@capgo/capacitor-updater 8.51.22 → 8.51.23

package/README.md

@@ -46,7 +46,7 @@ Perfect for fixing bugs immediately, A/B testing features, and maintaining contr
 - 🔄 Auto Update: Automatically download and set the latest bundle for the app.
 - 🛟 Rollback: Reset the app to last working bundle if an incompatible bundle has been set.
 - 🔁 **Delta Updates**: Make instant updates by only downloading changed files.
-- 🔒 **Security**: Encrypt and sign each updates with best in class security standards.
+- 🔒 Security: checksum on every update; encryption optional for high-security apps.
 - ⚔️ **Battle-Tested**: Used in more than 3000 projects.
 - 📊 View your deployment statistics
 - 🔋 Supports Android and iOS

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -146,7 +146,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     static final int APPLICATION_EXIT_REASON_USER_REQUESTED = 10;
     static final int APPLICATION_EXIT_REASON_DEPENDENCY_DIED = 12;
 
-    private final String pluginVersion = "8.51.22";
+    private final String pluginVersion = "8.51.23";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;
@@ -2842,6 +2842,16 @@ public class CapacitorUpdaterPlugin extends Plugin {
         final String checksum,
         final JSONArray manifest
     ) throws IOException {
+        if (!this.implementation.publicKey.isEmpty() && !CryptoCipher.isValidSessionKey(sessionKey)) {
+            logger.error("Public key present but no valid session key provided");
+            this.implementation.sendStats("session_key_required");
+            throw new IOException("Session key required when public key is present");
+        }
+        if (manifest == null && (checksum == null || checksum.isEmpty())) {
+            logger.error("No checksum provided");
+            this.implementation.sendStats("checksum_required");
+            throw new IOException("Checksum required");
+        }
         // Manual/preview downloads must wait too — launch orphan sweep can delete their temps.
         waitForCleanupIfNeeded();
         if (manifest != null) {
@@ -4936,7 +4946,13 @@ public class CapacitorUpdaterPlugin extends Plugin {
                                     );
                                     return;
                                 }
-                                if (latest.isDownloaded() && BundleStatus.DOWNLOADING != latest.getStatus()) {
+                                final String latestSessionKey = jsRes.has("sessionKey") ? jsRes.getString("sessionKey") : "";
+                                if (
+                                    latest.isDownloaded() &&
+                                    BundleStatus.DOWNLOADING != latest.getStatus() &&
+                                    (CapacitorUpdaterPlugin.this.implementation.publicKey.isEmpty() ||
+                                        CryptoCipher.isValidSessionKey(latestSessionKey))
+                                ) {
                                     logger.info("Latest bundle already exists and download is NOT required. " + messageUpdate);
                                     final boolean directUpdateAllowedNow = CapacitorUpdaterPlugin.this.isDirectUpdateCurrentlyAllowed(
                                         plannedDirectUpdate

package/android/src/main/java/ee/forgr/capacitor_updater/CapgoUpdater.java

@@ -285,6 +285,22 @@ public class CapgoUpdater {
         this.cachedKeyId = CryptoCipher.calcKeyId(publicKey);
     }
 
+    private void requireSessionKeyForEncryptedUpdate(final String sessionKey) throws IOException {
+        if (!this.publicKey.isEmpty() && !CryptoCipher.isValidSessionKey(sessionKey)) {
+            logger.error("Public key present but no valid session key provided");
+            this.sendStats("session_key_required");
+            throw new IOException("Session key required when public key is present");
+        }
+    }
+
+    private void requireBundleChecksum(final String checksum) throws IOException {
+        if (checksum == null || checksum.isEmpty()) {
+            logger.error("No checksum provided");
+            this.sendStats("checksum_required");
+            throw new IOException("Checksum required");
+        }
+    }
+
     static boolean containsPathTraversalSegment(final String relativePath) {
         for (final String segment : relativePath.split("/")) {
             if ("..".equals(segment)) {
@@ -322,6 +338,10 @@ public class CapgoUpdater {
         return canonicalTarget;
     }
 
+    static File resolveBundleDirectory(final File documentsDir, final String bundleId) throws IOException {
+        return resolvePathInsideDirectory(new File(documentsDir, bundleDirectory), bundleId);
+    }
+
     public String getKeyId() {
         return this.cachedKeyId;
     }
@@ -389,11 +409,11 @@ public class CapgoUpdater {
         }
     }
 
-    private void flattenAssets(final File sourceFile, final String dest) throws IOException {
+    private void flattenAssets(final File sourceFile, final File destinationFile) throws IOException {
         if (!sourceFile.exists()) {
             throw new FileNotFoundException("Source file not found: " + sourceFile.getPath());
         }
-        final File destinationFile = new File(this.documentsDir, dest);
+        assertPathInsideBundleRoot(destinationFile);
         Objects.requireNonNull(destinationFile.getParentFile()).mkdirs();
         final String[] entries = sourceFile.list(this.filter);
         if (entries == null || entries.length == 0) {
@@ -422,7 +442,13 @@ public class CapgoUpdater {
             return;
         }
 
-        final File bundleDir = this.getBundleDirectory(id);
+        final File bundleDir;
+        try {
+            bundleDir = this.getBundleDirectory(id);
+        } catch (IOException e) {
+            logger.debug("Skip delta cache population: invalid bundle id");
+            return;
+        }
         if (!bundleDir.exists()) {
             logger.debug("Skip delta cache population: bundle dir missing");
             return;
@@ -510,7 +536,10 @@ public class CapgoUpdater {
         if (fileHash.isEmpty()) {
             return "";
         }
-        if (this.publicKey != null && !this.publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+        if (this.publicKey != null && !this.publicKey.isEmpty()) {
+            if (!CryptoCipher.isValidSessionKey(sessionKey)) {
+                return "";
+            }
             try {
                 fileHash = CryptoCipher.decryptChecksum(fileHash, this.publicKey);
             } catch (Exception e) {
@@ -846,31 +875,24 @@ public class CapgoUpdater {
         String checksum = "";
 
         try {
+            this.requireSessionKeyForEncryptedUpdate(sessionKey);
             this.notifyDownload(id, 71);
             downloaded = new File(this.documentsDir, dest);
 
             if (!isManifest) {
-                String checksumDecrypted = Objects.requireNonNullElse(checksumRes, "");
-
-                // If public key is present but no checksum provided, refuse installation
-                if (!this.publicKey.isEmpty() && checksumDecrypted.isEmpty()) {
-                    logger.error("Public key present but no checksum provided");
-                    this.sendStats("checksum_required");
-                    throw new IOException("Checksum required when public key is present: " + id);
-                }
+                String expectedChecksum = Objects.requireNonNullElse(checksumRes, "");
+                this.requireBundleChecksum(expectedChecksum);
 
-                if (!sessionKey.isEmpty()) {
+                if (CryptoCipher.isValidSessionKey(sessionKey)) {
                     CryptoCipher.decryptFile(downloaded, publicKey, sessionKey);
-                    checksumDecrypted = CryptoCipher.decryptChecksum(checksumRes, publicKey);
-                    checksum = CryptoCipher.calcChecksum(downloaded);
-                } else {
-                    checksum = CryptoCipher.calcChecksum(downloaded);
+                    expectedChecksum = CryptoCipher.decryptChecksum(checksumRes, publicKey);
                 }
+                checksum = CryptoCipher.calcChecksum(downloaded);
                 CryptoCipher.logChecksumInfo("Calculated checksum", checksum);
-                CryptoCipher.logChecksumInfo("Expected checksum", checksumDecrypted);
-                if ((!checksumDecrypted.isEmpty() || !this.publicKey.isEmpty()) && !checksumDecrypted.equals(checksum)) {
+                CryptoCipher.logChecksumInfo("Expected checksum", expectedChecksum);
+                if (!expectedChecksum.equals(checksum)) {
                     logger.error("Checksum mismatch");
-                    logger.debug("Expected: " + checksumDecrypted + ", Got: " + checksum);
+                    logger.debug("Expected: " + expectedChecksum + ", Got: " + checksum);
                     this.sendStats("checksum_fail");
                     throw new IOException("Checksum failed: " + id);
                 }
@@ -898,13 +920,11 @@ public class CapgoUpdater {
             if (!isManifest) {
                 extractedDir = this.unzip(id, downloaded, TEMP_UNZIP_PREFIX + this.randomString());
                 this.notifyDownload(id, 91);
-                final String idName = bundleDirectory + "/" + id;
-                this.flattenAssets(extractedDir, idName);
+                this.flattenAssets(extractedDir, this.getBundleDirectory(id));
                 this.cacheBundleFilesAsync(id);
             } else {
                 this.notifyDownload(id, 91);
-                final String idName = bundleDirectory + "/" + id;
-                this.flattenAssets(downloaded, idName);
+                this.flattenAssets(downloaded, this.getBundleDirectory(id));
                 downloaded.delete();
             }
             // Remove old bundle info and set new one
@@ -1123,18 +1143,44 @@ public class CapgoUpdater {
         }
     }
 
+    private void assertPathInsideDocumentsDir(final File target) throws IOException {
+        if (this.documentsDir == null) {
+            throw new IOException("Documents directory unavailable");
+        }
+        final File canonicalBase = this.documentsDir.getCanonicalFile();
+        final File canonicalTarget = target.getCanonicalFile();
+        final String basePath = canonicalBase.getPath();
+        final String normalizedBasePath = basePath.endsWith(File.separator) ? basePath : basePath + File.separator;
+        final String targetPath = canonicalTarget.getPath();
+        if (!targetPath.equals(basePath) && !targetPath.startsWith(normalizedBasePath)) {
+            throw new IOException("Path escapes updater storage: " + target.getPath());
+        }
+    }
+
+    private void assertPathInsideBundleRoot(final File target) throws IOException {
+        final File bundleRoot = new File(this.documentsDir, bundleDirectory).getCanonicalFile();
+        final File canonicalTarget = target.getCanonicalFile();
+        final String basePath = bundleRoot.getPath();
+        final String normalizedBasePath = basePath.endsWith(File.separator) ? basePath : basePath + File.separator;
+        final String targetPath = canonicalTarget.getPath();
+        if (!targetPath.equals(basePath) && !targetPath.startsWith(normalizedBasePath)) {
+            throw new IOException("Path escapes bundle storage: " + target.getPath());
+        }
+    }
+
     private void safeDelete(final File target) {
         if (target == null || !target.exists()) {
             return;
         }
         try {
+            this.assertPathInsideDocumentsDir(target);
             if (target.isDirectory()) {
                 this.deleteDirectory(target);
             } else if (!target.delete()) {
                 logger.warn("Failed to delete file: " + target.getAbsolutePath());
             }
         } catch (IOException cleanupError) {
-            logger.warn("Cleanup failed for " + target.getAbsolutePath() + ": " + cleanupError.getMessage());
+            logger.warn("Refusing unsafe delete for " + target.getAbsolutePath() + ": " + cleanupError.getMessage());
         }
     }
 
@@ -1408,6 +1454,15 @@ public class CapgoUpdater {
         final JSONArray manifest,
         final boolean setNext
     ) {
+        try {
+            this.requireSessionKeyForEncryptedUpdate(sessionKey);
+            if (manifest == null) {
+                this.requireBundleChecksum(checksum);
+            }
+        } catch (final IOException e) {
+            logger.error("Download blocked: " + e.getMessage());
+            return;
+        }
         if (!this.runDownloadGateQuiet()) {
             return;
         }
@@ -1438,6 +1493,8 @@ public class CapgoUpdater {
     }
 
     public BundleInfo download(final String url, final String version, final String sessionKey, final String checksum) throws IOException {
+        this.requireSessionKeyForEncryptedUpdate(sessionKey);
+        this.requireBundleChecksum(checksum);
         this.runDownloadGate();
         // Check for existing bundle with same version and clean up if in error state
         BundleInfo existingBundle = this.getBundleInfoByName(version);
@@ -1489,6 +1546,7 @@ public class CapgoUpdater {
         final String checksum,
         final JSONArray manifest
     ) throws IOException {
+        this.requireSessionKeyForEncryptedUpdate(sessionKey);
         this.runDownloadGate();
         if (manifest == null) {
             return download(url, version, sessionKey, checksum);
@@ -1570,6 +1628,14 @@ public class CapgoUpdater {
 
     public Boolean delete(final String id, final Boolean removeInfo, final boolean cancelActiveDownload) throws IOException {
         synchronized (this.deleteLock) {
+            final File bundle;
+            try {
+                bundle = this.getBundleDirectory(id);
+            } catch (IOException e) {
+                logger.error("Cannot delete bundle with invalid id");
+                logger.debug("Bundle ID: " + id + ", Error: " + e.getMessage());
+                return false;
+            }
             final BundleInfo deleted = this.getBundleInfo(id);
             if (deleted.isBuiltin() || this.getCurrentBundleId().equals(id)) {
                 logger.error("Cannot delete current or builtin bundle");
@@ -1595,7 +1661,6 @@ public class CapgoUpdater {
                 return false;
             }
 
-            final File bundle = this.getBundleDirectory(id);
             final boolean hadRegistry = this.hasStoredBundleInfo(id);
             final boolean hadFolder = bundle.exists();
             if (!hadRegistry && !hadFolder) {
@@ -1743,12 +1808,17 @@ public class CapgoUpdater {
         this.editor.commit();
     }
 
-    private File getBundleDirectory(final String id) {
-        return new File(this.documentsDir, bundleDirectory + "/" + id);
+    private File getBundleDirectory(final String id) throws IOException {
+        return resolveBundleDirectory(this.documentsDir, id);
     }
 
     private boolean bundleExists(final String id) {
-        final File bundle = this.getBundleDirectory(id);
+        final File bundle;
+        try {
+            bundle = this.getBundleDirectory(id);
+        } catch (IOException e) {
+            return false;
+        }
         final BundleInfo bundleInfo = this.getBundleInfo(id);
         return (
             bundle.isDirectory() &&
@@ -1825,7 +1895,16 @@ public class CapgoUpdater {
             this.reset();
             return true;
         }
-        final File bundle = this.getBundleDirectory(id);
+        final File bundle;
+        try {
+            bundle = this.getBundleDirectory(id);
+        } catch (IOException e) {
+            logger.error("Invalid bundle id");
+            logger.debug("Bundle ID: " + id + ", Error: " + e.getMessage());
+            this.setBundleStatus(id, BundleStatus.ERROR);
+            this.sendStats("set_fail", newBundle.getVersionName());
+            return false;
+        }
         logger.info("Setting next active bundle: " + id);
         if (this.bundleExists(id)) {
             var currentBundleName = this.getCurrentBundle().getVersionName();
@@ -1843,8 +1922,12 @@ public class CapgoUpdater {
         if (bundle == null || bundle.isBuiltin() || !this.bundleExists(bundle.getId())) {
             return false;
         }
-        this.setCurrentBundle(this.getBundleDirectory(bundle.getId()));
-        return true;
+        try {
+            this.setCurrentBundle(this.getBundleDirectory(bundle.getId()));
+            return true;
+        } catch (IOException e) {
+            return false;
+        }
     }
 
     boolean stagePreviewFallbackReload(final BundleInfo bundle) {
@@ -1858,8 +1941,12 @@ public class CapgoUpdater {
         if (!this.bundleExists(bundle.getId())) {
             return false;
         }
-        this.setCurrentBundle(this.getBundleDirectory(bundle.getId()));
-        return true;
+        try {
+            this.setCurrentBundle(this.getBundleDirectory(bundle.getId()));
+            return true;
+        } catch (IOException e) {
+            return false;
+        }
     }
 
     void finalizePendingReload(final BundleInfo bundle, final String previousBundleName) {

package/android/src/main/java/ee/forgr/capacitor_updater/CryptoCipher.java

@@ -135,8 +135,16 @@ public class CryptoCipher {
         return buf;
     }
 
+    public static boolean isValidSessionKey(final String sessionKey) {
+        if (sessionKey == null || sessionKey.isEmpty()) {
+            return false;
+        }
+        String[] sessionKeyParts = sessionKey.split(":", -1);
+        return sessionKeyParts.length == 2 && !sessionKeyParts[0].isEmpty() && !sessionKeyParts[1].isEmpty();
+    }
+
     public static void decryptFile(final File file, final String publicKey, final String ivSessionKey) throws IOException {
-        if (publicKey.isEmpty() || ivSessionKey == null || ivSessionKey.isEmpty() || ivSessionKey.split(":").length != 2) {
+        if (publicKey.isEmpty() || !isValidSessionKey(ivSessionKey)) {
             if (logger != null) {
                 logger.info("Encryption not set, no public key or session, ignored");
             }

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -456,7 +456,7 @@ public class DownloadService extends Worker {
                     return createFailureResult("Manifest is null");
                 }
             } else {
-                handleSingleFileDownload(url, id, documentsDir, dest, version, sessionKey, checksum);
+                handleSingleFileDownload(url, id, documentsDir, dest, version, sessionKey, checksum, publicKey);
                 return createSuccessResult(dest, version, sessionKey, checksum, false);
             }
         } catch (DownloadRetryException e) {
@@ -547,6 +547,12 @@ public class DownloadService extends Worker {
         try {
             logger.debug("handleManifestDownload");
 
+            if (publicKey != null && !publicKey.isEmpty() && !CryptoCipher.isValidSessionKey(sessionKey)) {
+                logger.error("Public key present but no valid session key provided");
+                sendStatsAsync("session_key_required", version);
+                throw new IOException("Session key required when public key is present");
+            }
+
             // Send stats for manifest download start
             sendStatsAsync("download_manifest_start", version);
 
@@ -582,7 +588,13 @@ public class DownloadService extends Worker {
                     continue;
                 }
 
-                if (publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+                if (publicKey != null && !publicKey.isEmpty()) {
+                    if (!CryptoCipher.isValidSessionKey(sessionKey)) {
+                        logger.error("Public key present but no valid session key provided");
+                        sendStatsAsync("session_key_required", version);
+                        hasError.set(true);
+                        continue;
+                    }
                     try {
                         fileHash = CryptoCipher.decryptChecksum(fileHash, publicKey);
                     } catch (Exception e) {
@@ -727,8 +739,20 @@ public class DownloadService extends Worker {
         String dest,
         String version,
         String sessionKey,
-        String checksum
+        String checksum,
+        String publicKey
     ) {
+        if (publicKey != null && !publicKey.isEmpty() && !CryptoCipher.isValidSessionKey(sessionKey)) {
+            logger.error("Public key present but no valid session key provided");
+            sendStatsAsync("session_key_required", version);
+            throw new RuntimeException("Session key required when public key is present");
+        }
+        if (checksum == null || checksum.isEmpty()) {
+            logger.error("No checksum provided");
+            sendStatsAsync("checksum_required", version);
+            throw new RuntimeException("Checksum required");
+        }
+
         // Send stats for zip download start
         sendStatsAsync("download_zip_start", version);
 
@@ -1110,7 +1134,7 @@ public class DownloadService extends Worker {
                 }
             }
 
-            boolean needDecrypt = publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty();
+            boolean needDecrypt = publicKey != null && !publicKey.isEmpty() && CryptoCipher.isValidSessionKey(sessionKey);
             File source = partial;
             if (needDecrypt) {
                 workFile = new File(cacheFolder, "work_" + UUID.randomUUID() + "_" + targetFile.getName() + ".tmp");

package/ios/Sources/CapacitorUpdaterPlugin/CapacitorUpdaterPlugin.swift

@@ -96,7 +96,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     deinit {
         implementation.shutdown()
     }
-    private let pluginVersion: String = "8.51.22"
+    private let pluginVersion: String = "8.51.23"
     private let launchStartedAtMs = Int64(Date().timeIntervalSince1970 * 1000)
     static let updateUrlDefault = "https://plugin.capgo.app/updates"
     static let statsUrlDefault = "https://plugin.capgo.app/stats"
@@ -582,8 +582,10 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         var dest: URL
         if BundleInfo.ID_BUILTIN == id {
             dest = Bundle.main.resourceURL!.appendingPathComponent("public")
+        } else if let bundleDir = try? self.implementation.getBundleDirectory(id: id) {
+            dest = bundleDir
         } else {
-            dest = self.implementation.getBundleDirectory(id: id)
+            dest = Bundle.main.resourceURL!.appendingPathComponent("public")
         }
 
         if !FileManager.default.fileExists(atPath: dest.path) {
@@ -1609,7 +1611,19 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
             throw makePreviewError("Invalid download URL")
         }
 
+        if !self.implementation.publicKey.isEmpty && !CryptoCipher.isValidSessionKey(sessionKey) {
+            self.logger.error("Public key present but no valid session key provided")
+            self.implementation.sendStats(action: "session_key_required", versionName: version)
+            throw makePreviewError("Session key required when public key is present")
+        }
+
         var checksum = rawChecksum
+        if manifestEntries == nil && checksum.isEmpty {
+            self.logger.error("No checksum provided")
+            self.implementation.sendStats(action: "checksum_required", versionName: version)
+            throw makePreviewError("Checksum required")
+        }
+
         let next: BundleInfo
         if let manifestEntries = manifestEntries {
             next = try self.implementation.downloadManifest(manifest: manifestEntries, version: version, sessionKey: sessionKey)
@@ -1617,29 +1631,20 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
             next = try self.implementation.download(url: url, version: version, sessionKey: sessionKey)
         }
 
-        if self.implementation.publicKey != "" && checksum == "" {
-            self.logger.error("Public key present but no checksum provided")
-            self.implementation.sendStats(action: "checksum_required", versionName: next.getVersionName())
-            let id = next.getId()
-            let resDel = self.implementation.delete(id: id)
-            if !resDel {
-                self.logger.error("Delete failed, id \(id) doesn't exist")
-            }
-            throw ObjectSavableError.checksum
-        }
-
-        checksum = try CryptoCipher.decryptChecksum(checksum: checksum, publicKey: self.implementation.publicKey)
-        CryptoCipher.logChecksumInfo(label: "Bundle checksum", hexChecksum: next.getChecksum())
-        CryptoCipher.logChecksumInfo(label: "Expected checksum", hexChecksum: checksum)
-        if (checksum != "" || self.implementation.publicKey != "") && next.getChecksum() != checksum {
-            self.logger.error("Error checksum \(next.getChecksum()) \(checksum)")
-            self.implementation.sendStats(action: "checksum_fail", versionName: next.getVersionName())
-            let id = next.getId()
-            let resDel = self.implementation.delete(id: id)
-            if !resDel {
-                self.logger.error("Delete failed, id \(id) doesn't exist")
+        if manifestEntries == nil {
+            checksum = try CryptoCipher.decryptChecksum(checksum: checksum, publicKey: self.implementation.publicKey)
+            CryptoCipher.logChecksumInfo(label: "Bundle checksum", hexChecksum: next.getChecksum())
+            CryptoCipher.logChecksumInfo(label: "Expected checksum", hexChecksum: checksum)
+            if next.getChecksum() != checksum {
+                self.logger.error("Error checksum \(next.getChecksum()) \(checksum)")
+                self.implementation.sendStats(action: "checksum_fail", versionName: next.getVersionName())
+                let id = next.getId()
+                let resDel = self.implementation.delete(id: id)
+                if !resDel {
+                    self.logger.error("Delete failed, id \(id) doesn't exist")
+                }
+                throw ObjectSavableError.checksum
             }
-            throw ObjectSavableError.checksum
         }
 
         self.logger.info("Good checksum \(next.getChecksum()) \(checksum)")
@@ -1691,8 +1696,10 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         let id = self.implementation.getCurrentBundleId()
         if BundleInfo.ID_BUILTIN == id {
             return Bundle.main.resourceURL!.appendingPathComponent("public")
+        } else if let bundleDir = try? self.implementation.getBundleDirectory(id: id) {
+            return bundleDir
         } else {
-            return self.implementation.getBundleDirectory(id: id)
+            return Bundle.main.resourceURL!.appendingPathComponent("public")
         }
     }
 
@@ -4172,6 +4179,22 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         self.updateUrl = updateUrl
     }
 
+    func downloadBundleForTesting(
+        urlString: String,
+        version: String,
+        sessionKey: String,
+        checksum: String,
+        manifestEntries: [ManifestEntry]?
+    ) throws -> BundleInfo {
+        try downloadBundle(
+            urlString: urlString,
+            version: version,
+            sessionKey: sessionKey,
+            checksum: checksum,
+            manifestEntries: manifestEntries
+        )
+    }
+
     func setAutoUpdateModeForTesting(_ autoUpdateMode: String) {
         self.autoUpdateMode = Self.normalizedAutoUpdateMode(autoUpdateMode)
         self.autoUpdate = Self.isAutoUpdateModeEnabled(self.autoUpdateMode)
@@ -4507,6 +4530,17 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
             if latestVersionName != "" && current.getVersionName() != latestVersionName {
                 do {
                     self.logger.info("New bundle: \(latestVersionName) found. Current is: \(current.getVersionName()). \(messageUpdate)")
+                    if !self.implementation.publicKey.isEmpty && !CryptoCipher.isValidSessionKey(sessionKey) {
+                        self.logger.error("Public key present but no valid session key provided")
+                        self.implementation.sendStats(action: "session_key_required", versionName: latestVersionName)
+                        self.endBackGroundTaskWithNotif(
+                            msg: "Session key required when public key is present",
+                            latestVersionName: latestVersionName,
+                            current: current,
+                            plannedDirectUpdate: plannedDirectUpdate
+                        )
+                        return
+                    }
                     var nextImpl = self.implementation.getBundleInfoByVersionName(version: latestVersionName)
                     let needsDownload = nextImpl.map(Self.shouldRetryDownloadForExistingBundle) ?? true
                     if needsDownload {
@@ -4524,6 +4558,17 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                         if res.manifest != nil {
                             nextImpl = try self.implementation.downloadManifest(manifest: res.manifest!, version: latestVersionName, sessionKey: sessionKey, link: res.link, comment: res.comment)
                         } else {
+                            if res.checksum.isEmpty {
+                                self.logger.error("No checksum provided")
+                                self.implementation.sendStats(action: "checksum_required", versionName: latestVersionName)
+                                self.endBackGroundTaskWithNotif(
+                                    msg: "Checksum required",
+                                    latestVersionName: latestVersionName,
+                                    current: current,
+                                    plannedDirectUpdate: plannedDirectUpdate
+                                )
+                                return
+                            }
                             nextImpl = try self.implementation.download(url: downloadUrl, version: latestVersionName, sessionKey: sessionKey, link: res.link, comment: res.comment)
                         }
                     }
@@ -4552,24 +4597,26 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                         self.endBackGroundTask()
                         return
                     }
-                    res.checksum = try CryptoCipher.decryptChecksum(checksum: res.checksum, publicKey: self.implementation.publicKey)
-                    CryptoCipher.logChecksumInfo(label: "Bundle checksum", hexChecksum: next.getChecksum())
-                    CryptoCipher.logChecksumInfo(label: "Expected checksum", hexChecksum: res.checksum)
-                    if res.checksum != "" && next.getChecksum() != res.checksum && res.manifest == nil {
-                        self.logger.error("Error checksum \(next.getChecksum()) \(res.checksum)")
-                        self.implementation.sendStats(action: "checksum_fail", versionName: next.getVersionName())
-                        let id = next.getId()
-                        let resDel = self.implementation.delete(id: id)
-                        if !resDel {
-                            self.logger.error("Delete failed, id \(id) doesn't exist")
+                    if res.manifest == nil {
+                        res.checksum = try CryptoCipher.decryptChecksum(checksum: res.checksum, publicKey: self.implementation.publicKey)
+                        CryptoCipher.logChecksumInfo(label: "Bundle checksum", hexChecksum: next.getChecksum())
+                        CryptoCipher.logChecksumInfo(label: "Expected checksum", hexChecksum: res.checksum)
+                        if next.getChecksum() != res.checksum {
+                            self.logger.error("Error checksum \(next.getChecksum()) \(res.checksum)")
+                            self.implementation.sendStats(action: "checksum_fail", versionName: next.getVersionName())
+                            let id = next.getId()
+                            let resDel = self.implementation.delete(id: id)
+                            if !resDel {
+                                self.logger.error("Delete failed, id \(id) doesn't exist")
+                            }
+                            self.endBackGroundTaskWithNotif(
+                                msg: "Error checksum",
+                                latestVersionName: latestVersionName,
+                                current: current,
+                                plannedDirectUpdate: plannedDirectUpdate
+                            )
+                            return
                         }
-                        self.endBackGroundTaskWithNotif(
-                            msg: "Error checksum",
-                            latestVersionName: latestVersionName,
-                            current: current,
-                            plannedDirectUpdate: plannedDirectUpdate
-                        )
-                        return
                     }
                     if self.shouldBlockAutoUpdateForPreviewSession() {
                         self.clearDownloadInProgressState()

package/ios/Sources/CapacitorUpdaterPlugin/CapgoUpdater.swift

@@ -166,6 +166,11 @@ import UIKit
         return canonicalTarget
     }
 
+    static func resolveBundleDirectory(libraryDir: URL, bundleId: String) throws -> URL {
+        let bundleRoot = libraryDir.appendingPathComponent("NoCloud/ionic_built_snapshots")
+        return try resolvePathInsideDirectory(baseDirectory: bundleRoot, relativePath: bundleId)
+    }
+
     static func resolveManifestTargetPath(baseDirectory: URL, fileName: String) throws -> URL {
         let isBrotli = fileName.hasSuffix(".br")
         let targetFileName = isBrotli ? String(fileName.dropLast(3)) : fileName
@@ -456,6 +461,18 @@ import UIKit
         return String((0..<length).map { _ in letters.randomElement()! })
     }
 
+    private func requireSessionKeyForEncryptedUpdate(sessionKey: String, versionName: String? = nil) throws {
+        if !self.publicKey.isEmpty && !CryptoCipher.isValidSessionKey(sessionKey) {
+            logger.error("Public key present but no valid session key provided")
+            self.sendStats(action: "session_key_required", versionName: versionName)
+            throw NSError(
+                domain: "CapgoUpdater",
+                code: 1,
+                userInfo: [NSLocalizedDescriptionKey: "Session key required when public key is present"]
+            )
+        }
+    }
+
     public func setPublicKey(_ publicKey: String) {
         // Empty string means no encryption - proceed normally
         if publicKey.isEmpty {
@@ -987,7 +1004,13 @@ import UIKit
     /// `manifest` must only contain entries the caller already checksum-verified
     /// (as `downloadManifest` does) — the hashes are trusted as-is, not re-checked.
     func populateDeltaCache(for id: String, manifest: [ManifestEntry]? = nil, sessionKey: String = "") {
-        let bundleDir = self.getBundleDirectory(id: id)
+        let bundleDir: URL
+        do {
+            bundleDir = try self.getBundleDirectory(id: id)
+        } catch {
+            logger.debug("Skip delta cache population: invalid bundle id")
+            return
+        }
         let fileManager = FileManager.default
 
         guard fileManager.fileExists(atPath: bundleDir.path) else {
@@ -1247,7 +1270,10 @@ import UIKit
         guard var fileHash = entry.file_hash, !fileHash.isEmpty else {
             return nil
         }
-        if !self.publicKey.isEmpty && !sessionKey.isEmpty {
+        if !self.publicKey.isEmpty {
+            if !CryptoCipher.isValidSessionKey(sessionKey) {
+                return nil
+            }
             do {
                 fileHash = try CryptoCipher.decryptChecksum(checksum: fileHash, publicKey: self.publicKey)
             } catch {
@@ -1408,10 +1434,11 @@ import UIKit
     }
 
     public func downloadManifest(manifest: [ManifestEntry], version: String, sessionKey: String, link: String? = nil, comment: String? = nil) throws -> BundleInfo {
+        try self.requireSessionKeyForEncryptedUpdate(sessionKey: sessionKey, versionName: version)
         try self.runBeforeDownload()
         let id = self.randomString(length: 10)
         logger.info("downloadManifest start \(id)")
-        let destFolder = self.getBundleDirectory(id: id)
+        let destFolder = try self.getBundleDirectory(id: id)
         let builtinFolder = self.builtinFolderURL()
 
         // Check disk space before starting manifest download (estimate 100KB per file, minimum 50MB)
@@ -1482,7 +1509,23 @@ import UIKit
             var fileHash = entryFileHash
 
             // Decrypt checksum if needed (done before creating operation)
-            if !self.publicKey.isEmpty && !sessionKey.isEmpty {
+            if !self.publicKey.isEmpty {
+                if !CryptoCipher.isValidSessionKey(sessionKey) {
+                    let error = NSError(
+                        domain: "CapgoUpdater",
+                        code: 1,
+                        userInfo: [NSLocalizedDescriptionKey: "Session key required when public key is present"]
+                    )
+                    self.sendStats(action: "session_key_required", versionName: version)
+                    errorLock.lock()
+                    if downloadError == nil {
+                        downloadError = error
+                    }
+                    errorLock.unlock()
+                    hasError.value = true
+                    logger.error("Public key present but no valid session key provided")
+                    continue
+                }
                 do {
                     fileHash = try CryptoCipher.decryptChecksum(checksum: fileHash, publicKey: self.publicKey)
                 } catch {
@@ -1762,7 +1805,7 @@ import UIKit
 
         do {
             var source = partialURL
-            if !self.publicKey.isEmpty && !sessionKey.isEmpty {
+            if !self.publicKey.isEmpty && CryptoCipher.isValidSessionKey(sessionKey) {
                 let work = cacheFolder.appendingPathComponent("work_\(UUID().uuidString)_\((fileName as NSString).lastPathComponent)")
                 try FileManager.default.copyItem(at: partialURL, to: work)
                 workURL = work
@@ -2064,6 +2107,7 @@ import UIKit
     }
 
     public func download(url: URL, version: String, sessionKey: String, link: String? = nil, comment: String? = nil) throws -> BundleInfo {
+        try self.requireSessionKeyForEncryptedUpdate(sessionKey: sessionKey, versionName: version)
         try self.runBeforeDownload()
         let id: String = self.randomString(length: 10)
         // Each download uses its own temp files keyed by bundle ID to prevent collisions
@@ -2344,6 +2388,15 @@ import UIKit
         self.deleteLock.lock()
         defer { self.deleteLock.unlock() }
 
+        let destPersist: URL
+        do {
+            destPersist = try self.getBundleDirectory(id: id)
+        } catch {
+            logger.error("Cannot delete bundle with invalid id")
+            logger.debug("Bundle ID: \(id), Error: \(error.localizedDescription)")
+            return false
+        }
+
         let deleted: BundleInfo = self.getBundleInfo(id: id)
         if deleted.isBuiltin() || self.getCurrentBundleId() == id {
             logger.info("Cannot delete current or builtin bundle")
@@ -2372,7 +2425,6 @@ import UIKit
             return false
         }
 
-        let destPersist: URL = libraryDir.appendingPathComponent(bundleDirectory).appendingPathComponent(id)
         let hadRegistry = self.hasStoredBundleInfo(id: id)
         let hadFolder = FileManager.default.fileExists(atPath: destPersist.path)
         if !hadRegistry && !hadFolder {
@@ -2676,8 +2728,8 @@ import UIKit
         }
     }
 
-    public func getBundleDirectory(id: String) -> URL {
-        return libraryDir.appendingPathComponent(self.bundleDirectory).appendingPathComponent(id)
+    public func getBundleDirectory(id: String) throws -> URL {
+        return try Self.resolveBundleDirectory(libraryDir: libraryDir, bundleId: id)
     }
 
     struct ResetState {
@@ -2731,7 +2783,12 @@ import UIKit
     }
 
     private func bundleExists(id: String) -> Bool {
-        let destPersist: URL = self.getBundleDirectory(id: id)
+        let destPersist: URL
+        do {
+            destPersist = try self.getBundleDirectory(id: id)
+        } catch {
+            return false
+        }
         let indexPersist: URL = destPersist.appendingPathComponent("index.html")
         let bundleIndo: BundleInfo = self.getBundleInfo(id: id)
         if
@@ -2754,7 +2811,12 @@ import UIKit
         }
         if bundleExists(id: id) {
             let currentBundleName = self.getCurrentBundle().getVersionName()
-            self.setCurrentBundle(bundle: self.getBundleDirectory(id: id).path)
+            guard let bundleDir = try? self.getBundleDirectory(id: id) else {
+                self.setBundleStatus(id: id, status: BundleStatus.ERROR)
+                self.sendStats(action: "set_fail", versionName: newBundle.getVersionName())
+                return false
+            }
+            self.setCurrentBundle(bundle: bundleDir.path)
             self.setBundleStatus(id: id, status: BundleStatus.PENDING)
             self.sendStats(action: "set", versionName: newBundle.getVersionName(), oldVersionName: currentBundleName)
             return true
@@ -2768,7 +2830,10 @@ import UIKit
         guard !bundle.isBuiltin(), bundleExists(id: bundle.getId()) else {
             return false
         }
-        self.setCurrentBundle(bundle: self.getBundleDirectory(id: bundle.getId()).path)
+        guard let bundleDir = try? self.getBundleDirectory(id: bundle.getId()) else {
+            return false
+        }
+        self.setCurrentBundle(bundle: bundleDir.path)
         return true
     }
 
@@ -2783,7 +2848,10 @@ import UIKit
         guard bundleExists(id: bundle.getId()) else {
             return false
         }
-        self.setCurrentBundle(bundle: self.getBundleDirectory(id: bundle.getId()).path)
+        guard let bundleDir = try? self.getBundleDirectory(id: bundle.getId()) else {
+            return false
+        }
+        self.setCurrentBundle(bundle: bundleDir.path)
         return true
     }
 

package/ios/Sources/CapacitorUpdaterPlugin/CryptoCipher.swift

@@ -225,8 +225,16 @@ public struct CryptoCipher {
         return String(hexString(from: sha256).prefix(16))
     }
 
+    public static func isValidSessionKey(_ sessionKey: String) -> Bool {
+        if sessionKey.isEmpty {
+            return false
+        }
+        let sessionKeyParts = sessionKey.components(separatedBy: ":")
+        return sessionKeyParts.count == 2 && !sessionKeyParts[0].isEmpty && !sessionKeyParts[1].isEmpty
+    }
+
     public static func decryptFile(filePath: URL, publicKey: String, sessionKey: String, version: String) throws {
-        if publicKey.isEmpty || sessionKey.isEmpty || sessionKey.components(separatedBy: ":").count != 2 {
+        if publicKey.isEmpty || !isValidSessionKey(sessionKey) {
             logger.info("Encryption not set, no public key or session, ignored")
             return
         }

package/ios/Sources/CapacitorUpdaterPlugin/ShakeMenu.swift

@@ -359,7 +359,10 @@ extension UIWindow {
             if !next.isBuiltin() {
                 plugin.logger.info("Resetting to: \(next.toString())")
                 _ = updater.set(bundle: next)
-                let destHot = updater.getBundleDirectory(id: next.getId())
+                guard let destHot = try? updater.getBundleDirectory(id: next.getId()) else {
+                    resetBuiltin()
+                    return
+                }
                 plugin.logger.info("Reloading \(next.toString())")
                 bridge.setServerBasePath(destHot.path)
             } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-updater",
-  "version": "8.51.22",
+  "version": "8.51.23",
   "license": "MPL-2.0",
   "description": "Live update for capacitor apps",
   "main": "dist/plugin.cjs.js",