@exodus/react-native-bundle-loader 0.2.0-exodus.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Jusbrasil
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,107 @@
+# @exodus/react-native-bundle-loader
+
+Loads a remote React Native JS bundle, with optional **hash-pinned integrity verification** before the bridge reloads.
+
+> This is the Exodus security-hardened fork of [`react-native-bundle-loader`](https://www.npmjs.com/package/react-native-bundle-loader)
+> (originally by Jusbrasil; upstream GitHub repo deleted; see [provenance](#provenance) for details).
+
+## Threat model
+
+Loading a remote JS bundle is, by construction, remote code execution inside the host app. **This library is intended for internal/development builds only — do not ship it in store builds without an out-of-band, statically-stripped feature flag.** See `SECURITY.md`.
+
+The `loadVerified()` API closes the dominant runtime risk: it fetches the bundle bytes itself, hashes them with `@exodus/crypto`, compares the hash to a caller-supplied digest in constant time, and only then asks the bridge to reload from the verified bytes. Anything that mutates the response between fetch and reload is rejected.
+
+## Installation
+
+```sh
+yarn add @exodus/react-native-bundle-loader
+```
+
+iOS:
+
+```sh
+cd ios && pod install
+```
+
+Android: `BundleLoaderPackage` is autolinked.
+
+## Usage
+
+### Verified loading (recommended)
+
+```ts
+import BundleLoader from '@exodus/react-native-bundle-loader';
+
+await BundleLoader.loadVerified(
+  'https://bundles.example.com/main.jsbundle',
+  // Lower-case hex sha256, exactly 64 chars
+  '4f1b9c…ec'
+);
+```
+
+Behavior:
+
+- The URL must use the `https:` scheme.
+- The expected sha256 must be a 64-character hex string.
+- The bytes are fetched, hashed in JS using `@exodus/crypto/hash`, and compared to the expected hash with a constant-time comparison.
+- On match, the bytes are written to the platform's app-private cache (iOS: `NSTemporaryDirectory()` with `NSDataWritingFileProtectionComplete`; Android: `Context.getCacheDir()`) and the bridge is reloaded from the local file path.
+- On mismatch, an error is thrown and the bridge is left untouched.
+
+Works on iOS and Android. The hash check happens in JS before any native call, so the integrity contract is identical on both platforms.
+
+### Unverified loading
+
+```ts
+BundleLoader.load('https://bundles.example.com/main.jsbundle');
+```
+
+Functionally identical to the upstream `load()`: passes the URL straight through to the native bridge, which fetches and reloads. **This skips integrity verification — only use it for developer ergonomics, never in production paths.**
+
+The URL is required to use `https:`.
+
+### `BundlePrompt`
+
+A `Modal`-wrapped text input + Reload button intended for developer UX. The default URL field is **empty** (the upstream's hardcoded jsdelivr default has been removed). The button calls the unverified `load()` path.
+
+```tsx
+import { BundlePrompt } from '@exodus/react-native-bundle-loader';
+```
+
+Do not render `BundlePrompt` in store builds.
+
+## Accessing a running Metro packager
+
+Same idea as upstream: expose your local Metro packager via a tunnel (e.g. `ngrok http 8081`) and call `BundleLoader.load(<https tunnel URL>)`. Required Metro query params:
+
+- `dev`: `true` or `false` matching how the binary was built
+- `excludeSource`: `true`
+- `platform`: `ios` or `android` matching the host
+
+Example: `https://example.ngrok.io/index.bundle?dev=false&platform=ios&excludeSource=true`
+
+## Platform support
+
+| Capability                  | iOS | Android |
+| --------------------------- | --- | ------- |
+| `load(url)`                 | ✅  | ✅      |
+| `loadVerified(url, sha256)` | ✅  | ✅      |
+| `runningMode()`             | ✅  | ✅      |
+
+### How the in-process swap works
+
+- **iOS** writes the bundle to `NSTemporaryDirectory()` and sets the bridge's `bundleURL` via KVC (`[bridge setValue:url forKey:@"bundleURL"]`), then calls `[bridge reload]`.
+- **Android** writes the bundle to `Context.getCacheDir()`, builds a `JSBundleLoader.createFileLoader(path)`, swaps it into the private `mBundleLoader` field on `ReactInstanceManager` via reflection, and calls `recreateReactContextInBackground()`.
+
+Both mechanisms touch private/internal React Native surface and could break on a major RN upgrade. See `SECURITY.md`. The Android implementation requires the host app to implement `ReactApplication` (the standard React Native template does).
+
+## Provenance
+
+This is a fork of `react-native-bundle-loader@0.1.0` originally published by Jusbrasil (2020-10-21, npm publisher `helielson`, commit `ec3d4520`). The upstream GitHub repo at `github.com/jusbrasil/react-native-bundle-loader` was subsequently deleted. The complete original git history is preserved through the v0.1.0 release commit; the Android implementation was contributed by `milad.bagherii@digikala.com` in the `mldb/react-native-bundle-loader` mirror in 2021.
+
+## Security
+
+See `SECURITY.md` for the threat model, accepted residual risks, and disclosure procedure.
+
+## License
+
+MIT

package/SECURITY.md

@@ -0,0 +1,57 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Email `security@exodus.com`. We will acknowledge within 2 business days. Do not file a public GitHub issue for security reports.
+
+## Threat model
+
+This library exists to load and execute a remote JavaScript bundle inside the host React Native app. That is, by construction, **a remote code execution primitive** with the host app's full bridge surface. Two consequences:
+
+1. The library has no business in a store-distributed binary unless protected by a build-flavor flag that is statically stripped (not just runtime-gated). A leaked release build with this library reachable is equivalent to a leaked signing key.
+2. Any defense the library offers is layered on top of that fundamental risk. It does not eliminate it.
+
+## What this fork hardens vs. upstream
+
+| Surface                                     | Upstream `0.1.0`                                        | This fork                                                                                                                          |
+| ------------------------------------------- | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| Bundle integrity                            | None — bridge fetches whatever the URL serves           | `loadVerified(url, sha256)` fetches bytes in JS, hashes with `@exodus/crypto`, compares constant-time, only then reloads from disk |
+| `BundlePrompt` default URL                  | Hardcoded `cdn.jsdelivr.net/gh/jusbrasil/...` (deleted) | Empty — operator must type a URL                                                                                                   |
+| Scheme enforcement                          | None — accepts `http://`, `file://`, etc.               | `https://` required at the JS boundary; native iOS `load:` re-checks                                                               |
+| Verified bundle on-disk protection (iOS)    | n/a                                                     | Written with `NSDataWritingFileProtectionComplete`                                                                                 |
+| Lockfile                                    | Not shipped                                             | `yarn.lock` committed; `.yarnrc` enforces `--frozen-lockfile`                                                                      |
+| Dependency version pinning                  | Carets (`^`)                                            | All direct deps pinned to exact versions; `.npmrc` `save-exact=true`                                                               |
+| Maven `+` on `react-native`                 | Yes                                                     | Configurable via `rootProject.ext.reactNativeVersion`; default `+` is the only fallback                                            |
+| Maven `jcenter()`                           | In repo list                                            | Removed (sunset 2021)                                                                                                              |
+| Husky 4 auto-postinstall                    | Yes                                                     | Husky removed entirely                                                                                                             |
+| `release-it` publishing                     | Yes                                                     | Removed; releases are manual `npm publish` after `yarn preflight` passes                                                           |
+| Eclipse / Xcode user-state in repo          | Committed                                               | Removed and gitignored                                                                                                             |
+| Source maps shipped to npm                  | Yes (`lib/**/*.map`)                                    | Excluded via `files` array; tarball denied by `verify-pack` if any reappear                                                        |
+| Tarball contents                            | Anything matching `files` blanket globs                 | Strict `.npm-tarball-allowlist` exact-match enforced by `yarn verify-pack`                                                         |
+| `example/public/ios.min.js` (700kB blob)    | Committed; served from jsdelivr to any `BundlePrompt`   | Removed along with the rest of `example/`                                                                                          |
+| CircleCI / Node 10 build container          | `.circleci/config.yml` shipped                          | Removed                                                                                                                            |
+
+## Accepted residual risks
+
+- **The bridge `bundleURL` setter is a KVC write** on iOS (`[bridge setValue:url forKey:@"bundleURL"]`) to a non-public RN property. Behavior could change on an RN upgrade and silently no-op the loader.
+- **The Android bundle swap reflects on a private field.** `ReactInstanceManager.mBundleLoader` has no public setter, so we use `Field.setAccessible(true)` to install a fresh `JSBundleLoader.createFileLoader(...)` before calling `recreateReactContextInBackground()`. The field name has been stable across RN 0.62–0.74 but is not part of the public API; an RN upgrade could rename or remove it, in which case `loadVerified`/`load` will throw `NoSuchFieldException` rather than silently no-op.
+- **`@exodus/crypto/hash` runs in JS on the JS thread.** Bundles are typically a few MB; hashing time is acceptable. We deliberately keep hashing in JS so the threat-model contract — "Exodus crypto verifies, and the verified bytes are what we hand to native" — is auditable in TypeScript and identical on iOS and Android.
+- **`timingSafeEqual()` is currently inlined** as a small constant-time XOR loop. The threat model anticipates this moving to a future `@exodus/crypto` export. The inlined version is functionally equivalent and lives in `src/index.tsx`.
+
+## Release process
+
+This package has no CI/CD. Maintainers cut releases manually from a developer machine:
+
+```sh
+yarn preflight   # lint + typecheck + test + verify-pack
+npm publish --access public
+```
+
+`yarn verify-pack` runs `npm pack` and diffs the resulting tarball file list against `.npm-tarball-allowlist`. Any deviation (extra files, missing files, renames) fails the script. Adding a new shippable file to the package requires updating `.npm-tarball-allowlist` in the same commit so the change is reviewable.
+
+The npm publish credential lives on the publishing maintainer's machine. There is no shared CI token, and no GitHub Actions workflow holds publish rights. The trust boundary is whoever has `npm login` access to `@exodus`.
+
+## Out of scope
+
+- The host app's CI pipeline that mints the deep links carrying `(url, sha256)` pairs is **not** covered by this library. Threats #1, #5, #6, #7, #8 in the originating threat model are the consuming app's responsibility.
+- Bundle code review and signing are out of scope. This library verifies *what was hashed by your CI* matches *what the device fetched*. It cannot tell you that the bundle does not contain malicious JS.

package/android/build.gradle

@@ -0,0 +1,119 @@
+buildscript {
+  repositories {
+    google()
+    mavenCentral()
+  }
+
+  dependencies {
+    classpath 'com.android.tools.build:gradle:7.4.2'
+  }
+}
+
+apply plugin: 'com.android.library'
+
+def getExtOrDefault(name) {
+  return rootProject.ext.has(name) ? rootProject.ext.get(name) : project.properties['BundleLoader_' + name]
+}
+
+def getExtOrIntegerDefault(name) {
+  return rootProject.ext.has(name) ? rootProject.ext.get(name) : (project.properties['BundleLoader_' + name]).toInteger()
+}
+
+android {
+  compileSdkVersion getExtOrIntegerDefault('compileSdkVersion')
+  buildToolsVersion getExtOrDefault('buildToolsVersion')
+  defaultConfig {
+    minSdkVersion 24
+    targetSdkVersion getExtOrIntegerDefault('targetSdkVersion')
+    versionCode 1
+    versionName "1.0"
+  }
+  buildTypes {
+    release {
+      minifyEnabled false
+    }
+  }
+  lintOptions {
+    disable 'GradleCompatible'
+  }
+  compileOptions {
+    sourceCompatibility JavaVersion.VERSION_11
+    targetCompatibility JavaVersion.VERSION_11
+  }
+}
+
+repositories {
+  google()
+  mavenCentral()
+
+  def found = false
+  def defaultDir = null
+  def androidSourcesName = 'React Native sources'
+
+  if (rootProject.ext.has('reactNativeAndroidRoot')) {
+    defaultDir = rootProject.ext.get('reactNativeAndroidRoot')
+  } else {
+    defaultDir = new File(
+            projectDir,
+            '/../../../node_modules/react-native/android'
+    )
+  }
+
+  if (defaultDir.exists()) {
+    maven {
+      url defaultDir.toString()
+      name androidSourcesName
+    }
+
+    logger.info(":${project.name}:reactNativeAndroidRoot ${defaultDir.canonicalPath}")
+    found = true
+  } else {
+    def parentDir = rootProject.projectDir
+
+    1.upto(5, {
+      if (found) return true
+      parentDir = parentDir.parentFile
+
+      def androidSourcesDir = new File(
+              parentDir,
+              'node_modules/react-native'
+      )
+
+      def androidPrebuiltBinaryDir = new File(
+              parentDir,
+              'node_modules/react-native/android'
+      )
+
+      if (androidPrebuiltBinaryDir.exists()) {
+        maven {
+          url androidPrebuiltBinaryDir.toString()
+          name androidSourcesName
+        }
+
+        logger.info(":${project.name}:reactNativeAndroidRoot ${androidPrebuiltBinaryDir.canonicalPath}")
+        found = true
+      } else if (androidSourcesDir.exists()) {
+        maven {
+          url androidSourcesDir.toString()
+          name androidSourcesName
+        }
+
+        logger.info(":${project.name}:reactNativeAndroidRoot ${androidSourcesDir.canonicalPath}")
+        found = true
+      }
+    })
+  }
+
+  if (!found) {
+    throw new GradleException(
+            "${project.name}: unable to locate React Native android sources. " +
+                    "Ensure you have you installed React Native as a dependency in your project and try again."
+    )
+  }
+}
+
+def reactNativeArtifactVersion = rootProject.ext.has('reactNativeVersion') ? rootProject.ext.get('reactNativeVersion') : '+'
+
+dependencies {
+  api "com.facebook.react:react-native:${reactNativeArtifactVersion}"
+}

package/android/gradle.properties

@@ -0,0 +1,3 @@
+BundleLoader_compileSdkVersion=33
+BundleLoader_buildToolsVersion=33.0.2
+BundleLoader_targetSdkVersion=33

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,4 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          package="com.reactnativebundleloader">
+
+</manifest>

package/android/src/main/java/com/reactnativebundleloader/BundleLoaderModule.java

@@ -0,0 +1,152 @@
+package com.reactnativebundleloader;
+
+import android.util.Base64;
+import android.util.Log;
+
+import androidx.annotation.NonNull;
+
+import com.facebook.react.ReactApplication;
+import com.facebook.react.ReactInstanceManager;
+import com.facebook.react.bridge.JSBundleLoader;
+import com.facebook.react.bridge.Promise;
+import com.facebook.react.bridge.ReactApplicationContext;
+import com.facebook.react.bridge.ReactContextBaseJavaModule;
+import com.facebook.react.bridge.ReactMethod;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.lang.reflect.Field;
+import java.net.HttpURLConnection;
+import java.net.URL;
+
+public class BundleLoaderModule extends ReactContextBaseJavaModule {
+
+  private static final String TAG = "BundleLoader";
+  private static final String BUNDLE_FILENAME = "verified-bundle.jsbundle";
+  private static final int CONNECT_TIMEOUT_MS = 30_000;
+  private static final int READ_TIMEOUT_MS = 30_000;
+  private static final int MAX_BUNDLE_BYTES = 64 * 1024 * 1024;
+
+  private static volatile boolean remoteLoaded = false;
+
+  BundleLoaderModule(ReactApplicationContext context) {
+    super(context);
+  }
+
+  @NonNull
+  @Override
+  public String getName() {
+    return "BundleLoader";
+  }
+
+  @ReactMethod
+  public void load(final String url) {
+    if (url == null || !url.startsWith("https://")) {
+      Log.e(TAG, "Bundle URL must use the https scheme");
+      return;
+    }
+    new Thread(new Runnable() {
+      @Override
+      public void run() {
+        try {
+          File bundleFile = downloadToCache(url);
+          swapBundleLoaderAndReload(bundleFile);
+        } catch (Exception e) {
+          Log.e(TAG, "load(" + url + ") failed", e);
+        }
+      }
+    }, "BundleLoader-load").start();
+  }
+
+  @ReactMethod
+  public void loadFromBase64(String base64, Promise promise) {
+    try {
+      byte[] data = Base64.decode(base64, Base64.DEFAULT);
+      if (data == null || data.length == 0) {
+        promise.reject("E_INVALID_BASE64", "Invalid base64 input");
+        return;
+      }
+      File bundleFile = new File(
+          getReactApplicationContext().getCacheDir(),
+          BUNDLE_FILENAME
+      );
+      try (FileOutputStream out = new FileOutputStream(bundleFile)) {
+        out.write(data);
+      }
+      swapBundleLoaderAndReload(bundleFile);
+      promise.resolve(null);
+    } catch (Exception e) {
+      promise.reject("E_LOAD_FAILED", e.getMessage(), e);
+    }
+  }
+
+  @ReactMethod
+  public void runningMode(Promise promise) {
+    promise.resolve(remoteLoaded ? "REMOTE" : "LOCAL");
+  }
+
+  private File downloadToCache(String urlString) throws IOException {
+    URL url = new URL(urlString);
+    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+    conn.setConnectTimeout(CONNECT_TIMEOUT_MS);
+    conn.setReadTimeout(READ_TIMEOUT_MS);
+    // Disallow follow-redirects so an HTTPS URL cannot transparently downgrade to HTTP.
+    conn.setInstanceFollowRedirects(false);
+    try {
+      int code = conn.getResponseCode();
+      if (code != HttpURLConnection.HTTP_OK) {
+        throw new IOException("Bundle fetch failed: HTTP " + code);
+      }
+      File file = new File(
+          getReactApplicationContext().getCacheDir(),
+          BUNDLE_FILENAME
+      );
+      long total = 0;
+      try (InputStream in = conn.getInputStream();
+           FileOutputStream out = new FileOutputStream(file)) {
+        byte[] buf = new byte[8192];
+        int n;
+        while ((n = in.read(buf)) != -1) {
+          total += n;
+          if (total > MAX_BUNDLE_BYTES) {
+            throw new IOException(
+                "Bundle exceeds " + MAX_BUNDLE_BYTES + " bytes"
+            );
+          }
+          out.write(buf, 0, n);
+        }
+      }
+      return file;
+    } finally {
+      conn.disconnect();
+    }
+  }
+
+  private void swapBundleLoaderAndReload(File bundleFile) throws Exception {
+    ReactApplication app = (ReactApplication)
+        getReactApplicationContext().getApplicationContext();
+    final ReactInstanceManager instanceManager =
+        app.getReactNativeHost().getReactInstanceManager();
+
+    JSBundleLoader bundleLoader =
+        JSBundleLoader.createFileLoader(bundleFile.getAbsolutePath());
+
+    // mBundleLoader is private on ReactInstanceManager and there is no public
+    // setter. The host app's ReactNativeHost wires the initial loader at
+    // construction; we swap it in-place so the next reload picks up our file.
+    Field field = ReactInstanceManager.class.getDeclaredField("mBundleLoader");
+    field.setAccessible(true);
+    field.set(instanceManager, bundleLoader);
+
+    remoteLoaded = true;
+
+    getReactApplicationContext().runOnUiQueueThread(new Runnable() {
+      @Override
+      public void run() {
+        instanceManager.recreateReactContextInBackground();
+      }
+    });
+  }
+}

package/android/src/main/java/com/reactnativebundleloader/BundleLoaderPackage.java

@@ -0,0 +1,31 @@
+package com.reactnativebundleloader;
+
+
+import com.facebook.react.ReactApplication;
+import com.facebook.react.ReactPackage;
+import com.facebook.react.bridge.NativeModule;
+import com.facebook.react.bridge.ReactApplicationContext;
+import com.facebook.react.uimanager.ViewManager;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+public class BundleLoaderPackage implements ReactPackage {
+
+  @Override
+  public List<ViewManager> createViewManagers(ReactApplicationContext reactContext) {
+    return Collections.emptyList();
+  }
+
+  @Override
+  public List<NativeModule> createNativeModules(
+    ReactApplicationContext reactContext) {
+    List<NativeModule> modules = new ArrayList<>();
+
+    modules.add(new BundleLoaderModule(reactContext));
+
+    return modules;
+  }
+
+}

package/ios/BundleLoader.h

@@ -0,0 +1,6 @@
+#import <React/RCTBridgeModule.h>
+#import <React/RCTRootView.h>
+
+@interface BundleLoader : NSObject <RCTBridgeModule>
+
+@end

package/ios/BundleLoader.m

@@ -0,0 +1,61 @@
+#import "BundleLoader.h"
+
+@implementation BundleLoader
+
+@synthesize bridge = _bridge;
+
+RCT_EXPORT_MODULE()
+
+- (void)setBundleURLAndReload:(NSURL *)url
+{
+  [_bridge setValue:url forKey:@"bundleURL"];
+  [_bridge reload];
+}
+
+RCT_EXPORT_METHOD(runningMode:(RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+{
+  NSString *scheme = [[_bridge bundleURL] scheme];
+  BOOL isRemote = [scheme isEqualToString:@"https"];
+  resolve(isRemote ? @"REMOTE" : @"LOCAL");
+}
+
+RCT_EXPORT_METHOD(load:(NSURL *)url)
+{
+  if (![[url scheme] isEqualToString:@"https"]) {
+    return;
+  }
+  dispatch_async(dispatch_get_main_queue(), ^{
+    [self setBundleURLAndReload:url];
+  });
+}
+
+RCT_EXPORT_METHOD(loadFromBase64:(NSString *)base64
+                  resolver:(RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+{
+  NSData *data = [[NSData alloc] initWithBase64EncodedString:base64
+                                                     options:0];
+  if (data == nil) {
+    reject(@"E_INVALID_BASE64", @"Invalid base64 input", nil);
+    return;
+  }
+
+  NSString *path = [NSTemporaryDirectory()
+      stringByAppendingPathComponent:@"verified-bundle.jsbundle"];
+  NSError *err = nil;
+  if (![data writeToFile:path
+                options:NSDataWritingAtomic | NSDataWritingFileProtectionComplete
+                  error:&err]) {
+    reject(@"E_WRITE_FAILED", err.localizedDescription, err);
+    return;
+  }
+
+  NSURL *fileURL = [NSURL fileURLWithPath:path];
+  dispatch_async(dispatch_get_main_queue(), ^{
+    [self setBundleURLAndReload:fileURL];
+    resolve(nil);
+  });
+}
+
+@end