@capgo/capacitor-ssl-pinning 8.1.5 → 8.1.7

package/README.md

@@ -54,7 +54,7 @@ const config: CapacitorConfig = {
       enabled: true,
     },
     SSLPinning: {
-      certs: ['sslCerts/production/primary.cer', 'sslCerts/production/backup.cer'],
+      certs: ['sslCerts/production/primary.cer', 'sslCerts/production/backup.der'],
       excludedDomains: ['https://analytics.google.com'],
     },
   },
@@ -63,7 +63,7 @@ const config: CapacitorConfig = {
 export default config;
 ```
 
-During `bunx cap sync`, the plugin copies the configured certificates into `webDir/certs`, which lets both native implementations load them from the bundled app assets.
+During `bunx cap sync`, the plugin copies the configured certificates into `webDir/certs`, which lets both native implementations load them from the bundled app assets. Both `.cer` and `.der` are supported; PEM `.cer` files are converted to DER automatically for iOS.
 
 ## Usage
 

package/android/src/main/java/io/ionic/sslpinning/CertificateLoader.java

@@ -3,6 +3,7 @@ package io.ionic.sslpinning;
 import android.content.Context;
 import com.getcapacitor.Bridge;
 import com.getcapacitor.PluginConfig;
+import java.io.FileNotFoundException;
 import java.io.InputStream;
 import java.net.URL;
 import java.security.KeyStore;
@@ -91,9 +92,43 @@ final class CertificateLoader {
 
     private static X509Certificate loadCertificate(final Context context, final String configuredCertPath) throws Exception {
         final String fileName = configuredCertPath.substring(configuredCertPath.lastIndexOf('/') + 1);
+        final String[] candidateFileNames = candidateFileNames(fileName);
+        final CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
+
+        for (String candidateFileName : candidateFileNames) {
+            try (InputStream inputStream = context.getAssets().open(CERTS_DIR + "/" + candidateFileName)) {
+                return (X509Certificate) certificateFactory.generateCertificate(inputStream);
+            } catch (FileNotFoundException ignored) {
+                // Try alternate extension if available.
+            }
+        }
+
+        // Trigger the original exception message for easier debugging.
         try (InputStream inputStream = context.getAssets().open(CERTS_DIR + "/" + fileName)) {
-            final CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
             return (X509Certificate) certificateFactory.generateCertificate(inputStream);
         }
     }
+
+    private static String[] candidateFileNames(final String fileName) {
+        if (fileName == null) {
+            return new String[0];
+        }
+
+        final int dotIndex = fileName.lastIndexOf('.');
+        if (dotIndex == -1) {
+            return new String[] { fileName };
+        }
+
+        final String base = fileName.substring(0, dotIndex);
+        final String ext = fileName.substring(dotIndex + 1).toLowerCase();
+
+        if ("cer".equals(ext)) {
+            return new String[] { fileName, base + ".der" };
+        }
+        if ("der".equals(ext)) {
+            return new String[] { fileName, base + ".cer" };
+        }
+
+        return new String[] { fileName };
+    }
 }

package/dist/esm/definitions.d.ts

@@ -33,6 +33,10 @@ export interface SSLPinningPluginConfig {
      *
      * During `bunx cap sync`, this plugin copies them into `webDir/certs` so native runtimes can load them from
      * the bundled web assets.
+     *
+     * Both `.cer` and `.der` filenames are supported. iOS requires DER-encoded X.509 certificates; when a
+     * certificate file is provided in PEM form (for example a `.cer` containing `-----BEGIN CERTIFICATE-----`),
+     * the sync hook converts it to DER while keeping the same filename.
      */
     certs?: string[];
     /**

package/dist/esm/definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Plugin version payload.\n */\nexport interface PluginVersionResult {\n  /**\n   * Version identifier returned by the platform implementation.\n   */\n  version: string;\n}\n\n/**\n * Static SSL pinning configuration currently visible to the plugin.\n */\nexport interface SSLPinningConfigurationState {\n  /**\n   * Whether at least one certificate is configured for native pinning.\n   */\n  configured: boolean;\n\n  /**\n   * Certificate paths from `capacitor.config.*` relative to the app root.\n   */\n  certs: string[];\n\n  /**\n   * Fully-qualified URLs that should bypass SSL pinning.\n   */\n  excludedDomains: string[];\n}\n\n/**\n * Plugin configuration added under `plugins.SSLPinning` in `capacitor.config.*`.\n */\nexport interface SSLPinningPluginConfig {\n  /**\n   * Certificate files relative to the application root.\n   *\n   * During `bunx cap sync`, this plugin copies them into `webDir/certs` so native runtimes can load them from\n   * the bundled web assets.\n   */\n  certs?: string[];\n\n  /**\n   * Fully-qualified URLs that should bypass pinning.\n   *\n   * Match is done by origin, and by path-prefix when the configured URL contains a path.\n   */\n  excludedDomains?: string[];\n}\n\n/**\n * Capacitor API for inspecting SSL pinning configuration.\n *\n * Native enforcement is applied automatically to `CapacitorHttp` requests when:\n * 1. `plugins.CapacitorHttp.enabled` is `true`\n * 2. `plugins.SSLPinning.certs` contains at least one certificate\n */\nexport interface SSLPinningPlugin {\n  /**\n   * Returns the active native configuration visible to the plugin.\n   */\n  getConfiguration(): Promise<SSLPinningConfigurationState>;\n\n  /**\n   * Returns the native implementation version marker.\n   */\n  getPluginVersion(): Promise<PluginVersionResult>;\n}\n"]}
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Plugin version payload.\n */\nexport interface PluginVersionResult {\n  /**\n   * Version identifier returned by the platform implementation.\n   */\n  version: string;\n}\n\n/**\n * Static SSL pinning configuration currently visible to the plugin.\n */\nexport interface SSLPinningConfigurationState {\n  /**\n   * Whether at least one certificate is configured for native pinning.\n   */\n  configured: boolean;\n\n  /**\n   * Certificate paths from `capacitor.config.*` relative to the app root.\n   */\n  certs: string[];\n\n  /**\n   * Fully-qualified URLs that should bypass SSL pinning.\n   */\n  excludedDomains: string[];\n}\n\n/**\n * Plugin configuration added under `plugins.SSLPinning` in `capacitor.config.*`.\n */\nexport interface SSLPinningPluginConfig {\n  /**\n   * Certificate files relative to the application root.\n   *\n   * During `bunx cap sync`, this plugin copies them into `webDir/certs` so native runtimes can load them from\n   * the bundled web assets.\n   *\n   * Both `.cer` and `.der` filenames are supported. iOS requires DER-encoded X.509 certificates; when a\n   * certificate file is provided in PEM form (for example a `.cer` containing `-----BEGIN CERTIFICATE-----`),\n   * the sync hook converts it to DER while keeping the same filename.\n   */\n  certs?: string[];\n\n  /**\n   * Fully-qualified URLs that should bypass pinning.\n   *\n   * Match is done by origin, and by path-prefix when the configured URL contains a path.\n   */\n  excludedDomains?: string[];\n}\n\n/**\n * Capacitor API for inspecting SSL pinning configuration.\n *\n * Native enforcement is applied automatically to `CapacitorHttp` requests when:\n * 1. `plugins.CapacitorHttp.enabled` is `true`\n * 2. `plugins.SSLPinning.certs` contains at least one certificate\n */\nexport interface SSLPinningPlugin {\n  /**\n   * Returns the active native configuration visible to the plugin.\n   */\n  getConfiguration(): Promise<SSLPinningConfigurationState>;\n\n  /**\n   * Returns the native implementation version marker.\n   */\n  getPluginVersion(): Promise<PluginVersionResult>;\n}\n"]}

package/ios/Sources/SSLPinningPlugin/SSLPinningSupport.swift

@@ -85,8 +85,9 @@ final class SSLPinningCertificateStore {
 
     private func loadCertificate(from configuredPath: String) throws -> SecCertificate {
         let fileName = URL(fileURLWithPath: configuredPath).lastPathComponent
-        guard let resourceURL = Bundle.main.resourceURL?.appendingPathComponent("public/certs/\(fileName)"),
-              let certificateData = try? Data(contentsOf: resourceURL),
+        let candidateFileNames = SSLPinningCertificateStore.candidateFileNames(for: fileName)
+
+        guard let certificateData = SSLPinningCertificateStore.loadBundledCertificateData(candidateFileNames: candidateFileNames),
               let certificate = SecCertificateCreateWithData(nil, certificateData as CFData)
         else {
             throw NSError(
@@ -98,6 +99,73 @@ final class SSLPinningCertificateStore {
 
         return certificate
     }
+
+    private static func candidateFileNames(for fileName: String) -> [String] {
+        var candidates = [fileName]
+        let url = URL(fileURLWithPath: fileName)
+        let ext = url.pathExtension.lowercased()
+        let base = url.deletingPathExtension().lastPathComponent
+
+        if ext == "cer" {
+            candidates.append("\(base).der")
+        } else if ext == "der" {
+            candidates.append("\(base).cer")
+        }
+
+        return candidates
+    }
+
+    private static func loadBundledCertificateData(candidateFileNames: [String]) -> Data? {
+        guard let resourceURL = Bundle.main.resourceURL else {
+            return nil
+        }
+
+        for fileName in candidateFileNames {
+            let candidateURL = resourceURL.appendingPathComponent("public/certs/\(fileName)")
+            guard let data = try? Data(contentsOf: candidateURL) else {
+                continue
+            }
+
+            if let decoded = decodePEMCertificateIfNeeded(data) {
+                return decoded
+            }
+
+            return data
+        }
+
+        return nil
+    }
+
+    private static func decodePEMCertificateIfNeeded(_ data: Data) -> Data? {
+        guard let text = String(data: data, encoding: .utf8),
+              text.contains("-----BEGIN CERTIFICATE-----")
+        else {
+            return nil
+        }
+
+        let beginMarker = "-----BEGIN CERTIFICATE-----"
+        let endMarker = "-----END CERTIFICATE-----"
+
+        guard let beginRange = text.range(of: beginMarker),
+              let endRange = text.range(of: endMarker, range: beginRange.upperBound..<text.endIndex)
+        else {
+            return nil
+        }
+
+        let base64Body = text[beginRange.upperBound..<endRange.lowerBound]
+            .replacingOccurrences(of: "\r", with: "")
+            .replacingOccurrences(of: "\n", with: "")
+            .replacingOccurrences(of: " ", with: "")
+            .replacingOccurrences(of: "\t", with: "")
+
+        guard let decoded = Data(base64Encoded: String(base64Body), options: [.ignoreUnknownCharacters]),
+              !decoded.isEmpty
+        else {
+            return nil
+        }
+
+        return decoded
+    }
 }
 
 enum SSLPinningTrustEvaluator {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-ssl-pinning",
-  "version": "8.1.5",
+  "version": "8.1.7",
   "description": "Capacitor SSL pinning plugin for Android and iOS that integrates with CapacitorHttp.",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",
@@ -55,8 +55,7 @@
     "capacitor:sync:before": "bun run prepare:certs",
     "capacitor:update:before": "bun run prepare:certs",
     "example:install": "cd example-app && bun install --frozen-lockfile",
-    "example:build": "bun run build && cd example-app && bun install --frozen-lockfile && bun run build",
-    "example:capgo:deploy": "bun run example:build && bun scripts/deploy-example-capgo.mjs"
+    "example:build": "bun run build && cd example-app && bun install --frozen-lockfile && bun run build"
   },
   "devDependencies": {
     "@capacitor/android": "^8.0.0",

package/scripts/prepare-certs.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { cp, mkdir, readdir, rm } from 'node:fs/promises';
+import { cp, mkdir, readdir, rm, readFile, writeFile } from 'node:fs/promises';
 import { basename, join, resolve } from 'node:path';
 
 const rootDir = process.env.CAPACITOR_ROOT_DIR;
@@ -12,6 +12,20 @@ const fail = (message) => {
   throw new Error(`[ssl-pinning] ${message}`);
 };
 
+const pemToDer = (pem) => {
+  const match = pem.match(/-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/);
+  if (!match) {
+    return null;
+  }
+
+  const base64 = match[1].replace(/[\r\n\s]/g, '');
+  if (!base64) {
+    return null;
+  }
+
+  return Buffer.from(base64, 'base64');
+};
+
 if (!rootDir || !webDir || !configJson) {
   log('Capacitor hook environment not detected, skipping certificate preparation.');
   process.exit(0);
@@ -46,6 +60,19 @@ for (const existingEntry of await readdir(targetDir, { withFileTypes: true })) {
 }
 
 for (const { source, fileName } of sourceFiles) {
-  await cp(source, join(targetDir, fileName), { force: true });
+  const targetPath = join(targetDir, fileName);
+  const buffer = await readFile(source);
+  const head = buffer.subarray(0, 2048).toString('utf8');
+  if (head.includes('-----BEGIN CERTIFICATE-----')) {
+    const der = pemToDer(buffer.toString('utf8'));
+    if (!der || der.length === 0) {
+      fail(`Failed to decode PEM certificate ${fileName}.`);
+    }
+    await writeFile(targetPath, der);
+    log(`Converted PEM ${fileName} into DER at ${targetDir}`);
+    continue;
+  }
+
+  await cp(source, targetPath, { force: true });
   log(`Copied ${fileName} into ${targetDir}`);
 }

package/scripts/deploy-example-capgo.mjs

@@ -1,117 +0,0 @@
-#!/usr/bin/env node
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const repoRoot = resolve(__dirname, '..');
-const appDir = resolve(repoRoot, 'example-app');
-const rootPackageJson = JSON.parse(readFileSync(resolve(repoRoot, 'package.json'), 'utf8'));
-const examplePackageJson = JSON.parse(readFileSync(resolve(appDir, 'package.json'), 'utf8'));
-const tsConfigPath = resolve(appDir, 'capacitor.config.ts');
-const jsonConfigPath = resolve(appDir, 'capacitor.config.json');
-const configPath = existsSync(tsConfigPath) ? tsConfigPath : existsSync(jsonConfigPath) ? jsonConfigPath : null;
-
-if (!configPath) {
-  console.error(
-    'Missing Capacitor config. Expected example-app/capacitor.config.ts or example-app/capacitor.config.json.',
-  );
-  process.exit(1);
-}
-
-const configText = readFileSync(configPath, 'utf8');
-
-function readConfigString(key, fallback) {
-  const match = configText.match(new RegExp(`['"]?${key}['"]?\\s*[:=]\\s*['"]([^'"]+)['"]`));
-  return match?.[1] ?? fallback;
-}
-
-function runCapgo(args, allowFailure = false) {
-  const token = process.env.CAPGO_TOKEN;
-  const fullArgs = ['@capgo/cli@8.5.3', ...args];
-  if (token) {
-    fullArgs.push('--apikey', token);
-  }
-  const result = spawnSync('bunx', fullArgs, {
-    cwd: appDir,
-    stdio: 'inherit',
-    env: process.env,
-  });
-  if (!allowFailure && result.status !== 0) {
-    process.exit(result.status ?? 1);
-  }
-  return result.status ?? 1;
-}
-
-const appId = process.env.CAPGO_APP_ID || readConfigString('appId');
-const appName = process.env.CAPGO_APP_NAME || readConfigString('appName', rootPackageJson.name);
-const webDir = process.env.CAPGO_WEB_DIR || readConfigString('webDir', 'dist');
-const distDir = resolve(appDir, webDir);
-const channel = process.env.CAPGO_CHANNEL || process.argv[2] || 'production';
-function usableVersion(version) {
-  return version && version !== '0.0.0' ? version : undefined;
-}
-
-const bundle =
-  process.env.CAPGO_BUNDLE || usableVersion(examplePackageJson.version) || usableVersion(rootPackageJson.version);
-const comment =
-  process.env.CAPGO_COMMENT ||
-  (process.env.GITHUB_RUN_NUMBER ? `${appName} run ${process.env.GITHUB_RUN_NUMBER}` : `${appName} ${bundle}`);
-const iconPath = process.env.CAPGO_ICON || resolve(appDir, 'assets', 'capgo-icon.png');
-
-if (!appId) {
-  console.error('Missing Capgo app id. Set CAPGO_APP_ID or example-app/capacitor.config.* appId.');
-  process.exit(1);
-}
-
-if (!existsSync(distDir)) {
-  console.error(`Missing example app bundle at ${distDir}. Run bun run example:build first.`);
-  process.exit(1);
-}
-
-if (!bundle) {
-  console.error(
-    'Missing Capgo bundle version. Set CAPGO_BUNDLE or add a version to example-app/package.json or package.json.',
-  );
-  process.exit(1);
-}
-
-const appArgs = [appId, '--name', appName];
-if (existsSync(iconPath)) {
-  appArgs.push('--icon', iconPath);
-}
-
-const setStatus = runCapgo(['app', 'set', ...appArgs], true);
-if (setStatus !== 0) {
-  runCapgo(['app', 'add', ...appArgs]);
-}
-
-console.log(`Deploying ${appId} to Capgo channel "${channel}"`);
-const channelArgs = ['channel', 'add', channel, appId];
-if (channel === 'production') {
-  channelArgs.push('--default');
-}
-runCapgo(channelArgs, true);
-
-runCapgo([
-  'bundle',
-  'upload',
-  appId,
-  '--bundle',
-  bundle,
-  '--path',
-  webDir,
-  '--channel',
-  channel,
-  '--package-json',
-  'package.json,../package.json',
-  '--node-modules',
-  'node_modules,../node_modules',
-  '--delta',
-  '--no-key',
-  '--ignore-checksum-check',
-  '--version-exists-ok',
-  '--comment',
-  comment,
-]);