Add crc32 for jsFile included for tamperproofing

cruxprotocol · Jan 17, 2020 · 6f388aa · 6f388aa
1 parent 9dceefd
commit 6f388aa
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/sdk/src/main/java/com/crux/sdk/bridge/CruxJSBridge.java b/sdk/src/main/java/com/crux/sdk/bridge/CruxJSBridge.java
@@ -18,6 +18,7 @@ public class CruxJSBridge {
     private final JSContext jsContext;
     private JSObject jsClient;
     private final String cruxJsFileName = "cruxpay-0.1.9.js";
+    private final Long cruxJsFileCheckSum = new Long(349195419);
 
 
     public CruxJSBridge(CruxClientInitConfig.Builder configBuilder, Context androidContextObject) throws IOException, CruxClientError {
@@ -45,8 +46,11 @@ private void prepareCruxClientInitConfig(CruxClientInitConfig.Builder configBuil
         configBuilder = null;
     }
 
-    private JSContext getContextForClient(Context androidContextObject) throws IOException {
+    private JSContext getContextForClient(Context androidContextObject) throws IOException, CruxClientError {
         String sdkFile = GenericUtils.getFromFile(androidContextObject, cruxJsFileName);
+        if (GenericUtils.crc32(sdkFile) != cruxJsFileCheckSum) {
+            throw CruxClientError.getCruxClientError(AndroidCruxClientErrorCode.runningInUnsafeEnvironment);
+        }
         JSContext jsContext = new JSContext();
         JSPolyFill.fixConsoleLog(jsContext);
         JSPolyFill.addFetch(jsContext, androidContextObject);

diff --git a/sdk/src/main/java/com/crux/sdk/bridge/GenericUtils.java b/sdk/src/main/java/com/crux/sdk/bridge/GenericUtils.java
@@ -11,6 +11,8 @@
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.util.Arrays;
+import java.util.zip.CRC32;
+import java.util.zip.Checksum;
 
 import org.liquidplayer.javascript.JSValue;
 
@@ -47,5 +49,13 @@ else if (val.isObject())
         return null;
     }
 
+    public static long crc32(String input) {
+        byte[] bytes = input.getBytes();
+        Checksum checksum = new CRC32(); // java.util.zip.CRC32
+        checksum.update(bytes, 0, bytes.length);
+
+        return checksum.getValue();
+    }
+
 }