- Add `otaFilenameCandidates` to strip all known extensions (.aea,
.ota, .zip) and generate a fallback candidate from the last
underscore-delimited segment (e.g. downloaded filenames like
`iPhone18,1_23F5043k_<hash>.aea` now match DB entries keyed by
`<hash>`)
- Add test covering the downloaded-filename → archive-stem lookup
- Serialize `GetPayloadFiles` and `PayloadFiles` loops (remove
`errgroup` concurrency) to fix data races and ensure correct
error propagation with explicit resource cleanup
- Add `ErrCryptexNotFound` sentinel error for programmatic detection
- Add `system-arm64e` and `system-x86_64h` as explicit cryptex
selector variants
- Remove POST /diff/files endpoint that allowed arbitrary host file reads
(CWE-22); clients must now read files locally and POST content to
/diff/blobs instead
- Add validatePublicURL() to /info remote endpoints, rejecting URLs that
resolve to loopback, private, link-local, or multicast addresses to
prevent SSRF; also remove attacker-controlled proxy/insecure params
- Add SanitizeArchivePath() helper that verifies extracted archive entry
paths stay within the destination directory (zip-slip / tar-slip,
CWE-22); replace bare filepath.Join(dest, filepath.Clean(name)) calls
in SearchZip, OTA parser, AA payload extractor, and ota_extract
- Fix server listen address to use net.JoinHostPort to respect Host config
- Support controlSize=0 (full-replacement) BXDIFF50 patches by
decompressing XZ/PBZX streams directly instead of raw extraction
- Add decompressStream helper that handles both raw XZ and PBZX formats
- Extract patch from ZIP before base-file lookup so temp file is always
cleaned up on skip
- Stream patch file instead of loading entirely into memory
Corrects ResolveAEAKey to prioritize explicit symmetric keys over
database lookups as documented. Previously the database was checked
first regardless of whether an explicit key was provided.
Refactors extraction code into testable helper functions and adds
unit tests. Fixes resource leaks in pbzx decompression path.
blacktop
Sam CollinsonandGitHub