Skip to content

fix(ios): constrain releaseCapture to direct temporary files - #683

Open
OskarEichler wants to merge 2 commits into
gre:masterfrom
OskarEichler:codex/viewshot-ios-release-containment
Open

fix(ios): constrain releaseCapture to direct temporary files#683
OskarEichler wants to merge 2 commits into
gre:masterfrom
OskarEichler:codex/viewshot-ios-release-containment

Conversation

@OskarEichler

@OskarEichler OskarEichler commented Aug 28, 2026

Copy link
Copy Markdown

Summary

Constrain releaseCapture to regular files that are direct children of React Native's temporary directory.

The implementation replaces raw string-prefix recursive removal with exact-root/direct-child validation and descriptor-relative, nonrecursive deletion. It rejects traversal, prefix siblings, directories, NULs, and symbolic-link escapes while preserving raw paths returned by RCTTempFilePath.

The native regression test now verifies that a file in a prefix-only sibling such as ReactNativeImposter is preserved.

Compatibility

Normal native-generated capture paths continue to release correctly. Arbitrary paths that merely share the temporary-root prefix, nested paths, directories, and symbolic links are no longer removed. No dependency or SDK version changes.

Verification

  • Focused iOS Simulator XCTest target: 5 tests passed, 0 failures
  • The targeted test covers normal capture deletion, missing files, outside paths, the root directory itself, and prefix-only sibling paths
  • git diff --check

Type: fix

@OskarEichler
OskarEichler marked this pull request as ready for review August 30, 2026 09:52
@OskarEichler

Copy link
Copy Markdown
Author

Resolved the draft blocker by updating the existing native regression to assert the fixed behavior: prefix-only sibling paths are preserved. I reran the focused iOS Simulator XCTest target against the actual CocoaPods workspace; all 5 RNViewShotReleaseCaptureTests pass with 0 failures. I’ve marked the PR ready for review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant