@capgo/cordova-updater 8.1.4 → 8.2.1

package/src/android/test/app/capgo/cordova/updater/SecurityHardeningTest.java

@@ -0,0 +1,197 @@
+package app.capgo.cordova.updater;
+
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+import static org.mockito.Mockito.mock;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.robolectric.RobolectricTestRunner;
+import org.robolectric.annotation.Config;
+
+@RunWith(RobolectricTestRunner.class)
+@Config(manifest = Config.NONE)
+public class SecurityHardeningTest {
+
+    @Test
+    public void testResolvePathInsideDirectoryRejectsAbsolutePaths() throws Exception {
+        final Path base = Files.createTempDirectory("capgo-abs-path");
+        base.toFile().deleteOnExit();
+
+        assertThrows(IOException.class, () -> CapgoUpdater.resolvePathInsideDirectory(base.toFile(), "/etc/passwd"));
+    }
+
+    @Test
+    public void testResolvePathInsideDirectoryRejectsBackslashes() throws Exception {
+        final Path base = Files.createTempDirectory("capgo-backslash-path");
+        base.toFile().deleteOnExit();
+
+        assertThrows(IOException.class, () -> CapgoUpdater.resolvePathInsideDirectory(base.toFile(), "assets\\app.js"));
+    }
+
+    @Test
+    public void testResolvePathInsideDirectoryRejectsNullBytes() throws Exception {
+        final Path base = Files.createTempDirectory("capgo-null-path");
+        base.toFile().deleteOnExit();
+
+        assertThrows(IOException.class, () -> CapgoUpdater.resolvePathInsideDirectory(base.toFile(), "assets\0app.js"));
+    }
+
+    @Test
+    public void testResolvePathInsideDirectoryRejectsDotDotSegments() throws Exception {
+        final Path base = Files.createTempDirectory("capgo-dotdot-path");
+        base.toFile().deleteOnExit();
+
+        assertThrows(IOException.class, () -> CapgoUpdater.resolvePathInsideDirectory(base.toFile(), "assets/../../secret.js"));
+        assertThrows(IOException.class, () -> CapgoUpdater.resolvePathInsideDirectory(base.toFile(), "../secret.js"));
+    }
+
+    @Test
+    public void testResolvePathInsideDirectoryRejectsDotAsBaseDirectory() throws Exception {
+        final Path base = Files.createTempDirectory("capgo-dot-path");
+        base.toFile().deleteOnExit();
+
+        assertThrows(IOException.class, () -> CapgoUpdater.resolvePathInsideDirectory(base.toFile(), "."));
+    }
+
+    @Test
+    public void testResolvePathInsideDirectoryAllowsNestedRelativePath() throws Exception {
+        final Path base = Files.createTempDirectory("capgo-nested-path");
+        base.toFile().deleteOnExit();
+
+        final File resolved = CapgoUpdater.resolvePathInsideDirectory(base.toFile(), "assets/app.js");
+
+        assertEquals(base.resolve("assets").resolve("app.js").toFile().getCanonicalFile(), resolved);
+    }
+
+    @Test
+    public void resolveBundleDirectoryRejectsAbsolutePath() throws Exception {
+        final Path tempDir = Files.createTempDirectory("capgo-delete-abs");
+        tempDir.toFile().deleteOnExit();
+        assertThrows(IOException.class, () -> CapgoUpdater.resolveBundleDirectory(tempDir.toFile(), "/tmp/evil"));
+    }
+
+    @Test
+    public void resolveBundleDirectoryRejectsPathTraversal() throws Exception {
+        final Path tempDir = Files.createTempDirectory("capgo-delete-traversal");
+        tempDir.toFile().deleteOnExit();
+        assertThrows(IOException.class, () -> CapgoUpdater.resolveBundleDirectory(tempDir.toFile(), "../outside-target"));
+    }
+
+    @Test
+    public void resolveBundleDirectoryRejectsDotAsBundleRoot() throws Exception {
+        final Path tempDir = Files.createTempDirectory("capgo-delete-dot");
+        tempDir.toFile().deleteOnExit();
+        assertThrows(IOException.class, () -> CapgoUpdater.resolveBundleDirectory(tempDir.toFile(), "."));
+    }
+
+    @Test
+    public void deleteRejectsDotBundleId() throws Exception {
+        final Path tempDir = Files.createTempDirectory("capgo-delete-dot-id");
+        tempDir.toFile().deleteOnExit();
+        final CapgoUpdater updater = new CapgoUpdater(mock(Logger.class));
+        updater.documentsDir = tempDir.toFile();
+
+        assertFalse(Boolean.TRUE.equals(updater.delete(".", true)));
+    }
+
+    @Test
+    public void resolveBundleDirectoryRejectsWindowsSeparators() throws Exception {
+        final Path tempDir = Files.createTempDirectory("capgo-delete-windows");
+        tempDir.toFile().deleteOnExit();
+        assertThrows(IOException.class, () -> CapgoUpdater.resolveBundleDirectory(tempDir.toFile(), "..\\outside-target"));
+    }
+
+    @Test
+    public void deleteRejectsPathTraversalOutsideBundleRoot() throws Exception {
+        final Path tempDir = Files.createTempDirectory("capgo-delete-escape");
+        tempDir.toFile().deleteOnExit();
+        final Path outsideTarget = tempDir.resolve("outside-target");
+        Files.createDirectories(outsideTarget);
+        Files.write(outsideTarget.resolve("marker.txt"), "keep".getBytes(StandardCharsets.UTF_8));
+
+        final CapgoUpdater updater = new CapgoUpdater(mock(Logger.class));
+        updater.documentsDir = tempDir.toFile();
+
+        assertFalse(Boolean.TRUE.equals(updater.delete("../outside-target", true)));
+        assertTrue("Path outside bundle root must remain untouched", Files.exists(outsideTarget.resolve("marker.txt")));
+    }
+
+    @Test
+    public void deleteRejectsAbsolutePathId() throws Exception {
+        final Path tempDir = Files.createTempDirectory("capgo-delete-abs-id");
+        tempDir.toFile().deleteOnExit();
+        final CapgoUpdater updater = new CapgoUpdater(mock(Logger.class));
+        updater.documentsDir = tempDir.toFile();
+
+        assertFalse(Boolean.TRUE.equals(updater.delete("/tmp/evil", true)));
+    }
+
+    @Test
+    public void decryptAesFileRejectsNullKeyWithoutNpe() throws Exception {
+        final Path dir = Files.createTempDirectory("capgo-aes-null-key");
+        dir.toFile().deleteOnExit();
+        File file = dir.resolve("cipher.bin").toFile();
+        byte[] iv = new byte[16];
+        Files.write(file.toPath(), new byte[] { 1, 2, 3, 4, 5, 6, 7, 8 });
+        try {
+            CryptoCipher.decryptAesFile(file, null, iv);
+            fail("expected null session key to be rejected");
+        } catch (NullPointerException e) {
+            fail("null session key must not cause NPE");
+        } catch (IOException e) {
+            assertTrue(e.getMessage().contains("missing session key"));
+        }
+    }
+
+    @Test
+    public void decryptAesFileRejectsBadKeyWithoutNpe() throws Exception {
+        final Path dir = Files.createTempDirectory("capgo-aes-bad-key");
+        dir.toFile().deleteOnExit();
+        File file = dir.resolve("cipher.bin").toFile();
+        byte[] iv = new byte[16];
+        byte[] keyBytes = new byte[16];
+        for (int i = 0; i < 16; i++) {
+            iv[i] = (byte) i;
+            keyBytes[i] = (byte) (31 - i);
+        }
+        javax.crypto.SecretKey encryptKey = new javax.crypto.spec.SecretKeySpec(keyBytes, "AES");
+        javax.crypto.SecretKey decryptKey = new javax.crypto.spec.SecretKeySpec(new byte[16], "AES");
+        byte[] plain = "capgo-aes-failure".getBytes(StandardCharsets.UTF_8);
+        javax.crypto.Cipher enc = javax.crypto.Cipher.getInstance("AES/CBC/PKCS5Padding");
+        enc.init(javax.crypto.Cipher.ENCRYPT_MODE, encryptKey, new javax.crypto.spec.IvParameterSpec(iv));
+        byte[] cipherBytes = enc.doFinal(plain);
+        Files.write(file.toPath(), cipherBytes);
+        byte[] originalCipher = Files.readAllBytes(file.toPath());
+        try {
+            CryptoCipher.decryptAesFile(file, decryptKey, iv);
+            fail("expected AES decrypt failure");
+        } catch (NullPointerException e) {
+            fail("AES decrypt failure must not cause NPE");
+        } catch (IOException e) {
+            assertTrue(e.getMessage().contains("AES file decryption failed"));
+            assertArrayEquals(originalCipher, Files.readAllBytes(file.toPath()));
+        }
+    }
+
+    @Test
+    public void decryptAESRejectsFailureWithoutNull() throws Exception {
+        byte[] iv = new byte[16];
+        byte[] keyBytes = new byte[16];
+        javax.crypto.SecretKey key = new javax.crypto.spec.SecretKeySpec(keyBytes, "AES");
+        try {
+            CryptoCipher.decryptAES(new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, key, iv);
+            fail("expected AES decrypt failure");
+        } catch (javax.crypto.BadPaddingException expected) {
+            // expected decrypt failure
+        }
+    }
+}

package/src/android/test/app/capgo/cordova/updater/SessionKeyRequiredTest.java

@@ -0,0 +1,344 @@
+package app.capgo.cordova.updater;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockConstruction;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.when;
+
+import android.content.SharedPreferences;
+import android.os.Handler;
+import android.os.Looper;
+import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import org.json.JSONArray;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.robolectric.RobolectricTestRunner;
+import org.robolectric.annotation.Config;
+
+@RunWith(RobolectricTestRunner.class)
+@Config(manifest = Config.NONE)
+public class SessionKeyRequiredTest {
+
+    private static String fixturePublicKey;
+
+    @BeforeClass
+    public static void setUpClass() throws Exception {
+        CryptoCipher.setLogger(new Logger("SessionKeyRequiredTest", new Logger.Options(Logger.LogLevel.silent)));
+        Path contractFile = Path.of(System.getProperty("user.dir")).toAbsolutePath();
+        while (contractFile != null) {
+            Path candidate = contractFile.resolve("native-contract-tests/crypto-rsa.json");
+            if (Files.exists(candidate)) {
+                fixturePublicKey = new org.json.JSONObject(new String(Files.readAllBytes(candidate), StandardCharsets.UTF_8)).getString(
+                    "publicKeyPem"
+                );
+                return;
+            }
+            contractFile = contractFile.getParent();
+        }
+        throw new IOException("native-contract-tests/crypto-rsa.json not found");
+    }
+
+    private static class StatsTrackingCapgoUpdater extends CapgoUpdater {
+
+        private final List<String> sentStatsActions = new ArrayList<>();
+
+        StatsTrackingCapgoUpdater() {
+            super(mock(Logger.class));
+        }
+
+        @Override
+        public void sendStats(final String action) {
+            this.sentStatsActions.add(action);
+        }
+
+        List<String> getSentStatsActions() {
+            return this.sentStatsActions;
+        }
+    }
+
+    private static final class AutoUpdateSessionKeyCapgoUpdater extends StatsTrackingCapgoUpdater {
+
+        @Override
+        public void getLatest(final String updateUrl, final String channel, final Callback callback) {
+            final Map<String, Object> response = new HashMap<>();
+            response.put("version", "2.0.0");
+            response.put("url", "https://example.com/update.zip");
+            callback.callback(response);
+        }
+
+        @Override
+        public BundleInfo getCurrentBundle() {
+            return new BundleInfo("current-id", "1.0.0", BundleStatus.SUCCESS, new Date(), "abc");
+        }
+    }
+
+    private static final class PendingBundleAutoUpdateCapgoUpdater extends StatsTrackingCapgoUpdater {
+
+        @Override
+        public void getLatest(final String updateUrl, final String channel, final Callback callback) {
+            final Map<String, Object> response = new HashMap<>();
+            response.put("version", "2.0.0");
+            response.put("url", "https://example.com/update.zip");
+            response.put("checksum", "abc123");
+            callback.callback(response);
+        }
+
+        @Override
+        public BundleInfo getCurrentBundle() {
+            return new BundleInfo("current-id", "1.0.0", BundleStatus.SUCCESS, new Date(), "abc");
+        }
+
+        @Override
+        public BundleInfo getBundleInfoByName(final String versionName) {
+            if ("2.0.0".equals(versionName)) {
+                return new BundleInfo("pending-id", "2.0.0", BundleStatus.PENDING, new Date(), "abc123");
+            }
+            return null;
+        }
+    }
+
+    private static final class ImmediateThreadCordovaUpdaterPlugin extends CordovaUpdaterPlugin {
+
+        @Override
+        public Thread startNewThread(final Runnable function) {
+            function.run();
+            return new Thread();
+        }
+    }
+
+    private static void configureFinishDownloadTestState(final StatsTrackingCapgoUpdater updater) {
+        updater.prefs = mock(SharedPreferences.class);
+        updater.editor = mock(SharedPreferences.Editor.class);
+        when(updater.prefs.getString(anyString(), anyString())).thenReturn("");
+    }
+
+    private static void invokeBackgroundDownload(final CordovaUpdaterPlugin plugin) throws Exception {
+        final Method backgroundDownload = CordovaUpdaterPlugin.class.getDeclaredMethod("backgroundDownload");
+        backgroundDownload.setAccessible(true);
+        backgroundDownload.invoke(plugin);
+    }
+
+    private static void invokeDownloadBundle(
+        final CordovaUpdaterPlugin plugin,
+        final String url,
+        final String version,
+        final String sessionKey,
+        final String checksum,
+        final JSONArray manifest
+    ) throws Exception {
+        final Method downloadBundle = CordovaUpdaterPlugin.class.getDeclaredMethod(
+            "downloadBundle",
+            String.class,
+            String.class,
+            String.class,
+            String.class,
+            JSONArray.class
+        );
+        downloadBundle.setAccessible(true);
+        downloadBundle.invoke(plugin, url, version, sessionKey, checksum, manifest);
+    }
+
+    @Test
+    public void finishDownloadRejectsManifestWhenSessionKeyMissing() throws Exception {
+        final StatsTrackingCapgoUpdater updater = new StatsTrackingCapgoUpdater();
+        configureFinishDownloadTestState(updater);
+        updater.setPublicKey(fixturePublicKey);
+        updater.documentsDir = Files.createTempDirectory("capgo-session-key-manifest").toFile();
+
+        final boolean success = updater.finishDownload("bundle-id", "dest", "1.0.0", "", "checksum", false, true);
+
+        assertFalse(success);
+        assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+    }
+
+    @Test
+    public void finishDownloadRejectsZipWhenSessionKeyMissing() throws Exception {
+        final StatsTrackingCapgoUpdater updater = new StatsTrackingCapgoUpdater();
+        configureFinishDownloadTestState(updater);
+        updater.setPublicKey(fixturePublicKey);
+        final Path tempDir = Files.createTempDirectory("capgo-session-key-zip");
+        updater.documentsDir = tempDir.toFile();
+        final String dest = "bundle.zip";
+        Files.write(tempDir.resolve(dest), "plaintext".getBytes(StandardCharsets.UTF_8));
+
+        final boolean success = updater.finishDownload("bundle-id", dest, "1.0.0", "", "checksum", false, false);
+
+        assertFalse(success);
+        assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+    }
+
+    @Test
+    public void downloadRejectsWhenSessionKeyMissing() {
+        final StatsTrackingCapgoUpdater updater = new StatsTrackingCapgoUpdater();
+        updater.setPublicKey(fixturePublicKey);
+
+        try {
+            updater.download("https://example.com/update.zip", "1.0.0", "", "checksum");
+            fail("Expected IOException when session key is missing");
+        } catch (IOException e) {
+            assertEquals("Session key required when public key is present", e.getMessage());
+        }
+
+        assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+    }
+
+    @Test
+    public void isValidSessionKeyRejectsEmptyComponents() {
+        assertFalse(CryptoCipher.isValidSessionKey(null));
+        assertFalse(CryptoCipher.isValidSessionKey(""));
+        assertFalse(CryptoCipher.isValidSessionKey(":"));
+        assertFalse(CryptoCipher.isValidSessionKey("abc:"));
+        assertFalse(CryptoCipher.isValidSessionKey(":xyz"));
+        assertFalse(CryptoCipher.isValidSessionKey("invalid-format"));
+        assertTrue(CryptoCipher.isValidSessionKey("abc:def"));
+    }
+
+    @Test
+    public void downloadRejectsWhenSessionKeyHasEmptyComponents() {
+        final StatsTrackingCapgoUpdater updater = new StatsTrackingCapgoUpdater();
+        updater.setPublicKey(fixturePublicKey);
+
+        try {
+            updater.download("https://example.com/update.zip", "1.0.0", "abc:", "checksum");
+            fail("Expected IOException when session key has empty components");
+        } catch (IOException e) {
+            assertEquals("Session key required when public key is present", e.getMessage());
+        }
+
+        assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+    }
+
+    @Test
+    public void downloadRejectsWhenSessionKeyFormatInvalid() {
+        final StatsTrackingCapgoUpdater updater = new StatsTrackingCapgoUpdater();
+        updater.setPublicKey(fixturePublicKey);
+
+        try {
+            updater.download("https://example.com/update.zip", "1.0.0", "invalid-format", "checksum");
+            fail("Expected IOException when session key format is invalid");
+        } catch (IOException e) {
+            assertEquals("Session key required when public key is present", e.getMessage());
+        }
+
+        assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+    }
+
+    @Test
+    public void downloadManifestRejectsWhenSessionKeyMissing() {
+        final StatsTrackingCapgoUpdater updater = new StatsTrackingCapgoUpdater();
+        updater.setPublicKey(fixturePublicKey);
+        final JSONArray manifest = new JSONArray();
+
+        try {
+            updater.downloadManifest("https://example.com/update.zip", "1.0.0", "", "checksum", manifest);
+            fail("Expected IOException when session key is missing");
+        } catch (IOException e) {
+            assertEquals("Session key required when public key is present", e.getMessage());
+        }
+
+        assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+    }
+
+    @Test
+    public void downloadBackgroundDoesNotStartWhenSessionKeyMissing() {
+        final StatsTrackingCapgoUpdater updater = new StatsTrackingCapgoUpdater();
+        updater.setPublicKey(fixturePublicKey);
+
+        updater.downloadBackground(
+            "https://example.com/update.zip",
+            "9.9.9-session-key-guard",
+            "",
+            "checksum",
+            null,
+            true,
+            1L
+        );
+
+        assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+        assertEquals(null, updater.getBundleInfoByName("9.9.9-session-key-guard"));
+    }
+
+    @Test
+    public void downloadBundleRejectsWhenSessionKeyMissing() throws Exception {
+        final ImmediateThreadCordovaUpdaterPlugin plugin = new ImmediateThreadCordovaUpdaterPlugin();
+        final StatsTrackingCapgoUpdater updater = new StatsTrackingCapgoUpdater();
+        updater.setPublicKey(fixturePublicKey);
+        plugin.implementation = updater;
+        plugin.setLoggerForTesting(mock(Logger.class));
+
+        try {
+            invokeDownloadBundle(plugin, "https://example.com/update.zip", "1.0.0", "", "checksum", null);
+            fail("Expected IOException when session key is missing");
+        } catch (InvocationTargetException e) {
+            assertTrue(e.getCause() instanceof IOException);
+            assertEquals("Session key required when public key is present", e.getCause().getMessage());
+        }
+
+        assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+    }
+
+    @Test
+    public void autoUpdateRejectsMissingSessionKeyWhenPendingBundleExists() throws Exception {
+        try (
+            MockedStatic<Looper> looperMock = mockStatic(Looper.class);
+            MockedConstruction<Handler> ignored = mockConstruction(Handler.class)
+        ) {
+            looperMock.when(Looper::getMainLooper).thenReturn(mock(Looper.class));
+
+            final ImmediateThreadCordovaUpdaterPlugin plugin = new ImmediateThreadCordovaUpdaterPlugin();
+            final PendingBundleAutoUpdateCapgoUpdater updater = new PendingBundleAutoUpdateCapgoUpdater();
+            updater.setPublicKey(fixturePublicKey);
+
+            plugin.implementation = updater;
+            plugin.setAutoUpdateModeForTesting("onlyDownload");
+            plugin.setLoggerForTesting(mock(Logger.class));
+
+            invokeBackgroundDownload(plugin);
+
+            assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+            final BundleInfo pending = updater.getBundleInfoByName("2.0.0");
+            assertTrue(pending != null && pending.getStatus() == BundleStatus.PENDING);
+        }
+    }
+
+    @Test
+    public void autoUpdateBackgroundDownloadRejectsWhenSessionKeyMissing() throws Exception {
+        try (
+            MockedStatic<Looper> looperMock = mockStatic(Looper.class);
+            MockedConstruction<Handler> ignored = mockConstruction(Handler.class)
+        ) {
+            looperMock.when(Looper::getMainLooper).thenReturn(mock(Looper.class));
+
+            final ImmediateThreadCordovaUpdaterPlugin plugin = new ImmediateThreadCordovaUpdaterPlugin();
+            final AutoUpdateSessionKeyCapgoUpdater updater = new AutoUpdateSessionKeyCapgoUpdater();
+            updater.setPublicKey(fixturePublicKey);
+
+            plugin.implementation = updater;
+            plugin.setAutoUpdateModeForTesting("onlyDownload");
+            plugin.setLoggerForTesting(mock(Logger.class));
+
+            invokeBackgroundDownload(plugin);
+
+            assertTrue(updater.getSentStatsActions().contains("session_key_required"));
+            assertEquals(null, updater.getBundleInfoByName("2.0.0"));
+        }
+    }
+}