chore: upgrade to 2.6.2-exodus.0 for RN 0.85#13
Open
raxodus wants to merge 6 commits into
Open
Conversation
Harden dictionary objects against prototype pollution: - Recorder.ts: animatedProps - utils.ts: materialize() result - NativeSkiaModule.web.ts: views, deferedPictures, deferedOnSize
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| if (content !== modified) { | ||
| fs.writeFileSync(projectPath, modified, 'utf8'); |
| const assets: any = {}; | ||
| if (value.assets) { | ||
| Object.keys(value.assets).forEach((key) => { | ||
| assets[key] = Skia.Data.fromBytes(new Uint8Array(value.assets[key])); |
| // eslint-disable-next-line no-eval | ||
| return eval( | ||
| `(function Main(){ const {Skia} = this; return (${value.source}); })` | ||
| `(function Main(){ const {Skia, TileMode} = this; return (${value.source}); })` |
|
|
||
| // Run installation | ||
| install().catch((error) => { | ||
| console.error(`\n❌ Installation failed: ${error.message}\n`); |
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
JsiHostObject::get fell back to runtime.global().eval("Symbol.for('Symbol.dispose');")
for the dispose-symbol lookup on every property miss. With a Hermes build that
disables the JS eval builtin (e.g. @exodus/hermes-engine V1's eval-disable patch),
the first miss throws an uncaught jsi::JSError and crashes the app on boot —
reproducibly seen when Reanimated 4 worklets access `_isReanimatedSharedValue`
on a Skia HostObject during MapperRegistry setup.
Replace the eval invocation with a direct JSI traversal of `Symbol.for`. The
behaviour is equivalent (Symbol.for("Symbol.dispose") returns the same well-known
symbol regardless of how it is reached) and the path no longer depends on the JS
eval builtin being available.
Remove the now-unused `RNJsi::eval` helper (no other consumers in this file or
across the package).
Bump to 2.6.2-exodus.1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rebase of Exodus patches onto upstream react-native-skia v2.6.2 (from v2.0.1).
Part of the RN 0.85 upgrade: ExodusMovement/exodus-mobile#38221.
Exodus Patches
d91da15c3caf6becd68bc2a4dabFork Cleanup
Removed non-shipped directories to eliminate Copilot/CodeQL scan noise and reduce repo size (690 files, 76,592 lines deleted, ~111 MB):
apps/(~111 MB)externals/.gitmodulesexternals/submodule definitions)Verified:
packages/skia/package.jsonfilesfield excludes both directories. Build-critical files intact:packages/skia/react-native-skia.podspec,packages/skia/android/build.gradle,packages/skia/android/CMakeLists.txt,packages/skia/scripts/install-libs.js,packages/skia/scripts/setup-canvaskit.js.Upstream Changelog (v2.0.1 → v2.6.2)
351 commits across ~813 files changed. Key highlights:
.xcframeworkfor Apple,.afor Android) split into separate npm packages (react-native-skia-android@147.1.0,react-native-skia-apple-ios@147.1.0, etc.) installed via apostinstallscript (scripts/install-libs.js). Previously bundled directly in the package.Skia.Skottiefactory,CustomPropertyManagerfor dynamic property manipulationSkia.PathBuilder): Replaces mutating path methodsSK_GRAPHITE=1env flag; not enabled in standard builds>=3.19.1build.gradle(reduces supply-chain exposure)setExternalMemoryPressure()TextPathCmdwith unsupported glyphsSecurity Audit of Upstream Changes
Prototype Pollution Vectors
No new
Object.assign,__proto__, orconstructor[patterns in production JS/TS source (packages/skia/src/). The diff contains onlyObject.keys,Object.values, andObject.entriescalls, which are safe. Upstream does not applyObject.create(null)hardening — the Exodus8bc2a4dabpatch remains necessary. ✅Command Injection
packages/skia/scripts/utils.tsexports$()(callingexecSync()) andrunAsync()(usingspawn(..., { shell: true })). These are developer build scripts only — not included in published npmfilesand never executed at runtime. The publishedinstall-libs.jspostinstall script uses onlyfs.cpSync/fs.readdirSync/require.resolve— no shell execution.Android
build.gradleand iOSreact-native-skia.podspecpass build-time config via CMake-Dflags. No user-controlled strings flow into shell commands. ✅Network Requests
Two
fetch()sites exist in lib source — both are web-only (.web.tssuffix, not bundled in React Native builds):JsiSkDataFactory.ts(fromURI) — present since before v2.0.1; unchangedSVG.web.ts(useSVGhook) — new; accepts app-code-supplied URLNo new runtime network requests in React Native builds. ✅
Binary Blobs / Non-reproducible Artifacts
Significant structural change: Prebuilt binaries moved from bundled-in-package to four separate npm packages:
react-native-skia-android@147.1.0react-native-skia-apple-ios@147.1.0react-native-skia-apple-macos@147.1.0react-native-skia-apple-tvos@147.1.0Published with npm OIDC provenance (
"provenance": true). Theinstall-libs.jspostinstall copies binaries viafs.cpSync— no network calls at postinstall. No binary blobs committed directly to the git repository.ReDoS Patterns
No
new RegExp(userInput)or dynamically constructed regular expressions in production source. ✅Unsafe Dynamic Code Execution
surface.eval()appears extensively but is confined to__tests__/e2e/test files only — a test harness API, not callable at runtime. GLSL.eval(pos)in shader source files are compile-time constants for Skia's runtime shader API, not JSeval. Noeval(),new Function(), orsetTimeout(string)in production source. ✅New Dependencies
Runtime dependencies:
react-native-skia-android147.1.0react-native-skia-apple-ios147.1.0react-native-skia-apple-macos147.1.0react-native-skia-apple-tvos147.1.0canvaskit-wasm0.40.0 → 0.41.0All other new deps are dev/CI-only (
jest30,eslint9,tsx,@blazediff/core).Findings Summary
execSync/spawnonly in dev build scriptsfetch; no new RN runtime network callssurface.eval()is test-onlyTest Plan
src/package.jsonin exodus-mobile-upgrade worktreereact-native-skia-{android,apple-ios}@147.1.0in lockfileyarn ios:basebuildsyarn android:basebuilds