@capgo/capacitor-updater 8.51.21 → 8.51.22

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -146,7 +146,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     static final int APPLICATION_EXIT_REASON_USER_REQUESTED = 10;
     static final int APPLICATION_EXIT_REASON_DEPENDENCY_DIED = 12;
 
-    private final String pluginVersion = "8.51.21";
+    private final String pluginVersion = "8.51.22";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;

package/android/src/main/java/ee/forgr/capacitor_updater/CapgoUpdater.java

@@ -285,6 +285,15 @@ public class CapgoUpdater {
         this.cachedKeyId = CryptoCipher.calcKeyId(publicKey);
     }
 
+    static boolean containsPathTraversalSegment(final String relativePath) {
+        for (final String segment : relativePath.split("/")) {
+            if ("..".equals(segment)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     static File resolvePathInsideDirectory(final File baseDirectory, final String relativePath) throws IOException {
         if (relativePath == null || relativePath.isEmpty()) {
             throw new IOException("Invalid empty path");
@@ -292,6 +301,9 @@ public class CapgoUpdater {
         if (relativePath.contains("\\") || relativePath.indexOf('\0') >= 0) {
             throw new IOException("Invalid path separator");
         }
+        if (containsPathTraversalSegment(relativePath)) {
+            throw new IOException("Path traversal segments are not allowed");
+        }
         if (new File(relativePath).isAbsolute()) {
             throw new IOException("Absolute paths are not allowed");
         }
@@ -302,7 +314,8 @@ public class CapgoUpdater {
         final String targetPath = canonicalTarget.getPath();
         final String normalizedBasePath = basePath.endsWith(File.separator) ? basePath : basePath + File.separator;
 
-        if (!targetPath.equals(basePath) && !targetPath.startsWith(normalizedBasePath)) {
+        // Require a strict child of the base. Equality would accept "." and wipe/write the root.
+        if (!targetPath.startsWith(normalizedBasePath)) {
             throw new IOException("Path escapes base directory: " + relativePath);
         }
 

package/android/src/main/java/ee/forgr/capacitor_updater/CryptoCipher.java

@@ -50,17 +50,15 @@ public class CryptoCipher {
         return decryptedBytes;
     }
 
-    public static byte[] decryptAES(byte[] cipherText, SecretKey key, byte[] iv) {
-        try {
-            IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
-            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
-            SecretKeySpec keySpec = new SecretKeySpec(key.getEncoded(), "AES");
-            cipher.init(Cipher.DECRYPT_MODE, keySpec, ivParameterSpec);
-            return cipher.doFinal(cipherText);
-        } catch (Exception e) {
-            e.printStackTrace();
+    public static byte[] decryptAES(byte[] cipherText, SecretKey key, byte[] iv) throws GeneralSecurityException {
+        if (key == null || iv == null) {
+            throw new IllegalArgumentException("AES key and IV must not be null");
         }
-        return null;
+        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
+        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+        SecretKeySpec keySpec = new SecretKeySpec(key.getEncoded(), "AES");
+        cipher.init(Cipher.DECRYPT_MODE, keySpec, ivParameterSpec);
+        return cipher.doFinal(cipherText);
     }
 
     public static SecretKey byteToSessionKey(byte[] sessionKey) {
@@ -139,11 +137,15 @@ public class CryptoCipher {
 
     public static void decryptFile(final File file, final String publicKey, final String ivSessionKey) throws IOException {
         if (publicKey.isEmpty() || ivSessionKey == null || ivSessionKey.isEmpty() || ivSessionKey.split(":").length != 2) {
-            logger.info("Encryption not set, no public key or session, ignored");
+            if (logger != null) {
+                logger.info("Encryption not set, no public key or session, ignored");
+            }
             return;
         }
         if (!publicKey.startsWith("-----BEGIN RSA PUBLIC KEY-----")) {
-            logger.error("The public key is not a valid RSA Public key");
+            if (logger != null) {
+                logger.error("The public key is not a valid RSA Public key");
+            }
             return;
         }
 
@@ -152,29 +154,50 @@ public class CryptoCipher {
             String sessionKeyB64 = ivSessionKey.split(":")[1];
             byte[] iv = Base64.decode(ivB64.getBytes(), Base64.DEFAULT);
             byte[] sessionKey = Base64.decode(sessionKeyB64.getBytes(), Base64.DEFAULT);
+            if (iv.length != 16) {
+                throw new IOException("AES file decryption failed: IV must be 16 bytes");
+            }
             PublicKey pKey = CryptoCipher.stringToPublicKey(publicKey);
             byte[] decryptedSessionKey = CryptoCipher.decryptRSA(sessionKey, pKey);
+            if (decryptedSessionKey == null || decryptedSessionKey.length != 16) {
+                throw new IOException("AES file decryption failed: decrypted session key must be 16 bytes");
+            }
 
             SecretKey sKey = CryptoCipher.byteToSessionKey(decryptedSessionKey);
             decryptAesFile(file, sKey, iv);
         } catch (GeneralSecurityException e) {
-            logger.info("decryptFile fail");
-            throw new IOException("GeneralSecurityException", e);
+            if (logger != null) {
+                logger.info("decryptFile fail");
+            }
+            throw new IOException("AES file decryption failed: " + e.getMessage(), e);
         }
     }
 
-    static void decryptAesFile(File file, SecretKey key, byte[] iv) throws IOException, GeneralSecurityException {
+    static void decryptAesFile(File file, SecretKey key, byte[] iv) throws IOException {
+        if (key == null) {
+            throw new IOException("AES file decryption failed: missing session key");
+        }
+        if (iv == null) {
+            throw new IOException("AES file decryption failed: missing IV");
+        }
+        if (iv.length != 16) {
+            throw new IOException("AES file decryption failed: IV must be 16 bytes");
+        }
+        byte[] keyBytes = key.getEncoded();
+        if (keyBytes == null || keyBytes.length != 16) {
+            throw new IOException("AES file decryption failed: session key must be 16 bytes");
+        }
         if (file.length() == 0) {
             throw new IOException("Empty encrypted data");
         }
-        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
-        cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key.getEncoded(), "AES"), new IvParameterSpec(iv));
         File parent = file.getAbsoluteFile().getParentFile();
         if (parent == null) {
             throw new IOException("Cannot create temp file for " + file.getAbsolutePath());
         }
         File tempFile = File.createTempFile("capgo-aes-", ".tmp", parent);
         try {
+            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+            cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(keyBytes, "AES"), new IvParameterSpec(iv));
             byte[] inBuf = new byte[ioBufferBytes()];
             // Reuse one output buffer. cipher.update(in) allocates a new byte[] per chunk.
             byte[] outBuf = new byte[inBuf.length + 16];
@@ -196,6 +219,8 @@ public class CryptoCipher {
             }
             replaceFile(tempFile, file);
             tempFile = null;
+        } catch (GeneralSecurityException e) {
+            throw new IOException("AES file decryption failed: " + e.getMessage(), e);
         } finally {
             if (tempFile != null && tempFile.exists()) {
                 tempFile.delete();

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -363,6 +363,38 @@ public class DownloadService extends Worker {
         return seenTargets.add(targetFile.getCanonicalPath());
     }
 
+    private static final class ManifestDownloadTask {
+
+        final String fileName;
+        final String finalFileHash;
+        final String downloadUrl;
+        final boolean isBrotli;
+        final File targetFile;
+        final File builtinFile;
+        final File cacheFile;
+        final File legacyCacheFile;
+
+        ManifestDownloadTask(
+            final String fileName,
+            final String finalFileHash,
+            final String downloadUrl,
+            final boolean isBrotli,
+            final File targetFile,
+            final File builtinFile,
+            final File cacheFile,
+            final File legacyCacheFile
+        ) {
+            this.fileName = fileName;
+            this.finalFileHash = finalFileHash;
+            this.downloadUrl = downloadUrl;
+            this.isBrotli = isBrotli;
+            this.targetFile = targetFile;
+            this.builtinFile = builtinFile;
+            this.cacheFile = cacheFile;
+            this.legacyCacheFile = legacyCacheFile;
+        }
+    }
+
     static boolean tryCopyBuiltinAsset(final AssetManager assets, final String fileName, final File dest, final String expectedHash) {
         if (assets == null || fileName == null || dest == null) {
             return false;
@@ -535,9 +567,7 @@ public class DownloadService extends Worker {
             int totalFiles = manifest.length();
             final AtomicLong completedFiles = new AtomicLong(0);
             final AtomicBoolean hasError = new AtomicBoolean(false);
-
-            ExecutorService executor = Executors.newFixedThreadPool(Math.min(MANIFEST_MAX_CONCURRENT_FILES, Math.max(1, totalFiles)));
-            List<Future<?>> futures = new ArrayList<>();
+            final List<ManifestDownloadTask> tasks = new ArrayList<>();
             final Set<String> seenTargets = new HashSet<>();
 
             for (int i = 0; i < totalFiles; i++) {
@@ -592,35 +622,56 @@ public class DownloadService extends Worker {
                 final File legacyCacheFile =
                     isBrotli && cacheFile != null ? new File(cacheFolder, finalFileHash + "_" + new File(fileName).getName()) : null;
 
-                // Ensure parent directories of the target file exist
-                if (!Objects.requireNonNull(targetFile.getParentFile()).exists() && !targetFile.getParentFile().mkdirs()) {
-                    logger.error("Failed to create parent directory for: " + targetFile.getAbsolutePath());
-                    hasError.set(true);
-                    continue;
+                tasks.add(
+                    new ManifestDownloadTask(
+                        fileName,
+                        finalFileHash,
+                        downloadUrl,
+                        isBrotli,
+                        targetFile,
+                        builtinFile,
+                        cacheFile,
+                        legacyCacheFile
+                    )
+                );
+            }
+
+            if (hasError.get()) {
+                throw new IOException("Manifest contains invalid or duplicate file paths");
+            }
+
+            for (final ManifestDownloadTask task : tasks) {
+                if (!Objects.requireNonNull(task.targetFile.getParentFile()).exists() && !task.targetFile.getParentFile().mkdirs()) {
+                    logger.error("Failed to create parent directory for: " + task.targetFile.getAbsolutePath());
+                    throw new IOException("Failed to create parent directory for: " + task.targetFile.getAbsolutePath());
                 }
+            }
+
+            ExecutorService executor = Executors.newFixedThreadPool(Math.min(MANIFEST_MAX_CONCURRENT_FILES, Math.max(1, totalFiles)));
+            List<Future<?>> futures = new ArrayList<>();
 
-                final boolean finalIsBrotli = isBrotli;
+            for (final ManifestDownloadTask task : tasks) {
                 Future<?> future = executor.submit(() -> {
                     try {
-                        if (tryCopyBuiltinAsset(assets, fileName, targetFile, finalFileHash)) {
-                            logger.debug("using builtin asset " + fileName);
-                        } else if (tryCopyBuiltinFile(builtinFile, targetFile, finalFileHash)) {
-                            logger.debug("using builtin file " + fileName);
+                        if (tryCopyBuiltinAsset(assets, task.fileName, task.targetFile, task.finalFileHash)) {
+                            logger.debug("using builtin asset " + task.fileName);
+                        } else if (tryCopyBuiltinFile(task.builtinFile, task.targetFile, task.finalFileHash)) {
+                            logger.debug("using builtin file " + task.fileName);
                         } else if (
-                            tryCopyFromCache(cacheFile, targetFile, finalFileHash) ||
-                            (legacyCacheFile != null && tryCopyFromCache(legacyCacheFile, targetFile, finalFileHash))
+                            tryCopyFromCache(task.cacheFile, task.targetFile, task.finalFileHash) ||
+                            (task.legacyCacheFile != null && tryCopyFromCache(task.legacyCacheFile, task.targetFile, task.finalFileHash))
                         ) {
-                            logger.debug("already cached " + fileName);
+                            logger.debug("already cached " + task.fileName);
                         } else {
                             downloadAndVerify(
-                                downloadUrl,
-                                targetFile,
-                                cacheFile,
-                                finalFileHash,
+                                task.downloadUrl,
+                                task.targetFile,
+                                task.cacheFile,
+                                task.finalFileHash,
                                 sessionKey,
                                 publicKey,
-                                finalIsBrotli,
-                                fileName
+                                task.isBrotli,
+                                task.fileName
                             );
                         }
 
@@ -628,8 +679,8 @@ public class DownloadService extends Worker {
                         int percent = calcTotalPercent(completed, totalFiles);
                         setProgress(percent);
                     } catch (Exception e) {
-                        logger.error("Error processing file: " + fileName + " " + e.getMessage());
-                        sendStatsAsync("download_manifest_file_fail", version + ":" + fileName);
+                        logger.error("Error processing file: " + task.fileName + " " + e.getMessage());
+                        sendStatsAsync("download_manifest_file_fail", version + ":" + task.fileName);
                         hasError.set(true);
                     }
                 });

package/ios/Sources/CapacitorUpdaterPlugin/CapacitorUpdaterPlugin.swift

@@ -96,7 +96,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     deinit {
         implementation.shutdown()
     }
-    private let pluginVersion: String = "8.51.21"
+    private let pluginVersion: String = "8.51.22"
     private let launchStartedAtMs = Int64(Date().timeIntervalSince1970 * 1000)
     static let updateUrlDefault = "https://plugin.capgo.app/updates"
     static let statsUrlDefault = "https://plugin.capgo.app/stats"
@@ -3496,13 +3496,10 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     }
 
     private func performHideSplashscreen() {
-        self.cancelSplashscreenTimeout()
         self.removeSplashscreenLoader()
         self.splashscreenInvocationToken += 1
-        self.invokeSplashscreenMethod(
-            methodName: "hide",
-            callbackId: "autoHideSplashscreen",
-            options: self.splashscreenOptions(methodName: "hide"),
+        self.invokeSplashscreenAction(
+            .hide,
             retriesRemaining: self.splashscreenMaxRetries,
             requestToken: self.splashscreenInvocationToken
         )
@@ -3522,10 +3519,8 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         self.cancelSplashscreenTimeout()
         self.autoSplashscreenTimedOut = false
         self.splashscreenInvocationToken += 1
-        self.invokeSplashscreenMethod(
-            methodName: "show",
-            callbackId: "autoShowSplashscreen",
-            options: self.splashscreenOptions(methodName: "show"),
+        self.invokeSplashscreenAction(
+            .show,
             retriesRemaining: self.splashscreenMaxRetries,
             requestToken: self.splashscreenInvocationToken
         )
@@ -3535,7 +3530,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     }
 
     private func splashscreenOptions(methodName: String) -> [String: Any] {
-        methodName == "show" ? ["autoHide": false] : [:]
+        methodName == "show" ? ["autoHide": false, "fadeInDuration": 0] : [:]
     }
 
     private func splashscreenCompletedMessage(methodName: String) -> String {
@@ -3554,20 +3549,59 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         self.splashscreenInvocationToken += 1
     }
 
-    private func makeSplashscreenCall(callbackId: String, options: [String: Any], methodName: String) -> CAPPluginCall {
-        CAPPluginCall(callbackId: callbackId, methodName: methodName, options: options, success: { [weak self] (_, _) in
-            guard let self = self else { return }
-            self.logger.info(self.splashscreenCompletedMessage(methodName: methodName))
-        }, error: { [weak self] (_) in
-            guard let self = self else { return }
-            self.logger.error("Failed to auto-\(methodName) splashscreen")
-        })
+    private enum SplashscreenAction {
+        case show
+        case hide
+
+        var methodName: String {
+            switch self {
+            case .show:
+                return "show"
+            case .hide:
+                return "hide"
+            }
+        }
+
+        var unavailableMessageVerb: String {
+            switch self {
+            case .show:
+                return "showing"
+            case .hide:
+                return "hiding"
+            }
+        }
+    }
+
+    private func splashscreenOptionsJSON(methodName: String) -> String {
+        let options = self.splashscreenOptions(methodName: methodName)
+        guard !options.isEmpty,
+              let data = try? JSONSerialization.data(withJSONObject: options),
+              let json = String(data: data, encoding: .utf8) else {
+            return "{}"
+        }
+        return json
+    }
+
+    private func splashscreenPluginExposesMethod(_ methodName: String, on plugin: CAPPlugin) -> Bool {
+        guard let bridgedPlugin = plugin as? CAPBridgedPlugin else {
+            return false
+        }
+        return bridgedPlugin.pluginMethods.contains { $0.name == methodName }
+    }
+
+    private func splashscreenBridgeScript(for action: SplashscreenAction) -> String {
+        let optionsJSON = self.splashscreenOptionsJSON(methodName: action.methodName)
+        return """
+        var cap = window.Capacitor;
+        if (!cap || typeof cap.nativePromise !== 'function') {
+          throw new Error('Capacitor bridge not ready');
+        }
+        return await cap.nativePromise('\(self.splashscreenPluginName)', '\(action.methodName)', \(optionsJSON));
+        """
     }
 
-    private func invokeSplashscreenMethod(
-        methodName: String,
-        callbackId: String,
-        options: [String: Any],
+    private func invokeSplashscreenAction(
+        _ action: SplashscreenAction,
         retriesRemaining: Int,
         requestToken: Int
     ) {
@@ -3576,22 +3610,18 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         }
 
         guard let bridge = self.bridge else {
-            self.retrySplashscreenMethod(
-                methodName: methodName,
-                callbackId: callbackId,
-                options: options,
+            self.retrySplashscreenAction(
+                action,
                 retriesRemaining: retriesRemaining,
                 requestToken: requestToken,
-                message: "Bridge not available for \(methodName == "show" ? "showing" : "hiding") splashscreen with autoSplashscreen"
+                message: "Bridge not available for \(action.unavailableMessageVerb) splashscreen with autoSplashscreen"
             )
             return
         }
 
         guard let splashScreenPlugin = bridge.plugin(withName: self.splashscreenPluginName) else {
-            self.retrySplashscreenMethod(
-                methodName: methodName,
-                callbackId: callbackId,
-                options: options,
+            self.retrySplashscreenAction(
+                action,
                 retriesRemaining: retriesRemaining,
                 requestToken: requestToken,
                 message: "autoSplashscreen: SplashScreen plugin not found. Install @capacitor/splash-screen plugin."
@@ -3599,37 +3629,86 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
             return
         }
 
-        let selector = NSSelectorFromString("\(methodName):")
-        guard splashScreenPlugin.responds(to: selector) else {
-            self.retrySplashscreenMethod(
-                methodName: methodName,
-                callbackId: callbackId,
-                options: options,
+        guard self.splashscreenPluginExposesMethod(action.methodName, on: splashScreenPlugin) else {
+            self.retrySplashscreenAction(
+                action,
+                retriesRemaining: retriesRemaining,
+                requestToken: requestToken,
+                message: "autoSplashscreen: SplashScreen plugin does not expose \(action.methodName)(). Make sure @capacitor/splash-screen plugin is properly installed."
+            )
+            return
+        }
+
+        guard let webView = bridge.webView else {
+            self.retrySplashscreenAction(
+                action,
                 retriesRemaining: retriesRemaining,
                 requestToken: requestToken,
-                message: "autoSplashscreen: SplashScreen plugin does not respond to \(methodName): method. Make sure @capacitor/splash-screen plugin is properly installed."
+                message: "WebView not available for \(action.unavailableMessageVerb) splashscreen with autoSplashscreen"
             )
             return
         }
 
-        let call = self.makeSplashscreenCall(callbackId: callbackId, options: options, methodName: methodName)
-        _ = splashScreenPlugin.perform(selector, with: call)
-        self.logger.info("Called SplashScreen \(methodName) method")
+        let script = self.splashscreenBridgeScript(for: action)
+        let runInvocation = { [weak self] in
+            guard let self = self, requestToken == self.splashscreenInvocationToken else {
+                return
+            }
+            webView.callAsyncJavaScript(
+                script,
+                arguments: [:],
+                in: nil,
+                in: .page
+            ) { [weak self] (result: Result<Any, Error>) in
+                guard let self = self, requestToken == self.splashscreenInvocationToken else {
+                    return
+                }
+                if case .failure(let error) = result {
+                    self.retrySplashscreenAction(
+                        action,
+                        retriesRemaining: retriesRemaining,
+                        requestToken: requestToken,
+                        message: "Failed to invoke SplashScreen \(action.methodName) via Capacitor bridge: \(error.localizedDescription)"
+                    )
+                    return
+                }
+                if action == .hide {
+                    self.cancelSplashscreenTimeout()
+                }
+                self.logger.info("Called SplashScreen \(action.methodName) method")
+                self.logger.info(self.splashscreenCompletedMessage(methodName: action.methodName))
+            }
+        }
+
+        if Thread.isMainThread {
+            runInvocation()
+        } else {
+            DispatchQueue.main.async(execute: runInvocation)
+        }
     }
 
-    private func retrySplashscreenMethod(
-        methodName: String,
-        callbackId: String,
-        options: [String: Any],
+    private func retrySplashscreenAction(
+        _ action: SplashscreenAction,
         retriesRemaining: Int,
         requestToken: Int,
         message: String
     ) {
         guard retriesRemaining > 0 else {
-            if methodName == "show" {
+            if action == .show {
                 self.logger.warn(message)
-            } else {
-                self.logger.error(message)
+                return
+            }
+
+            self.logger.error("\(message). Scheduling another hide retry.")
+            DispatchQueue.main.asyncAfter(deadline: .now() + .milliseconds(self.splashscreenRetryDelayMilliseconds)) { [weak self] in
+                guard let self = self, requestToken == self.splashscreenInvocationToken else {
+                    return
+                }
+                self.invokeSplashscreenAction(
+                    action,
+                    retriesRemaining: self.splashscreenMaxRetries,
+                    requestToken: requestToken
+                )
             }
             return
         }
@@ -3639,10 +3718,8 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
             guard let self = self, requestToken == self.splashscreenInvocationToken else {
                 return
             }
-            self.invokeSplashscreenMethod(
-                methodName: methodName,
-                callbackId: callbackId,
-                options: options,
+            self.invokeSplashscreenAction(
+                action,
                 retriesRemaining: retriesRemaining - 1,
                 requestToken: requestToken
             )

package/ios/Sources/CapacitorUpdaterPlugin/CapgoUpdater.swift

@@ -134,6 +134,10 @@ import UIKit
         case pathTraversal
     }
 
+    static func containsPathTraversalSegment(_ relativePath: String) -> Bool {
+        return relativePath.split(separator: "/").contains(where: { $0 == ".." })
+    }
+
     static func resolvePathInsideDirectory(baseDirectory: URL, relativePath: String) throws -> URL {
         if relativePath.isEmpty {
             throw SecurePathError.emptyPath
@@ -141,6 +145,9 @@ import UIKit
         if relativePath.contains("\\") || relativePath.contains("\0") {
             throw SecurePathError.windowsPath
         }
+        if containsPathTraversalSegment(relativePath) {
+            throw SecurePathError.pathTraversal
+        }
         if (relativePath as NSString).isAbsolutePath {
             throw SecurePathError.absolutePath
         }
@@ -151,7 +158,8 @@ import UIKit
         let canonicalTarget = canonicalBase.appendingPathComponent(relativePath).standardizedFileURL
         let canonicalTargetPath = canonicalTarget.path
 
-        if canonicalTargetPath != canonicalBasePath && !canonicalTargetPath.hasPrefix(normalizedBasePath) {
+        // Require a strict child of the base. Equality would accept "." and wipe/write the root.
+        if !canonicalTargetPath.hasPrefix(normalizedBasePath) {
             throw SecurePathError.pathTraversal
         }
 
@@ -164,6 +172,22 @@ import UIKit
         return try resolvePathInsideDirectory(baseDirectory: baseDirectory, relativePath: targetFileName)
     }
 
+    static func rememberManifestTarget(_ seenTargets: inout Set<String>, targetFile: URL) -> Bool {
+        return seenTargets.insert(targetFile.standardizedFileURL.path).inserted
+    }
+
+    private struct ManifestDownloadTask {
+        let fileName: String
+        let downloadUrl: String
+        let finalFileHash: String
+        let isBrotli: Bool
+        let destFileName: String
+        let destFilePath: URL
+        let builtinFilePath: URL
+        let cacheFilePath: URL?
+        let legacyCacheFilePath: URL?
+    }
+
     private func isTimedOutError(_ error: Error?) -> Bool {
         guard let nsError = error as NSError? else {
             return false
@@ -1416,8 +1440,8 @@ import UIKit
         var downloadError: Error?
         let errorLock = NSLock()
 
-        // Create operations for each file
-        var operations: [Operation] = []
+        var tasks: [ManifestDownloadTask] = []
+        var seenTargets = Set<String>()
 
         for entry in manifest {
             guard let fileName = entry.file_name,
@@ -1489,6 +1513,24 @@ import UIKit
             do {
                 destFilePath = try Self.resolveManifestTargetPath(baseDirectory: destFolder, fileName: fileName)
                 builtinFilePath = try Self.resolveManifestTargetPath(baseDirectory: builtinFolder, fileName: fileName)
+                if !Self.rememberManifestTarget(&seenTargets, targetFile: destFilePath) {
+                    logger.error("Duplicate manifest target path: \(fileName)")
+                    self.sendStats(action: "manifest_path_fail", versionName: "\(version):\(fileName)")
+                    let error = NSError(
+                        domain: "ManifestEntryError",
+                        code: 3,
+                        userInfo: [
+                            NSLocalizedDescriptionKey: "Duplicate manifest target path for \(fileName)"
+                        ]
+                    )
+                    errorLock.lock()
+                    if downloadError == nil {
+                        downloadError = error
+                    }
+                    errorLock.unlock()
+                    hasError.value = true
+                    continue
+                }
             } catch {
                 logger.error("Invalid manifest file path: \(fileName)")
                 self.sendStats(action: "manifest_path_fail", versionName: "\(version):\(fileName)")
@@ -1501,8 +1543,40 @@ import UIKit
                 continue
             }
 
-            // Create parent directories synchronously (before operations start)
-            try? FileManager.default.createDirectory(at: destFilePath.deletingLastPathComponent(), withIntermediateDirectories: true, attributes: nil)
+            tasks.append(
+                ManifestDownloadTask(
+                    fileName: fileName,
+                    downloadUrl: downloadUrl,
+                    finalFileHash: finalFileHash,
+                    isBrotli: isBrotli,
+                    destFileName: destFileName,
+                    destFilePath: destFilePath,
+                    builtinFilePath: builtinFilePath,
+                    cacheFilePath: cacheFilePath,
+                    legacyCacheFilePath: legacyCacheFilePath
+                )
+            )
+        }
+
+        if hasError.value {
+            let resolvedError = downloadError ?? NSError(
+                domain: "ManifestDownloadError",
+                code: 1,
+                userInfo: [NSLocalizedDescriptionKey: "Manifest download failed due to invalid or missing entries"]
+            )
+            let errorBundle = bundleInfo.setStatus(status: BundleStatus.ERROR.storedValue)
+            self.saveBundleInfo(id: id, bundle: errorBundle)
+            throw resolvedError
+        }
+
+        var operations: [Operation] = []
+
+        for task in tasks {
+            try FileManager.default.createDirectory(
+                at: task.destFilePath.deletingLastPathComponent(),
+                withIntermediateDirectories: true,
+                attributes: nil
+            )
 
             let operation = BlockOperation { [weak self] in
                 guard let self = self else { return }
@@ -1510,26 +1584,29 @@ import UIKit
 
                 do {
                     // Try builtin first
-                    if FileManager.default.fileExists(atPath: builtinFilePath.path) && self.verifyChecksum(file: builtinFilePath, expectedHash: finalFileHash) {
-                        try self.copyItemReplacing(from: builtinFilePath, to: destFilePath)
-                        self.logger.info("downloadManifest \(fileName) using builtin file \(id)")
+                    if FileManager.default.fileExists(atPath: task.builtinFilePath.path) &&
+                        self.verifyChecksum(file: task.builtinFilePath, expectedHash: task.finalFileHash) {
+                        try self.copyItemReplacing(from: task.builtinFilePath, to: task.destFilePath)
+                        self.logger.info("downloadManifest \(task.fileName) using builtin file \(id)")
                     }
                     // Try cache
                     else if
-                        (cacheFilePath != nil && self.tryCopyFromCache(from: cacheFilePath!, to: destFilePath, expectedHash: finalFileHash)) ||
-                            (legacyCacheFilePath != nil && self.tryCopyFromCache(from: legacyCacheFilePath!, to: destFilePath, expectedHash: finalFileHash)) {
-                        self.logger.info("downloadManifest \(fileName) copy from cache \(id)")
+                        (task.cacheFilePath != nil &&
+                            self.tryCopyFromCache(from: task.cacheFilePath!, to: task.destFilePath, expectedHash: task.finalFileHash)) ||
+                            (task.legacyCacheFilePath != nil &&
+                                self.tryCopyFromCache(from: task.legacyCacheFilePath!, to: task.destFilePath, expectedHash: task.finalFileHash)) {
+                        self.logger.info("downloadManifest \(task.fileName) copy from cache \(id)")
                     }
                     // Download
                     else {
                         try self.downloadManifestFile(
-                            downloadUrl: downloadUrl,
-                            destFilePath: destFilePath,
-                            cacheFilePath: cacheFilePath,
-                            fileHash: finalFileHash,
-                            fileName: fileName,
-                            destFileName: destFileName,
-                            isBrotli: isBrotli,
+                            downloadUrl: task.downloadUrl,
+                            destFilePath: task.destFilePath,
+                            cacheFilePath: task.cacheFilePath,
+                            fileHash: task.finalFileHash,
+                            fileName: task.fileName,
+                            destFileName: task.destFileName,
+                            isBrotli: task.isBrotli,
                             sessionKey: sessionKey,
                             version: version,
                             bundleId: id
@@ -1547,8 +1624,8 @@ import UIKit
                     }
                     errorLock.unlock()
                     hasError.value = true
-                    self.logger.error("Manifest file download failed: \(fileName)")
-                    self.logger.debug("Bundle: \(id), File: \(fileName), Error: \(error.localizedDescription)")
+                    self.logger.error("Manifest file download failed: \(task.fileName)")
+                    self.logger.debug("Bundle: \(id), File: \(task.fileName), Error: \(error.localizedDescription)")
                 }
             }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-updater",
-  "version": "8.51.21",
+  "version": "8.51.22",
   "license": "MPL-2.0",
   "description": "Live update for capacitor apps",
   "main": "dist/plugin.cjs.js",