@capgo/capacitor-updater 8.51.21 → 8.51.23

package/README.md

@@ -46,7 +46,7 @@ Perfect for fixing bugs immediately, A/B testing features, and maintaining contr
 - 🔄 Auto Update: Automatically download and set the latest bundle for the app.
 - 🛟 Rollback: Reset the app to last working bundle if an incompatible bundle has been set.
 - 🔁 **Delta Updates**: Make instant updates by only downloading changed files.
-- 🔒 **Security**: Encrypt and sign each updates with best in class security standards.
+- 🔒 Security: checksum on every update; encryption optional for high-security apps.
 - ⚔️ **Battle-Tested**: Used in more than 3000 projects.
 - 📊 View your deployment statistics
 - 🔋 Supports Android and iOS

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -146,7 +146,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     static final int APPLICATION_EXIT_REASON_USER_REQUESTED = 10;
     static final int APPLICATION_EXIT_REASON_DEPENDENCY_DIED = 12;
 
-    private final String pluginVersion = "8.51.21";
+    private final String pluginVersion = "8.51.23";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;
@@ -2842,6 +2842,16 @@ public class CapacitorUpdaterPlugin extends Plugin {
         final String checksum,
         final JSONArray manifest
     ) throws IOException {
+        if (!this.implementation.publicKey.isEmpty() && !CryptoCipher.isValidSessionKey(sessionKey)) {
+            logger.error("Public key present but no valid session key provided");
+            this.implementation.sendStats("session_key_required");
+            throw new IOException("Session key required when public key is present");
+        }
+        if (manifest == null && (checksum == null || checksum.isEmpty())) {
+            logger.error("No checksum provided");
+            this.implementation.sendStats("checksum_required");
+            throw new IOException("Checksum required");
+        }
         // Manual/preview downloads must wait too — launch orphan sweep can delete their temps.
         waitForCleanupIfNeeded();
         if (manifest != null) {
@@ -4936,7 +4946,13 @@ public class CapacitorUpdaterPlugin extends Plugin {
                                     );
                                     return;
                                 }
-                                if (latest.isDownloaded() && BundleStatus.DOWNLOADING != latest.getStatus()) {
+                                final String latestSessionKey = jsRes.has("sessionKey") ? jsRes.getString("sessionKey") : "";
+                                if (
+                                    latest.isDownloaded() &&
+                                    BundleStatus.DOWNLOADING != latest.getStatus() &&
+                                    (CapacitorUpdaterPlugin.this.implementation.publicKey.isEmpty() ||
+                                        CryptoCipher.isValidSessionKey(latestSessionKey))
+                                ) {
                                     logger.info("Latest bundle already exists and download is NOT required. " + messageUpdate);
                                     final boolean directUpdateAllowedNow = CapacitorUpdaterPlugin.this.isDirectUpdateCurrentlyAllowed(
                                         plannedDirectUpdate

package/android/src/main/java/ee/forgr/capacitor_updater/CapgoUpdater.java

@@ -285,6 +285,31 @@ public class CapgoUpdater {
         this.cachedKeyId = CryptoCipher.calcKeyId(publicKey);
     }
 
+    private void requireSessionKeyForEncryptedUpdate(final String sessionKey) throws IOException {
+        if (!this.publicKey.isEmpty() && !CryptoCipher.isValidSessionKey(sessionKey)) {
+            logger.error("Public key present but no valid session key provided");
+            this.sendStats("session_key_required");
+            throw new IOException("Session key required when public key is present");
+        }
+    }
+
+    private void requireBundleChecksum(final String checksum) throws IOException {
+        if (checksum == null || checksum.isEmpty()) {
+            logger.error("No checksum provided");
+            this.sendStats("checksum_required");
+            throw new IOException("Checksum required");
+        }
+    }
+
+    static boolean containsPathTraversalSegment(final String relativePath) {
+        for (final String segment : relativePath.split("/")) {
+            if ("..".equals(segment)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     static File resolvePathInsideDirectory(final File baseDirectory, final String relativePath) throws IOException {
         if (relativePath == null || relativePath.isEmpty()) {
             throw new IOException("Invalid empty path");
@@ -292,6 +317,9 @@ public class CapgoUpdater {
         if (relativePath.contains("\\") || relativePath.indexOf('\0') >= 0) {
             throw new IOException("Invalid path separator");
         }
+        if (containsPathTraversalSegment(relativePath)) {
+            throw new IOException("Path traversal segments are not allowed");
+        }
         if (new File(relativePath).isAbsolute()) {
             throw new IOException("Absolute paths are not allowed");
         }
@@ -302,13 +330,18 @@ public class CapgoUpdater {
         final String targetPath = canonicalTarget.getPath();
         final String normalizedBasePath = basePath.endsWith(File.separator) ? basePath : basePath + File.separator;
 
-        if (!targetPath.equals(basePath) && !targetPath.startsWith(normalizedBasePath)) {
+        // Require a strict child of the base. Equality would accept "." and wipe/write the root.
+        if (!targetPath.startsWith(normalizedBasePath)) {
             throw new IOException("Path escapes base directory: " + relativePath);
         }
 
         return canonicalTarget;
     }
 
+    static File resolveBundleDirectory(final File documentsDir, final String bundleId) throws IOException {
+        return resolvePathInsideDirectory(new File(documentsDir, bundleDirectory), bundleId);
+    }
+
     public String getKeyId() {
         return this.cachedKeyId;
     }
@@ -376,11 +409,11 @@ public class CapgoUpdater {
         }
     }
 
-    private void flattenAssets(final File sourceFile, final String dest) throws IOException {
+    private void flattenAssets(final File sourceFile, final File destinationFile) throws IOException {
         if (!sourceFile.exists()) {
             throw new FileNotFoundException("Source file not found: " + sourceFile.getPath());
         }
-        final File destinationFile = new File(this.documentsDir, dest);
+        assertPathInsideBundleRoot(destinationFile);
         Objects.requireNonNull(destinationFile.getParentFile()).mkdirs();
         final String[] entries = sourceFile.list(this.filter);
         if (entries == null || entries.length == 0) {
@@ -409,7 +442,13 @@ public class CapgoUpdater {
             return;
         }
 
-        final File bundleDir = this.getBundleDirectory(id);
+        final File bundleDir;
+        try {
+            bundleDir = this.getBundleDirectory(id);
+        } catch (IOException e) {
+            logger.debug("Skip delta cache population: invalid bundle id");
+            return;
+        }
         if (!bundleDir.exists()) {
             logger.debug("Skip delta cache population: bundle dir missing");
             return;
@@ -497,7 +536,10 @@ public class CapgoUpdater {
         if (fileHash.isEmpty()) {
             return "";
         }
-        if (this.publicKey != null && !this.publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+        if (this.publicKey != null && !this.publicKey.isEmpty()) {
+            if (!CryptoCipher.isValidSessionKey(sessionKey)) {
+                return "";
+            }
             try {
                 fileHash = CryptoCipher.decryptChecksum(fileHash, this.publicKey);
             } catch (Exception e) {
@@ -833,31 +875,24 @@ public class CapgoUpdater {
         String checksum = "";
 
         try {
+            this.requireSessionKeyForEncryptedUpdate(sessionKey);
             this.notifyDownload(id, 71);
             downloaded = new File(this.documentsDir, dest);
 
             if (!isManifest) {
-                String checksumDecrypted = Objects.requireNonNullElse(checksumRes, "");
+                String expectedChecksum = Objects.requireNonNullElse(checksumRes, "");
+                this.requireBundleChecksum(expectedChecksum);
 
-                // If public key is present but no checksum provided, refuse installation
-                if (!this.publicKey.isEmpty() && checksumDecrypted.isEmpty()) {
-                    logger.error("Public key present but no checksum provided");
-                    this.sendStats("checksum_required");
-                    throw new IOException("Checksum required when public key is present: " + id);
-                }
-
-                if (!sessionKey.isEmpty()) {
+                if (CryptoCipher.isValidSessionKey(sessionKey)) {
                     CryptoCipher.decryptFile(downloaded, publicKey, sessionKey);
-                    checksumDecrypted = CryptoCipher.decryptChecksum(checksumRes, publicKey);
-                    checksum = CryptoCipher.calcChecksum(downloaded);
-                } else {
-                    checksum = CryptoCipher.calcChecksum(downloaded);
+                    expectedChecksum = CryptoCipher.decryptChecksum(checksumRes, publicKey);
                 }
+                checksum = CryptoCipher.calcChecksum(downloaded);
                 CryptoCipher.logChecksumInfo("Calculated checksum", checksum);
-                CryptoCipher.logChecksumInfo("Expected checksum", checksumDecrypted);
-                if ((!checksumDecrypted.isEmpty() || !this.publicKey.isEmpty()) && !checksumDecrypted.equals(checksum)) {
+                CryptoCipher.logChecksumInfo("Expected checksum", expectedChecksum);
+                if (!expectedChecksum.equals(checksum)) {
                     logger.error("Checksum mismatch");
-                    logger.debug("Expected: " + checksumDecrypted + ", Got: " + checksum);
+                    logger.debug("Expected: " + expectedChecksum + ", Got: " + checksum);
                     this.sendStats("checksum_fail");
                     throw new IOException("Checksum failed: " + id);
                 }
@@ -885,13 +920,11 @@ public class CapgoUpdater {
             if (!isManifest) {
                 extractedDir = this.unzip(id, downloaded, TEMP_UNZIP_PREFIX + this.randomString());
                 this.notifyDownload(id, 91);
-                final String idName = bundleDirectory + "/" + id;
-                this.flattenAssets(extractedDir, idName);
+                this.flattenAssets(extractedDir, this.getBundleDirectory(id));
                 this.cacheBundleFilesAsync(id);
             } else {
                 this.notifyDownload(id, 91);
-                final String idName = bundleDirectory + "/" + id;
-                this.flattenAssets(downloaded, idName);
+                this.flattenAssets(downloaded, this.getBundleDirectory(id));
                 downloaded.delete();
             }
             // Remove old bundle info and set new one
@@ -1110,18 +1143,44 @@ public class CapgoUpdater {
         }
     }
 
+    private void assertPathInsideDocumentsDir(final File target) throws IOException {
+        if (this.documentsDir == null) {
+            throw new IOException("Documents directory unavailable");
+        }
+        final File canonicalBase = this.documentsDir.getCanonicalFile();
+        final File canonicalTarget = target.getCanonicalFile();
+        final String basePath = canonicalBase.getPath();
+        final String normalizedBasePath = basePath.endsWith(File.separator) ? basePath : basePath + File.separator;
+        final String targetPath = canonicalTarget.getPath();
+        if (!targetPath.equals(basePath) && !targetPath.startsWith(normalizedBasePath)) {
+            throw new IOException("Path escapes updater storage: " + target.getPath());
+        }
+    }
+
+    private void assertPathInsideBundleRoot(final File target) throws IOException {
+        final File bundleRoot = new File(this.documentsDir, bundleDirectory).getCanonicalFile();
+        final File canonicalTarget = target.getCanonicalFile();
+        final String basePath = bundleRoot.getPath();
+        final String normalizedBasePath = basePath.endsWith(File.separator) ? basePath : basePath + File.separator;
+        final String targetPath = canonicalTarget.getPath();
+        if (!targetPath.equals(basePath) && !targetPath.startsWith(normalizedBasePath)) {
+            throw new IOException("Path escapes bundle storage: " + target.getPath());
+        }
+    }
+
     private void safeDelete(final File target) {
         if (target == null || !target.exists()) {
             return;
         }
         try {
+            this.assertPathInsideDocumentsDir(target);
             if (target.isDirectory()) {
                 this.deleteDirectory(target);
             } else if (!target.delete()) {
                 logger.warn("Failed to delete file: " + target.getAbsolutePath());
             }
         } catch (IOException cleanupError) {
-            logger.warn("Cleanup failed for " + target.getAbsolutePath() + ": " + cleanupError.getMessage());
+            logger.warn("Refusing unsafe delete for " + target.getAbsolutePath() + ": " + cleanupError.getMessage());
         }
     }
 
@@ -1395,6 +1454,15 @@ public class CapgoUpdater {
         final JSONArray manifest,
         final boolean setNext
     ) {
+        try {
+            this.requireSessionKeyForEncryptedUpdate(sessionKey);
+            if (manifest == null) {
+                this.requireBundleChecksum(checksum);
+            }
+        } catch (final IOException e) {
+            logger.error("Download blocked: " + e.getMessage());
+            return;
+        }
         if (!this.runDownloadGateQuiet()) {
             return;
         }
@@ -1425,6 +1493,8 @@ public class CapgoUpdater {
     }
 
     public BundleInfo download(final String url, final String version, final String sessionKey, final String checksum) throws IOException {
+        this.requireSessionKeyForEncryptedUpdate(sessionKey);
+        this.requireBundleChecksum(checksum);
         this.runDownloadGate();
         // Check for existing bundle with same version and clean up if in error state
         BundleInfo existingBundle = this.getBundleInfoByName(version);
@@ -1476,6 +1546,7 @@ public class CapgoUpdater {
         final String checksum,
         final JSONArray manifest
     ) throws IOException {
+        this.requireSessionKeyForEncryptedUpdate(sessionKey);
         this.runDownloadGate();
         if (manifest == null) {
             return download(url, version, sessionKey, checksum);
@@ -1557,6 +1628,14 @@ public class CapgoUpdater {
 
     public Boolean delete(final String id, final Boolean removeInfo, final boolean cancelActiveDownload) throws IOException {
         synchronized (this.deleteLock) {
+            final File bundle;
+            try {
+                bundle = this.getBundleDirectory(id);
+            } catch (IOException e) {
+                logger.error("Cannot delete bundle with invalid id");
+                logger.debug("Bundle ID: " + id + ", Error: " + e.getMessage());
+                return false;
+            }
             final BundleInfo deleted = this.getBundleInfo(id);
             if (deleted.isBuiltin() || this.getCurrentBundleId().equals(id)) {
                 logger.error("Cannot delete current or builtin bundle");
@@ -1582,7 +1661,6 @@ public class CapgoUpdater {
                 return false;
             }
 
-            final File bundle = this.getBundleDirectory(id);
             final boolean hadRegistry = this.hasStoredBundleInfo(id);
             final boolean hadFolder = bundle.exists();
             if (!hadRegistry && !hadFolder) {
@@ -1730,12 +1808,17 @@ public class CapgoUpdater {
         this.editor.commit();
     }
 
-    private File getBundleDirectory(final String id) {
-        return new File(this.documentsDir, bundleDirectory + "/" + id);
+    private File getBundleDirectory(final String id) throws IOException {
+        return resolveBundleDirectory(this.documentsDir, id);
     }
 
     private boolean bundleExists(final String id) {
-        final File bundle = this.getBundleDirectory(id);
+        final File bundle;
+        try {
+            bundle = this.getBundleDirectory(id);
+        } catch (IOException e) {
+            return false;
+        }
         final BundleInfo bundleInfo = this.getBundleInfo(id);
         return (
             bundle.isDirectory() &&
@@ -1812,7 +1895,16 @@ public class CapgoUpdater {
             this.reset();
             return true;
         }
-        final File bundle = this.getBundleDirectory(id);
+        final File bundle;
+        try {
+            bundle = this.getBundleDirectory(id);
+        } catch (IOException e) {
+            logger.error("Invalid bundle id");
+            logger.debug("Bundle ID: " + id + ", Error: " + e.getMessage());
+            this.setBundleStatus(id, BundleStatus.ERROR);
+            this.sendStats("set_fail", newBundle.getVersionName());
+            return false;
+        }
         logger.info("Setting next active bundle: " + id);
         if (this.bundleExists(id)) {
             var currentBundleName = this.getCurrentBundle().getVersionName();
@@ -1830,8 +1922,12 @@ public class CapgoUpdater {
         if (bundle == null || bundle.isBuiltin() || !this.bundleExists(bundle.getId())) {
             return false;
         }
-        this.setCurrentBundle(this.getBundleDirectory(bundle.getId()));
-        return true;
+        try {
+            this.setCurrentBundle(this.getBundleDirectory(bundle.getId()));
+            return true;
+        } catch (IOException e) {
+            return false;
+        }
     }
 
     boolean stagePreviewFallbackReload(final BundleInfo bundle) {
@@ -1845,8 +1941,12 @@ public class CapgoUpdater {
         if (!this.bundleExists(bundle.getId())) {
             return false;
         }
-        this.setCurrentBundle(this.getBundleDirectory(bundle.getId()));
-        return true;
+        try {
+            this.setCurrentBundle(this.getBundleDirectory(bundle.getId()));
+            return true;
+        } catch (IOException e) {
+            return false;
+        }
     }
 
     void finalizePendingReload(final BundleInfo bundle, final String previousBundleName) {

package/android/src/main/java/ee/forgr/capacitor_updater/CryptoCipher.java

@@ -50,17 +50,15 @@ public class CryptoCipher {
         return decryptedBytes;
     }
 
-    public static byte[] decryptAES(byte[] cipherText, SecretKey key, byte[] iv) {
-        try {
-            IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
-            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
-            SecretKeySpec keySpec = new SecretKeySpec(key.getEncoded(), "AES");
-            cipher.init(Cipher.DECRYPT_MODE, keySpec, ivParameterSpec);
-            return cipher.doFinal(cipherText);
-        } catch (Exception e) {
-            e.printStackTrace();
+    public static byte[] decryptAES(byte[] cipherText, SecretKey key, byte[] iv) throws GeneralSecurityException {
+        if (key == null || iv == null) {
+            throw new IllegalArgumentException("AES key and IV must not be null");
         }
-        return null;
+        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
+        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+        SecretKeySpec keySpec = new SecretKeySpec(key.getEncoded(), "AES");
+        cipher.init(Cipher.DECRYPT_MODE, keySpec, ivParameterSpec);
+        return cipher.doFinal(cipherText);
     }
 
     public static SecretKey byteToSessionKey(byte[] sessionKey) {
@@ -137,13 +135,25 @@ public class CryptoCipher {
         return buf;
     }
 
+    public static boolean isValidSessionKey(final String sessionKey) {
+        if (sessionKey == null || sessionKey.isEmpty()) {
+            return false;
+        }
+        String[] sessionKeyParts = sessionKey.split(":", -1);
+        return sessionKeyParts.length == 2 && !sessionKeyParts[0].isEmpty() && !sessionKeyParts[1].isEmpty();
+    }
+
     public static void decryptFile(final File file, final String publicKey, final String ivSessionKey) throws IOException {
-        if (publicKey.isEmpty() || ivSessionKey == null || ivSessionKey.isEmpty() || ivSessionKey.split(":").length != 2) {
-            logger.info("Encryption not set, no public key or session, ignored");
+        if (publicKey.isEmpty() || !isValidSessionKey(ivSessionKey)) {
+            if (logger != null) {
+                logger.info("Encryption not set, no public key or session, ignored");
+            }
             return;
         }
         if (!publicKey.startsWith("-----BEGIN RSA PUBLIC KEY-----")) {
-            logger.error("The public key is not a valid RSA Public key");
+            if (logger != null) {
+                logger.error("The public key is not a valid RSA Public key");
+            }
             return;
         }
 
@@ -152,29 +162,50 @@ public class CryptoCipher {
             String sessionKeyB64 = ivSessionKey.split(":")[1];
             byte[] iv = Base64.decode(ivB64.getBytes(), Base64.DEFAULT);
             byte[] sessionKey = Base64.decode(sessionKeyB64.getBytes(), Base64.DEFAULT);
+            if (iv.length != 16) {
+                throw new IOException("AES file decryption failed: IV must be 16 bytes");
+            }
             PublicKey pKey = CryptoCipher.stringToPublicKey(publicKey);
             byte[] decryptedSessionKey = CryptoCipher.decryptRSA(sessionKey, pKey);
+            if (decryptedSessionKey == null || decryptedSessionKey.length != 16) {
+                throw new IOException("AES file decryption failed: decrypted session key must be 16 bytes");
+            }
 
             SecretKey sKey = CryptoCipher.byteToSessionKey(decryptedSessionKey);
             decryptAesFile(file, sKey, iv);
         } catch (GeneralSecurityException e) {
-            logger.info("decryptFile fail");
-            throw new IOException("GeneralSecurityException", e);
+            if (logger != null) {
+                logger.info("decryptFile fail");
+            }
+            throw new IOException("AES file decryption failed: " + e.getMessage(), e);
         }
     }
 
-    static void decryptAesFile(File file, SecretKey key, byte[] iv) throws IOException, GeneralSecurityException {
+    static void decryptAesFile(File file, SecretKey key, byte[] iv) throws IOException {
+        if (key == null) {
+            throw new IOException("AES file decryption failed: missing session key");
+        }
+        if (iv == null) {
+            throw new IOException("AES file decryption failed: missing IV");
+        }
+        if (iv.length != 16) {
+            throw new IOException("AES file decryption failed: IV must be 16 bytes");
+        }
+        byte[] keyBytes = key.getEncoded();
+        if (keyBytes == null || keyBytes.length != 16) {
+            throw new IOException("AES file decryption failed: session key must be 16 bytes");
+        }
         if (file.length() == 0) {
             throw new IOException("Empty encrypted data");
         }
-        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
-        cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key.getEncoded(), "AES"), new IvParameterSpec(iv));
         File parent = file.getAbsoluteFile().getParentFile();
         if (parent == null) {
             throw new IOException("Cannot create temp file for " + file.getAbsolutePath());
         }
         File tempFile = File.createTempFile("capgo-aes-", ".tmp", parent);
         try {
+            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+            cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(keyBytes, "AES"), new IvParameterSpec(iv));
             byte[] inBuf = new byte[ioBufferBytes()];
             // Reuse one output buffer. cipher.update(in) allocates a new byte[] per chunk.
             byte[] outBuf = new byte[inBuf.length + 16];
@@ -196,6 +227,8 @@ public class CryptoCipher {
             }
             replaceFile(tempFile, file);
             tempFile = null;
+        } catch (GeneralSecurityException e) {
+            throw new IOException("AES file decryption failed: " + e.getMessage(), e);
         } finally {
             if (tempFile != null && tempFile.exists()) {
                 tempFile.delete();