committers have signed the CLA.