@dynamic-labs/react-native-extension 4.91.5 → 4.92.0

package/android/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.

package/android/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.

package/android/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.

package/android/java/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.

package/android/main/java/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.

package/android/src/main/java/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.

package/android/xyz/dynamic/embeddedwebview/EmbeddedWebViewController.kt

@@ -24,7 +24,7 @@ import org.json.JSONObject
 import java.util.UUID
 
 private const val SCRIPT_HANDLER_NAME = "DynamicEmbeddedWebView"
-private const val NAVIGATION_DECISION_TIMEOUT_MS = 2000L
+private const val NAVIGATION_DECISION_TIMEOUT_MS = 5000L
 
 // Singleton owning the in-app overlay view that hosts the WebView.
 // Mirrors EmbeddedWebViewController on iOS.

package/index.cjs

@@ -35,7 +35,7 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var version = "4.91.5";
+var version = "4.92.0";
 
 function _extends() {
   return _extends = Object.assign ? Object.assign.bind() : function (n) {
@@ -1002,6 +1002,7 @@ const setupEmbeddedWebView = ({
   let recoveryTimer = null;
   let hasFailed = false;
   let hasEmittedSuccessLog = false;
+  let tornDown = false;
   const clearLoadingTimer = () => {
     if (loadingTimer !== null) {
       clearTimeout(loadingTimer);
@@ -1023,6 +1024,7 @@ const setupEmbeddedWebView = ({
     hasFailed = true;
     clearLoadingTimer();
     clearRecoveryTimer();
+    logger.debug(`[EmbeddedWebView] raiseFailure phase=${phase}`);
     const meta = phaseTimers.getMeta({
       phase
     });
@@ -1064,6 +1066,7 @@ const setupEmbeddedWebView = ({
   const handleSdkReady = message => {
     if (message.origin !== 'webview') return;
     if (message.type !== webviewMessages.sdkHasLoadedEventName) return;
+    logger.debug('[EmbeddedWebView] SDK ready signal received');
     clearRecoveryTimer();
     if (hasEmittedSuccessLog || hasFailed) return;
     hasEmittedSuccessLog = true;
@@ -1099,11 +1102,13 @@ const setupEmbeddedWebView = ({
       isTopFrame: event.isTopFrame,
       url: event.url
     }, builtUrl);
+    logger.debug(`[EmbeddedWebView] onShouldStartLoad id=${event.id} url=${event.url} isTopFrame=${event.isTopFrame} allow=${allow}`);
     native.respondToShouldStartLoad(event.id, allow).catch(err => {
       logger.warn('EmbeddedWebView.respondToShouldStartLoad failed', err);
     });
   });
   const onLoadStartSub = native.addListener('onLoadStart', () => {
+    logger.debug('[EmbeddedWebView] onLoadStart');
     phaseTimers.recordEvent('load_start');
     // Re-arm both timers on every load_start. A retry from the native
     // side (e.g. a redirect, or a reload after a transient failure)
@@ -1116,10 +1121,12 @@ const setupEmbeddedWebView = ({
     }, _loadingTimeoutMs);
   });
   const onLoadSub = native.addListener('onLoad', () => {
+    logger.debug('[EmbeddedWebView] onLoad (response committed)');
     phaseTimers.recordEvent('load');
     clearLoadingTimer();
   });
   const onLoadEndSub = native.addListener('onLoadEnd', () => {
+    logger.debug('[EmbeddedWebView] onLoadEnd (page finished)');
     phaseTimers.recordEvent('load_end');
     clearLoadingTimer();
     clearRecoveryTimer();
@@ -1128,6 +1135,7 @@ const setupEmbeddedWebView = ({
     }, _recoveryTimeoutMs);
   });
   const onLoadErrorSub = native.addListener('onLoadError', event => {
+    logger.debug(`[EmbeddedWebView] onLoadError domain=${event.domain} code=${event.code} url=${event.url}`);
     phaseTimers.recordEvent('native_error');
     logger.warn('EmbeddedWebView load error', event);
     raiseFailure('embedded_native_error', {
@@ -1147,13 +1155,28 @@ const setupEmbeddedWebView = ({
   // without emitting onLoadError — leaving onLoadStart (and therefore the
   // timer) never triggered. The onLoadStart handler clears and re-arms this
   // timer when it fires, so behaviour after onLoadStart is unchanged.
+  logger.debug(`[EmbeddedWebView] arming loading timer (${_loadingTimeoutMs}ms) before setUrl`);
   loadingTimer = setTimeout(() => {
+    logger.debug('[EmbeddedWebView] loading timer fired — raising html_load failure');
     raiseFailure('html_load');
   }, _loadingTimeoutMs);
-  native.setUrl(builtUrl.toString()).catch(err => {
-    logger.warn('EmbeddedWebView.setUrl failed', err);
-  });
+  // Defer setUrl by one event-loop tick so the JS thread has fully settled
+  // after listener registration. On cold boot the main thread is congested
+  // with bundle evaluation — yielding here gives pending microtasks and
+  // native bridge batches a chance to flush before the native side starts
+  // firing navigation events that require a JS round-trip response.
+  const warmupTimer = setTimeout(() => {
+    var _a;
+    if (tornDown) return;
+    logger.debug(`[EmbeddedWebView] calling setUrl: ${builtUrl.toString()}`);
+    (_a = native.setUrl(builtUrl.toString())) === null || _a === void 0 ? void 0 : _a.catch(err => {
+      logger.warn('EmbeddedWebView.setUrl failed', err);
+    });
+  }, 0);
   return () => {
+    logger.debug('[EmbeddedWebView] teardown — removing listeners');
+    tornDown = true;
+    clearTimeout(warmupTimer);
     clearLoadingTimer();
     clearRecoveryTimer();
     removeVisibilityHandler();
@@ -1312,6 +1335,20 @@ const setupPlatformHandler = core => {
     fileName,
     mimeType
   }) {
+    /**
+     * Sanitize the caller-provided fileName to prevent path traversal
+     * (CWE-22). The fileName is used to build a path inside the app cache
+     * directory, so a value containing path separators or `..` segments
+     * could escape the cache directory and delete/overwrite arbitrary files
+     * in the app sandbox. Reject anything that is not a plain basename:
+     * empty, `.`/`..`, or containing `/` or `\` (any `..` segment within a
+     * path is caught by the separator checks). Reducing to the basename here
+     * would silently write attacker-chosen data under a different name, so we
+     * reject instead.
+     */
+    if (!fileName || fileName === '.' || fileName === '..' || fileName.includes('/') || fileName.includes('\\')) {
+      throw new Error(`Invalid fileName: ${fileName}`);
+    }
     /**
      * Because this is an iOS and Android only package, we need to import
      * dynamically to avoid react-native-web build errors.

package/index.js

@@ -13,7 +13,7 @@ import { createURL, getInitialURL, addEventListener, openURL } from 'expo-linkin
 import { openAuthSessionAsync } from 'expo-web-browser';
 import { createPasskey, PasskeyStamper } from '@turnkey/react-native-passkey-stamper';
 
-var version = "4.91.5";
+var version = "4.92.0";
 
 function _extends() {
   return _extends = Object.assign ? Object.assign.bind() : function (n) {
@@ -980,6 +980,7 @@ const setupEmbeddedWebView = ({
   let recoveryTimer = null;
   let hasFailed = false;
   let hasEmittedSuccessLog = false;
+  let tornDown = false;
   const clearLoadingTimer = () => {
     if (loadingTimer !== null) {
       clearTimeout(loadingTimer);
@@ -1001,6 +1002,7 @@ const setupEmbeddedWebView = ({
     hasFailed = true;
     clearLoadingTimer();
     clearRecoveryTimer();
+    logger.debug(`[EmbeddedWebView] raiseFailure phase=${phase}`);
     const meta = phaseTimers.getMeta({
       phase
     });
@@ -1042,6 +1044,7 @@ const setupEmbeddedWebView = ({
   const handleSdkReady = message => {
     if (message.origin !== 'webview') return;
     if (message.type !== sdkHasLoadedEventName) return;
+    logger.debug('[EmbeddedWebView] SDK ready signal received');
     clearRecoveryTimer();
     if (hasEmittedSuccessLog || hasFailed) return;
     hasEmittedSuccessLog = true;
@@ -1077,11 +1080,13 @@ const setupEmbeddedWebView = ({
       isTopFrame: event.isTopFrame,
       url: event.url
     }, builtUrl);
+    logger.debug(`[EmbeddedWebView] onShouldStartLoad id=${event.id} url=${event.url} isTopFrame=${event.isTopFrame} allow=${allow}`);
     native.respondToShouldStartLoad(event.id, allow).catch(err => {
       logger.warn('EmbeddedWebView.respondToShouldStartLoad failed', err);
     });
   });
   const onLoadStartSub = native.addListener('onLoadStart', () => {
+    logger.debug('[EmbeddedWebView] onLoadStart');
     phaseTimers.recordEvent('load_start');
     // Re-arm both timers on every load_start. A retry from the native
     // side (e.g. a redirect, or a reload after a transient failure)
@@ -1094,10 +1099,12 @@ const setupEmbeddedWebView = ({
     }, _loadingTimeoutMs);
   });
   const onLoadSub = native.addListener('onLoad', () => {
+    logger.debug('[EmbeddedWebView] onLoad (response committed)');
     phaseTimers.recordEvent('load');
     clearLoadingTimer();
   });
   const onLoadEndSub = native.addListener('onLoadEnd', () => {
+    logger.debug('[EmbeddedWebView] onLoadEnd (page finished)');
     phaseTimers.recordEvent('load_end');
     clearLoadingTimer();
     clearRecoveryTimer();
@@ -1106,6 +1113,7 @@ const setupEmbeddedWebView = ({
     }, _recoveryTimeoutMs);
   });
   const onLoadErrorSub = native.addListener('onLoadError', event => {
+    logger.debug(`[EmbeddedWebView] onLoadError domain=${event.domain} code=${event.code} url=${event.url}`);
     phaseTimers.recordEvent('native_error');
     logger.warn('EmbeddedWebView load error', event);
     raiseFailure('embedded_native_error', {
@@ -1125,13 +1133,28 @@ const setupEmbeddedWebView = ({
   // without emitting onLoadError — leaving onLoadStart (and therefore the
   // timer) never triggered. The onLoadStart handler clears and re-arms this
   // timer when it fires, so behaviour after onLoadStart is unchanged.
+  logger.debug(`[EmbeddedWebView] arming loading timer (${_loadingTimeoutMs}ms) before setUrl`);
   loadingTimer = setTimeout(() => {
+    logger.debug('[EmbeddedWebView] loading timer fired — raising html_load failure');
     raiseFailure('html_load');
   }, _loadingTimeoutMs);
-  native.setUrl(builtUrl.toString()).catch(err => {
-    logger.warn('EmbeddedWebView.setUrl failed', err);
-  });
+  // Defer setUrl by one event-loop tick so the JS thread has fully settled
+  // after listener registration. On cold boot the main thread is congested
+  // with bundle evaluation — yielding here gives pending microtasks and
+  // native bridge batches a chance to flush before the native side starts
+  // firing navigation events that require a JS round-trip response.
+  const warmupTimer = setTimeout(() => {
+    var _a;
+    if (tornDown) return;
+    logger.debug(`[EmbeddedWebView] calling setUrl: ${builtUrl.toString()}`);
+    (_a = native.setUrl(builtUrl.toString())) === null || _a === void 0 ? void 0 : _a.catch(err => {
+      logger.warn('EmbeddedWebView.setUrl failed', err);
+    });
+  }, 0);
   return () => {
+    logger.debug('[EmbeddedWebView] teardown — removing listeners');
+    tornDown = true;
+    clearTimeout(warmupTimer);
     clearLoadingTimer();
     clearRecoveryTimer();
     removeVisibilityHandler();
@@ -1290,6 +1313,20 @@ const setupPlatformHandler = core => {
     fileName,
     mimeType
   }) {
+    /**
+     * Sanitize the caller-provided fileName to prevent path traversal
+     * (CWE-22). The fileName is used to build a path inside the app cache
+     * directory, so a value containing path separators or `..` segments
+     * could escape the cache directory and delete/overwrite arbitrary files
+     * in the app sandbox. Reject anything that is not a plain basename:
+     * empty, `.`/`..`, or containing `/` or `\` (any `..` segment within a
+     * path is caught by the separator checks). Reducing to the basename here
+     * would silently write attacker-chosen data under a different name, so we
+     * reject instead.
+     */
+    if (!fileName || fileName === '.' || fileName === '..' || fileName.includes('/') || fileName.includes('\\')) {
+      throw new Error(`Invalid fileName: ${fileName}`);
+    }
     /**
      * Because this is an iOS and Android only package, we need to import
      * dynamically to avoid react-native-web build errors.

package/ios/EmbeddedWebViewController.swift

@@ -2,7 +2,7 @@ import UIKit
 import WebKit
 
 private let scriptHandlerName = "dynamicEmbeddedWebView"
-private let navigationDecisionTimeout: TimeInterval = 2.0
+private let navigationDecisionTimeout: TimeInterval = 5.0
 
 // Cleartext http is only permitted in debug builds (e.g. Metro at
 // http://localhost:4202). Release builds reject http top-frame and sub-frame
@@ -366,6 +366,17 @@ extension EmbeddedWebViewController: WKNavigationDelegate {
         if let handler = self.pendingNavigationDecisions.removeValue(forKey: id) {
           self.navigationTimers.removeValue(forKey: id)?.invalidate()
           handler(.cancel)
+          // Surface an explicit load error so the SDK's error path runs
+          // immediately instead of waiting for the 20 s html_load timer.
+          // Matches Android's EmbeddedWebViewNavigationTimeout behavior.
+          let timeoutMs = Int(navigationDecisionTimeout * 1000)
+          self.eventEmitter?("onLoadError", [
+            "url": url,
+            "code": -1,
+            "domain": "EmbeddedWebViewNavigationTimeout",
+            "description": "Navigation decision timed out after \(timeoutMs)ms",
+            "isProvisional": true,
+          ])
         }
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamic-labs/react-native-extension",
-  "version": "4.91.5",
+  "version": "4.92.0",
   "main": "./index.cjs",
   "module": "./index.js",
   "types": "./src/index.d.ts",
@@ -18,11 +18,11 @@
     "@turnkey/react-native-passkey-stamper": "1.2.7",
     "@react-native-documents/picker": "^11.0.0",
     "react-native-fs": ">=2.20.0",
-    "@dynamic-labs/assert-package-version": "4.91.5",
-    "@dynamic-labs/client": "4.91.5",
-    "@dynamic-labs/logger": "4.91.5",
-    "@dynamic-labs/message-transport": "4.91.5",
-    "@dynamic-labs/webview-messages": "4.91.5"
+    "@dynamic-labs/assert-package-version": "4.92.0",
+    "@dynamic-labs/client": "4.92.0",
+    "@dynamic-labs/logger": "4.92.0",
+    "@dynamic-labs/message-transport": "4.92.0",
+    "@dynamic-labs/webview-messages": "4.92.0"
   },
   "peerDependencies": {
     "react": ">=18.0.0 <20.0.0",