@hot-updater/react-native 0.31.4 → 0.33.0

package/android/build.gradle

@@ -69,6 +69,10 @@ android {
     consumerProguardFiles 'proguard-rules.pro'
     buildConfigField "long", "BUILD_TIMESTAMP", "${System.currentTimeMillis()}L"
 
+    ndk {
+      abiFilters(*reactNativeArchitectures())
+    }
+
     externalNativeBuild {
       cmake {
         arguments "-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON"
@@ -146,7 +150,7 @@ dependencies {
   implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.3"
   implementation "org.apache.commons:commons-compress:1.27.1"
   implementation "com.squareup.okhttp3:okhttp:4.12.0"
-  implementation files('libs/org.brotli.dec-1.2.0.jar')
+  implementation files('libs/hot-updater-brotli-dec-1.2.0.jar')
   testImplementation "junit:junit:4.13.2"
   testImplementation "org.json:json:20240303"
 }

package/android/libs/README.md

@@ -1,6 +1,6 @@
 # Bundled Libraries
 
-## org.brotli.dec-1.2.0.jar
+## hot-updater-brotli-dec-1.2.0.jar
 
 **Why bundled:** The official `org.brotli:dec` package on Maven Central is stuck at v0.1.2 (released May 2017) and contains critical security vulnerabilities. Google has not published newer versions to Maven Central despite releasing v1.2.0 with security fixes.
 
@@ -18,15 +18,28 @@ mvn clean package -DskipTests
 cp target/org.brotli.dec-1.2.0-SNAPSHOT.jar <destination>/org.brotli.dec-1.2.0.jar
 ```
 
+The generated jar is then relocated before being bundled:
+
+```gradle
+relocate "org.brotli.dec", "com.hotupdater.vendor.brotli.dec"
+```
+
+The relocation keeps Hot Updater's security-fixed Brotli decoder isolated from
+apps or frameworks that also depend on `org.brotli:dec`.
+
 **Verification:**
-- **SHA256:** `2d12a2d7fb52fd7f944564fb378aaccd41389cf02ea2e5eb6b3a6477188cced8`
-- **Size:** 97KB
+- **Original SHA256:** `2d12a2d7fb52fd7f944564fb378aaccd41389cf02ea2e5eb6b3a6477188cced8`
+- **Relocated SHA256:** `4e9aee81466e21e365fd291bd29ca0540dc174ce64d29a7613ff336e4276bcdf`
+- **Size:** 99KB
 - **Built:** 2026-02-12
 - **Git Commit:** [028fb5a](https://github.com/google/brotli/commit/028fb5a23661f123017c060daa546b55cf4bde29) (v1.2.0 tag)
+- **Relocated Package:** `com.hotupdater.vendor.brotli.dec`
 
 **API Compatibility:**
-The v1.2.0 decoder is 100% API compatible with v0.1.2. No code changes are required:
-- Same package: `org.brotli.dec`
+The v1.2.0 decoder is API compatible with v0.1.2. Hot Updater imports the
+relocated package internally, so apps can keep their own `org.brotli:dec`
+dependency without duplicate classes:
+- Relocated package: `com.hotupdater.vendor.brotli.dec`
 - Same class: `BrotliInputStream`
 - Same constructor: `BrotliInputStream(InputStream)`
 
@@ -34,4 +47,4 @@ The v1.2.0 decoder is 100% API compatible with v0.1.2. No code changes are requi
 Apache Commons Compress depends on `org.brotli:dec:0.1.2` as an optional dependency, so switching to it would not fix the vulnerability—it would just make it transitive.
 
 **Future Updates:**
-When Google releases new versions of Brotli (e.g., v1.3.0), rebuild this JAR using the same process and update the SHA256 checksum and build date in this file.
+When Google releases new versions of Brotli (e.g., v1.3.0), rebuild this JAR using the same process, relocate it into the Hot Updater vendor package, and update the SHA256 checksum and build date in this file.

package/android/src/main/java/com/hotupdater/BundleFileStorageService.kt

@@ -2,9 +2,9 @@ package com.hotupdater
 
 import android.os.StatFs
 import android.util.Log
+import com.hotupdater.vendor.brotli.dec.BrotliInputStream
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
-import org.brotli.dec.BrotliInputStream
 import org.json.JSONObject
 import java.io.File
 import java.io.FileInputStream
@@ -391,7 +391,7 @@ class BundleFileStorageService(
         }
 
         val sourceDir = activeBundleDir ?: return false
-        val sourceFile = File(sourceDir, assetPath)
+        val sourceFile = RelativePathResolver.resolveInside(sourceDir, assetPath) ?: return false
         if (!sourceFile.exists() || !HashUtils.verifyHash(sourceFile, patch.baseFileHash)) {
             return false
         }
@@ -735,11 +735,15 @@ class BundleFileStorageService(
             if (assetPath !is String) {
                 return null
             }
+            val normalizedAssetPath = RelativePathResolver.normalizeRelativePath(assetPath)
+            if (normalizedAssetPath == null || normalizedAssetPath != assetPath) {
+                return null
+            }
 
             val assetMap = assetValue as? Map<*, *> ?: return null
             val fileHash = assetMap["fileHash"] as? String ?: return null
             val signature = assetMap["signature"] as? String
-            assets[assetPath] =
+            assets[normalizedAssetPath] =
                 ParsedManifestAsset(
                     fileHash = fileHash,
                     signature = signature?.takeIf { it.isNotBlank() },
@@ -1523,7 +1527,9 @@ class BundleFileStorageService(
             val targetEntries = targetManifest.assets.entries.toList()
             targetEntries.forEachIndexed { index, (assetPath, expectedAsset) ->
                 val expectedHash = expectedAsset.fileHash
-                val targetFile = File(tmpDir, assetPath)
+                val targetFile =
+                    RelativePathResolver.resolveInside(tmpDir, assetPath)
+                        ?: throw HotUpdaterException.invalidBundle()
                 val currentAsset = currentManifest?.assets?.get(assetPath)
 
                 if (currentAsset?.fileHash == expectedHash) {
@@ -1532,7 +1538,9 @@ class BundleFileStorageService(
                             ?: throw HotUpdaterException.downloadFailed(
                                 IllegalStateException("Current bundle directory unavailable for reused asset: $assetPath"),
                             )
-                    val sourceFile = File(sourceDir, assetPath)
+                    val sourceFile =
+                        RelativePathResolver.resolveInside(sourceDir, assetPath)
+                            ?: throw HotUpdaterException.invalidBundle()
                     if (!sourceFile.exists() || !HashUtils.verifyHash(sourceFile, expectedHash)) {
                         throw HotUpdaterException.downloadFailed(
                             IllegalStateException("Reusable asset missing or corrupted: $assetPath"),

package/android/src/main/java/com/hotupdater/HotUpdaterImpl.kt

@@ -105,14 +105,7 @@ class HotUpdaterImpl {
          * @return The isolation key in format: HotUpdaterPrefs_{fingerprintOrVersion}_{channel}
          */
         private fun getIsolationKey(context: Context): String {
-            // Get fingerprint hash directly from resources
-            val fingerprintId = StringResourceUtils.getIdentifier(context, "hot_updater_fingerprint_hash")
-            val fingerprintHash =
-                if (fingerprintId != 0) {
-                    context.getString(fingerprintId).takeIf { it.isNotEmpty() }
-                } else {
-                    null
-                }
+            val fingerprintHash = getFingerprintHash(context)
 
             // Get app version and channel
             val appVersion = getAppVersion(context) ?: "unknown"
@@ -147,14 +140,12 @@ class HotUpdaterImpl {
                 null
             }
 
-        fun getChannel(context: Context): String {
-            val id = StringResourceUtils.getIdentifier(context, "hot_updater_channel")
-            return if (id != 0) {
-                context.getString(id).takeIf { it.isNotEmpty() } ?: DEFAULT_CHANNEL
-            } else {
-                DEFAULT_CHANNEL
-            }
-        }
+        fun getChannel(context: Context): String =
+            NativeConfigUtils.getString(
+                context,
+                NativeConfigUtils.CHANNEL_META_DATA_KEY,
+                "hot_updater_channel",
+            ) ?: DEFAULT_CHANNEL
 
         /**
          * Get minimum bundle ID string
@@ -221,28 +212,24 @@ class HotUpdaterImpl {
          * @param context Application context
          * @return The fingerprint hash or null if not set
          */
-        fun getFingerprintHash(context: Context): String? {
-            val id = StringResourceUtils.getIdentifier(context, "hot_updater_fingerprint_hash")
-            return if (id != 0) {
-                context.getString(id).takeIf { it.isNotEmpty() }
-            } else {
-                null
-            }
-        }
+        fun getFingerprintHash(context: Context): String? =
+            NativeConfigUtils.getString(
+                context,
+                NativeConfigUtils.FINGERPRINT_HASH_META_DATA_KEY,
+                "hot_updater_fingerprint_hash",
+            )
     }
 
     /**
      * Gets the current fingerprint hash
      * @return The fingerprint hash or null if not set
      */
-    fun getFingerprintHash(): String? {
-        val id = StringResourceUtils.getIdentifier(context, "hot_updater_fingerprint_hash")
-        return if (id != 0) {
-            context.getString(id).takeIf { it.isNotEmpty() }
-        } else {
-            null
-        }
-    }
+    fun getFingerprintHash(): String? =
+        NativeConfigUtils.getString(
+            context,
+            NativeConfigUtils.FINGERPRINT_HASH_META_DATA_KEY,
+            "hot_updater_fingerprint_hash",
+        )
 
     /**
      * Gets the current update channel
@@ -254,12 +241,11 @@ class HotUpdaterImpl {
             return overriddenChannel
         }
 
-        val id = StringResourceUtils.getIdentifier(context, "hot_updater_channel")
-        return if (id != 0) {
-            context.getString(id).takeIf { it.isNotEmpty() } ?: DEFAULT_CHANNEL
-        } else {
-            DEFAULT_CHANNEL
-        }
+        return NativeConfigUtils.getString(
+            context,
+            NativeConfigUtils.CHANNEL_META_DATA_KEY,
+            "hot_updater_channel",
+        ) ?: DEFAULT_CHANNEL
     }
 
     fun getDefaultChannel(): String = getChannel(context)

package/android/src/main/java/com/hotupdater/NativeConfigUtils.kt

@@ -0,0 +1,62 @@
+package com.hotupdater
+
+import android.content.Context
+import android.content.pm.PackageManager
+import android.os.Build
+
+object NativeConfigUtils {
+    const val CHANNEL_META_DATA_KEY = "com.hotupdater.CHANNEL"
+    const val FINGERPRINT_HASH_META_DATA_KEY = "com.hotupdater.FINGERPRINT_HASH"
+    const val PUBLIC_KEY_META_DATA_KEY = "com.hotupdater.PUBLIC_KEY"
+
+    fun getString(
+        context: Context,
+        metaDataKey: String,
+        stringResourceName: String,
+    ): String? =
+        getManifestMetaDataString(context, metaDataKey)
+            ?: getStringResource(context, stringResourceName)
+
+    private fun getManifestMetaDataString(
+        context: Context,
+        key: String,
+    ): String? =
+        try {
+            val packageManager = context.packageManager
+            val applicationInfo =
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                    packageManager.getApplicationInfo(
+                        context.packageName,
+                        PackageManager.ApplicationInfoFlags.of(PackageManager.GET_META_DATA.toLong()),
+                    )
+                } else {
+                    @Suppress("DEPRECATION")
+                    packageManager.getApplicationInfo(
+                        context.packageName,
+                        PackageManager.GET_META_DATA,
+                    )
+                }
+
+            @Suppress("DEPRECATION")
+            coerceManifestMetaDataString(applicationInfo.metaData?.get(key))
+        } catch (e: Exception) {
+            null
+        }
+
+    internal fun coerceManifestMetaDataString(value: Any?): String? =
+        value
+            ?.toString()
+            ?.takeIf { it.isNotEmpty() }
+
+    private fun getStringResource(
+        context: Context,
+        name: String,
+    ): String? {
+        val id = StringResourceUtils.getIdentifier(context, name)
+        return if (id != 0) {
+            context.getString(id).takeIf { it.isNotEmpty() }
+        } else {
+            null
+        }
+    }
+}

package/android/src/main/java/com/hotupdater/RelativePathResolver.kt

@@ -0,0 +1,41 @@
+package com.hotupdater
+
+import java.io.File
+
+internal object RelativePathResolver {
+    fun normalizeRelativePath(path: String): String? {
+        if (path.isBlank() || path.indexOf('\u0000') >= 0 || path.contains('\\')) {
+            return null
+        }
+
+        if (File(path).isAbsolute || Regex("^[A-Za-z]:").containsMatchIn(path)) {
+            return null
+        }
+
+        val components = path.split("/")
+        if (components.any { it.isEmpty() || it == "." || it == ".." }) {
+            return null
+        }
+
+        return components.joinToString("/")
+    }
+
+    fun resolveInside(
+        root: File,
+        relativePath: String,
+    ): File? {
+        val normalizedPath = normalizeRelativePath(relativePath) ?: return null
+        val file = File(root, normalizedPath)
+        return if (isInside(root, file)) file else null
+    }
+
+    fun isInside(
+        root: File,
+        file: File,
+    ): Boolean {
+        val rootPath = root.canonicalFile.path
+        val filePath = file.canonicalFile.path
+        return filePath == rootPath ||
+            filePath.startsWith("$rootPath${File.separator}")
+    }
+}

package/android/src/main/java/com/hotupdater/SignatureVerifier.kt

@@ -27,7 +27,7 @@ sealed class SignatureVerificationException(
     class PublicKeyNotConfigured :
         SignatureVerificationException(
             "Public key not configured for signature verification. " +
-                "Add 'hot_updater_public_key' to res/values/strings.xml",
+                "Add 'com.hotupdater.PUBLIC_KEY' to AndroidManifest.xml",
         )
 
     class InvalidPublicKeyFormat :
@@ -97,16 +97,15 @@ object SignatureVerifier {
      * @return Public key PEM string or null if not configured
      */
     private fun getPublicKeyFromConfig(context: Context): String? {
-        val resourceId = StringResourceUtils.getIdentifier(context, "hot_updater_public_key")
-
-        if (resourceId == 0) {
-            Log.d(TAG, "hot_updater_public_key not found in strings.xml")
-            return null
-        }
+        val publicKeyPEM =
+            NativeConfigUtils.getString(
+                context,
+                NativeConfigUtils.PUBLIC_KEY_META_DATA_KEY,
+                "hot_updater_public_key",
+            )
 
-        val publicKeyPEM = context.getString(resourceId)
-        if (publicKeyPEM.isEmpty()) {
-            Log.d(TAG, "hot_updater_public_key is empty")
+        if (publicKeyPEM.isNullOrEmpty()) {
+            Log.d(TAG, "com.hotupdater.PUBLIC_KEY is not configured")
             return null
         }
 
@@ -229,7 +228,7 @@ object SignatureVerifier {
         val publicKeyPEM =
             getPublicKeyFromConfig(context)
                 ?: run {
-                    Log.e(TAG, "Cannot verify signature: public key not configured in strings.xml")
+                    Log.e(TAG, "Cannot verify signature: public key not configured")
                     throw SignatureVerificationException.PublicKeyNotConfigured()
                 }
 
@@ -267,7 +266,7 @@ object SignatureVerifier {
         val publicKeyPEM =
             getPublicKeyFromConfig(context)
                 ?: run {
-                    Log.e(TAG, "Cannot verify signature: public key not configured in strings.xml")
+                    Log.e(TAG, "Cannot verify signature: public key not configured")
                     throw SignatureVerificationException.PublicKeyNotConfigured()
                 }
 

package/android/src/main/java/com/hotupdater/TarBrDecompressionStrategy.kt

@@ -1,7 +1,7 @@
 package com.hotupdater
 
 import android.util.Log
-import org.brotli.dec.BrotliInputStream
+import com.hotupdater.vendor.brotli.dec.BrotliInputStream
 import java.io.BufferedInputStream
 import java.io.File
 import java.io.FileInputStream
@@ -72,9 +72,9 @@ class TarBrDecompressionStrategy : DecompressionStrategy {
                             var entry = tarInputStream.getNextEntry()
 
                             while (entry != null) {
-                                val file = File(destinationPath, entry.name)
+                                val file = RelativePathResolver.resolveInside(destinationDir, entry.name)
 
-                                if (!file.canonicalPath.startsWith(destinationDir.canonicalPath)) {
+                                if (file == null) {
                                     Log.w(TAG, "Skipping potentially malicious tar entry: ${entry.name}")
                                     entry = tarInputStream.getNextEntry()
                                     continue

package/android/src/main/java/com/hotupdater/TarGzDecompressionStrategy.kt

@@ -73,9 +73,9 @@ class TarGzDecompressionStrategy : DecompressionStrategy {
                             var entry = tarInputStream.getNextEntry()
 
                             while (entry != null) {
-                                val file = File(destinationPath, entry.name)
+                                val file = RelativePathResolver.resolveInside(destinationDir, entry.name)
 
-                                if (!file.canonicalPath.startsWith(destinationDir.canonicalPath)) {
+                                if (file == null) {
                                     Log.w(TAG, "Skipping potentially malicious tar entry: ${entry.name}")
                                     entry = tarInputStream.getNextEntry()
                                     continue

package/android/src/main/java/com/hotupdater/ZipDecompressionStrategy.kt

@@ -117,21 +117,16 @@ class ZipDecompressionStrategy : DecompressionStrategy {
                     ZipInputStream(bufferedInputStream).use { zipInputStream ->
                         var entry: ZipEntry? = zipInputStream.nextEntry
                         while (entry != null) {
-                            val file = File(destinationPath, entry.name)
-
-                            // Zip Slip vulnerability check - verify entry path is within destination
-                            try {
-                                val canonicalDestPath = destinationDir.canonicalPath
-                                val canonicalFilePath = file.canonicalPath
-
-                                if (!canonicalFilePath.startsWith(canonicalDestPath)) {
-                                    Log.w(TAG, "Skipping potentially malicious zip entry: ${entry.name}")
-                                    entry = zipInputStream.nextEntry
-                                    continue
+                            val file =
+                                try {
+                                    RelativePathResolver.resolveInside(destinationDir, entry.name)
+                                } catch (e: IOException) {
+                                    Log.w(TAG, "Failed to resolve canonical path for zip entry: ${entry.name}", e)
+                                    null
                                 }
-                            } catch (e: IOException) {
-                                // If we can't resolve canonical paths, treat as potentially malicious
-                                Log.w(TAG, "Failed to resolve canonical path for zip entry: ${entry.name}", e)
+
+                            if (file == null) {
+                                Log.w(TAG, "Skipping potentially malicious zip entry: ${entry.name}")
                                 entry = zipInputStream.nextEntry
                                 continue
                             }

package/android/src/test/java/com/hotupdater/BundleFileStorageServiceTest.kt

@@ -12,6 +12,8 @@ import org.junit.Test
 import org.junit.rules.TemporaryFolder
 import java.io.File
 import java.net.URL
+import java.util.zip.ZipEntry
+import java.util.zip.ZipOutputStream
 
 class BundleFileStorageServiceTest {
     @get:Rule
@@ -253,6 +255,41 @@ class BundleFileStorageServiceTest {
         assertTrue(invokeCanUseManifestDrivenInstall(service))
     }
 
+    @Test
+    fun `manifest driven install rejects unsafe asset paths`() {
+        val rootDir = temporaryFolder.newFolder("active-ota-unsafe-manifest")
+        val preferences = InMemoryPreferencesService()
+        val service = createService(rootDir, preferences)
+        val activeDir = createBundleDir(rootDir, "active-bundle")
+        val activeBundleFile = writeFile(activeDir, "index.android.bundle")
+        writeManifest(activeDir, listOf("../active-bundle_evil/index.android.bundle"))
+
+        preferences.setItem("HotUpdaterBundleURL", activeBundleFile.absolutePath)
+
+        assertFalse(invokeCanUseManifestDrivenInstall(service))
+    }
+
+    @Test
+    fun `zip decompression does not write sibling prefix traversal entries`() {
+        val rootDir = temporaryFolder.newFolder("zip-sibling-prefix")
+        val zipFile = File(rootDir, "bundle.zip")
+        ZipOutputStream(zipFile.outputStream()).use { zip ->
+            writeZipEntry(zip, "../bundle-temp_evil/escape.txt", "blocked")
+            writeZipEntry(zip, "safe/kept.txt", "kept")
+        }
+
+        val destinationDir = File(rootDir, "bundle-temp")
+        val extracted =
+            ZipDecompressionStrategy().decompress(
+                zipFile.absolutePath,
+                destinationDir.absolutePath,
+            ) {}
+
+        assertTrue(extracted)
+        assertTrue(File(destinationDir, "safe/kept.txt").isFile)
+        assertFalse(File(rootDir, "bundle-temp_evil/escape.txt").exists())
+    }
+
     private fun createService(
         rootDir: File,
         preferences: InMemoryPreferencesService = InMemoryPreferencesService(),
@@ -313,6 +350,16 @@ class BundleFileStorageServiceTest {
             writeText(content)
         }
 
+    private fun writeZipEntry(
+        zip: ZipOutputStream,
+        path: String,
+        content: String,
+    ) {
+        zip.putNextEntry(ZipEntry(path))
+        zip.write(content.toByteArray())
+        zip.closeEntry()
+    }
+
     private fun bundleStoreDir(rootDir: File): File = File(rootDir, "bundle-store").apply { mkdirs() }
 
     private fun invokeResolveBundleFile(

package/android/src/test/java/com/hotupdater/NativeConfigUtilsTest.kt

@@ -0,0 +1,20 @@
+package com.hotupdater
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class NativeConfigUtilsTest {
+    @Test
+    fun `coerces typed manifest metadata to strings`() {
+        assertEquals("123", NativeConfigUtils.coerceManifestMetaDataString(123))
+        assertEquals("true", NativeConfigUtils.coerceManifestMetaDataString(true))
+        assertEquals("-16711936", NativeConfigUtils.coerceManifestMetaDataString(-16711936))
+    }
+
+    @Test
+    fun `ignores missing and empty manifest metadata`() {
+        assertNull(NativeConfigUtils.coerceManifestMetaDataString(null))
+        assertNull(NativeConfigUtils.coerceManifestMetaDataString(""))
+    }
+}

package/ios/HotUpdater/Internal/ArchiveExtractionUtilities.swift

@@ -84,16 +84,14 @@ enum ArchiveExtractionUtilities {
     }
 
     static func normalizedRelativePath(from rawPath: String) -> String? {
-        var candidate = rawPath
-            .replacingOccurrences(of: "\\", with: "/")
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-
-        while candidate.hasPrefix("/") {
-            candidate.removeFirst()
-        }
-
-        while candidate.hasPrefix("./") {
-            candidate.removeFirst(2)
+        let candidate = rawPath.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !candidate.isEmpty,
+              !candidate.contains("\0"),
+              !candidate.contains("\\"),
+              !candidate.hasPrefix("/"),
+              candidate.range(of: #"^[A-Za-z]:"#, options: .regularExpression) == nil
+        else {
+            return nil
         }
 
         let components = candidate
@@ -104,7 +102,9 @@ enum ArchiveExtractionUtilities {
             return nil
         }
 
-        guard !components.contains(".."), !components.contains(".") else {
+        guard components.count == candidate.split(separator: "/", omittingEmptySubsequences: false).count,
+              !components.contains(".."),
+              !components.contains(".") else {
             return nil
         }
 

package/ios/HotUpdater/Internal/BundleFileStorageService.swift

@@ -556,7 +556,15 @@ class BundleFileStorageService: BundleStorageService {
             return false
         }
 
-        let sourcePath = (currentBundleDir as NSString).appendingPathComponent(assetPath)
+        let sourcePath: String
+        do {
+            sourcePath = try ArchiveExtractionUtilities.extractionURL(
+                for: assetPath,
+                destinationRoot: currentBundleDir
+            ).path
+        } catch {
+            return false
+        }
         guard self.fileSystem.fileExists(atPath: sourcePath),
               HashUtils.verifyHash(
                 fileURL: URL(fileURLWithPath: sourcePath),
@@ -969,6 +977,9 @@ class BundleFileStorageService: BundleStorageService {
 
         var assets: [String: ParsedManifestAsset] = [:]
         for (assetPath, assetValue) in rawAssets {
+            guard ArchiveExtractionUtilities.normalizedRelativePath(from: assetPath) == assetPath else {
+                return nil
+            }
             guard let asset = assetValue as? [String: Any],
                   let fileHash = asset["fileHash"] as? String,
                   !fileHash.isEmpty
@@ -1738,7 +1749,10 @@ class BundleFileStorageService: BundleStorageService {
                 let assetPath = asset.key
                 let expectedAsset = asset.value
                 let expectedHash = expectedAsset.fileHash
-                let destinationPath = (tmpDir as NSString).appendingPathComponent(assetPath)
+                let destinationPath = try ArchiveExtractionUtilities.extractionURL(
+                    for: assetPath,
+                    destinationRoot: tmpDir
+                ).path
                 let destinationDir = (destinationPath as NSString).deletingLastPathComponent
                 guard self.fileSystem.createDirectory(atPath: destinationDir) else {
                     throw BundleStorageError.directoryCreationFailed
@@ -1755,7 +1769,10 @@ class BundleFileStorageService: BundleStorageService {
                         )
                     }
 
-                    let sourcePath = (currentBundleDir as NSString).appendingPathComponent(assetPath)
+                    let sourcePath = try ArchiveExtractionUtilities.extractionURL(
+                        for: assetPath,
+                        destinationRoot: currentBundleDir
+                    ).path
                     guard self.fileSystem.fileExists(atPath: sourcePath),
                           HashUtils.verifyHash(fileURL: URL(fileURLWithPath: sourcePath), expectedHash: expectedHash)
                     else {