@hot-updater/react-native 0.36.3 → 0.36.5

package/android/src/main/java/com/hotupdater/BundleFileStorageService.kt

@@ -547,34 +547,28 @@ class BundleFileStorageService(
         return regex.find(currentUrl)?.groupValues?.get(1)
     }
 
-    private fun resolveBundleFile(bundleDir: File): File? {
-        val manifest = readManifestFromBundleDir(bundleDir)
-        val manifestBundlePath =
-            (manifest?.get("assets") as? Map<*, *>)
-                ?.keys
-                ?.mapNotNull { key ->
-                    (key as? String)
-                        ?.trim()
-                        ?.takeIf { it.isNotEmpty() }
-                        ?.takeIf { File(it).name.endsWith(".android.bundle") }
-                }?.singleOrNull()
-
-        if (manifestBundlePath != null) {
-            try {
-                val canonicalBundleDir = bundleDir.canonicalFile
-                val canonicalBundleFile = File(bundleDir, manifestBundlePath).canonicalFile
-                val canonicalBundleDirPath = canonicalBundleDir.path
-                val canonicalBundleFilePath = canonicalBundleFile.path
-                val isWithinBundleDir =
-                    canonicalBundleFilePath == canonicalBundleDirPath ||
-                        canonicalBundleFilePath.startsWith("$canonicalBundleDirPath${File.separator}")
-
-                if (isWithinBundleDir && canonicalBundleFile.isFile) {
-                    return canonicalBundleFile
-                }
-            } catch (e: Exception) {
-                Log.w(TAG, "Failed to resolve manifest bundle file from ${bundleDir.absolutePath}: ${e.message}")
+    private fun resolveBundleFile(
+        bundleDir: File,
+        expectedBundleId: String? = null,
+    ): File? {
+        val manifestFile = File(bundleDir, "manifest.json")
+        if (manifestFile.exists()) {
+            val manifest = parseBundleManifestFromFile(manifestFile) ?: return null
+            if (expectedBundleId != null && manifest.bundleId != expectedBundleId) {
+                return null
             }
+
+            val resolvedAssets =
+                manifest.assets.keys.associateWith { assetPath ->
+                    RelativePathResolver
+                        .resolveInside(bundleDir, assetPath)
+                        ?.takeIf { it.isFile }
+                        ?: return null
+                }
+            return resolvedAssets
+                .filterKeys { assetPath -> File(assetPath).name.endsWith(".android.bundle") }
+                .values
+                .singleOrNull()
         }
 
         return File(bundleDir, "index.android.bundle").absoluteFile.takeIf { it.isFile }
@@ -582,7 +576,7 @@ class BundleFileStorageService(
 
     private fun findBundleFile(bundleId: String): File? {
         val bundleDir = File(getBundleStoreDir(), bundleId)
-        return resolveBundleFile(bundleDir)
+        return resolveBundleFile(bundleDir, bundleId)
     }
 
     private fun getBundleUrlForId(bundleId: String): String? = findBundleFile(bundleId)?.absolutePath
@@ -1090,15 +1084,21 @@ class BundleFileStorageService(
             return null
         }
 
-        val file = File(urlString)
-        val exists = file.exists()
-        Log.d(TAG, "getCachedBundleURL: file exists = $exists at path: $urlString")
-        if (!exists) {
+        val cachedBundleId = extractBundleIdFromCurrentURL()
+        val resolvedBundle = cachedBundleId?.let(::findBundleFile)
+        val isValid =
+            if (cachedBundleId == null) {
+                File(urlString).isFile
+            } else {
+                resolvedBundle != null
+            }
+        Log.d(TAG, "getCachedBundleURL: cached bundle valid = $isValid at path: $urlString")
+        if (!isValid) {
             preferences.setItem("HotUpdaterBundleURL", null)
-            Log.d(TAG, "getCachedBundleURL: file doesn't exist, cleared preference")
+            Log.d(TAG, "getCachedBundleURL: cached bundle is invalid, cleared preference")
             return null
         }
-        return urlString
+        return resolvedBundle?.absolutePath ?: urlString
     }
 
     override fun getFallbackBundleURL(): String = "assets://index.android.bundle"
@@ -1180,7 +1180,7 @@ class BundleFileStorageService(
         val finalBundleDir = File(bundleStoreDir, bundleId)
         if (finalBundleDir.exists()) {
             Log.d(TAG, "Bundle for bundleId $bundleId already exists. Using cached bundle.")
-            val existingBundleFile = resolveBundleFile(finalBundleDir)
+            val existingBundleFile = resolveBundleFile(finalBundleDir, bundleId)
             if (existingBundleFile != null) {
                 // Update last modified time
                 finalBundleDir.setLastModified(System.currentTimeMillis())
@@ -1364,7 +1364,7 @@ class BundleFileStorageService(
                     }
 
                     // 4) Resolve the extracted Android bundle file.
-                    val extractedBundleFile = resolveBundleFile(tmpDir)
+                    val extractedBundleFile = resolveBundleFile(tmpDir, bundleId)
                     if (extractedBundleFile == null) {
                         Log.d("BundleStorage", "Android bundle file could not be resolved in tmpDir.")
                         tempDir.deleteRecursively()
@@ -1403,7 +1403,7 @@ class BundleFileStorageService(
                     }
 
                     // 8) Verify the Android bundle file exists inside finalBundleDir.
-                    val finalBundleFile = resolveBundleFile(finalBundleDir)
+                    val finalBundleFile = resolveBundleFile(finalBundleDir, bundleId)
                     if (finalBundleFile == null) {
                         Log.d("BundleStorage", "Android bundle file could not be resolved in realDir.")
                         tempDir.deleteRecursively()

package/android/src/main/java/com/hotupdater/RelativePathResolver.kt

@@ -12,7 +12,8 @@ internal object RelativePathResolver {
             return null
         }
 
-        val components = path.split("/")
+        // Archive directory entries conventionally end with one slash.
+        val components = path.removeSuffix("/").split("/")
         if (components.any { it.isEmpty() || it == "." || it == ".." }) {
             return null
         }

package/android/src/main/java/com/hotupdater/TarArchiveInputStream.kt

@@ -13,7 +13,7 @@ class TarArchiveInputStream(
 ) : InputStream() {
     private var currentEntry: TarArchiveEntry? = null
     private var currentEntryBytesRead: Long = 0
-    private var longName: String? = null
+    private var pendingName: String? = null
 
     companion object {
         private const val TAG = "TarInputStream"
@@ -73,14 +73,20 @@ class TarArchiveInputStream(
 
             // Handle GNU long filename extension
             if (entry.typeFlag == 'L') {
-                longName = readLongName(entry.size)
+                pendingName = readLongName(entry.size)
                 continue
             }
 
-            // Apply long name if present
-            if (longName != null) {
-                entry.name = longName!!
-                longName = null
+            // Handle POSIX PAX extended header
+            if (entry.typeFlag == 'x') {
+                readPaxPath(entry.size)?.let { pendingName = it }
+                continue
+            }
+
+            // Apply extended name if present
+            if (pendingName != null) {
+                entry.name = pendingName!!
+                pendingName = null
             }
 
             // Validate entry
@@ -306,6 +312,95 @@ class TarArchiveInputStream(
         return String(nameBytes, 0, nameLength, Charsets.UTF_8)
     }
 
+    /**
+     * Read the path attribute from a POSIX PAX extended header.
+     * Record lengths are measured in bytes and include the length itself.
+     */
+    private fun readPaxPath(size: Long): String? {
+        if (size < 0 || size > MAX_FILE_SIZE) {
+            throw SecurityException("Invalid PAX header size: $size")
+        }
+
+        val data = ByteArray(size.toInt())
+        var bytesRead = 0
+        while (bytesRead < data.size) {
+            val count = input.read(data, bytesRead, data.size - bytesRead)
+            if (count < 0) throw EOFException("Unexpected end reading PAX header")
+            bytesRead += count
+        }
+        skipPadding(size)
+
+        var offset = 0
+        var path: String? = null
+        while (offset < data.size) {
+            val space = findByte(data, ' '.code.toByte(), offset, data.size)
+            if (space <= offset) throw IOException("Invalid PAX record length")
+
+            val recordLength = parsePaxRecordLength(data, offset, space)
+            if (recordLength <= 0 || recordLength > data.size - offset) {
+                throw IOException("Invalid PAX record length: $recordLength")
+            }
+
+            val recordEnd = offset + recordLength
+            if (recordEnd <= space + 2 || data[recordEnd - 1] != '\n'.code.toByte()) {
+                throw IOException("Invalid PAX record")
+            }
+
+            val valueEnd = recordEnd - 1
+            val equals = findByte(data, '='.code.toByte(), space + 1, valueEnd)
+            if (equals <= space + 1) throw IOException("Invalid PAX record")
+
+            val key =
+                String(
+                    data,
+                    space + 1,
+                    equals - space - 1,
+                    Charsets.UTF_8,
+                )
+            if (key == "path") {
+                path =
+                    String(
+                        data,
+                        equals + 1,
+                        valueEnd - equals - 1,
+                        Charsets.UTF_8,
+                    )
+            }
+
+            offset = recordEnd
+        }
+
+        return path
+    }
+
+    private fun parsePaxRecordLength(
+        bytes: ByteArray,
+        start: Int,
+        end: Int,
+    ): Int {
+        var result = 0
+        for (index in start until end) {
+            val digit = bytes[index].toInt() - '0'.code
+            if (digit !in 0..9 || result > (Int.MAX_VALUE - digit) / 10) {
+                throw IOException("Invalid PAX record length")
+            }
+            result = result * 10 + digit
+        }
+        return result
+    }
+
+    private fun findByte(
+        bytes: ByteArray,
+        value: Byte,
+        start: Int,
+        end: Int,
+    ): Int {
+        for (index in start until end) {
+            if (bytes[index] == value) return index
+        }
+        return -1
+    }
+
     /**
      * Skip padding to 512-byte boundary
      */

package/android/src/test/java/com/hotupdater/BundleFileStorageServiceTest.kt

@@ -48,29 +48,29 @@ class BundleFileStorageServiceTest {
     }
 
     @Test
-    fun `resolveBundleFile falls back to root index when manifest has no android bundle candidate`() {
+    fun `resolveBundleFile rejects a manifest with missing assets even when root index exists`() {
         val rootDir = temporaryFolder.newFolder("no-android-candidate")
         val service = createService(rootDir)
         val bundleDir = createBundleDir(rootDir, "bundle-no-candidate")
-        val fallbackBundleFile = writeFile(bundleDir, "index.android.bundle")
+        writeFile(bundleDir, "index.android.bundle")
 
         writeManifest(bundleDir, listOf("index.ios.bundle", "assets/image.png"))
 
-        assertResolvedBundlePath(service, bundleDir, fallbackBundleFile)
+        assertNull(invokeResolveBundleFile(service, bundleDir))
     }
 
     @Test
-    fun `resolveBundleFile falls back to root index when manifest has multiple android bundle candidates`() {
+    fun `resolveBundleFile rejects a manifest with multiple android bundle candidates`() {
         val rootDir = temporaryFolder.newFolder("multiple-android-candidates")
         val service = createService(rootDir)
         val bundleDir = createBundleDir(rootDir, "bundle-multiple-candidates")
-        val fallbackBundleFile = writeFile(bundleDir, "index.android.bundle")
+        writeFile(bundleDir, "index.android.bundle")
 
         writeFile(bundleDir, "foo.android.bundle")
         writeFile(bundleDir, "dist/bar.android.bundle")
         writeManifest(bundleDir, listOf("foo.android.bundle", "dist/bar.android.bundle"))
 
-        assertResolvedBundlePath(service, bundleDir, fallbackBundleFile)
+        assertNull(invokeResolveBundleFile(service, bundleDir))
     }
 
     @Test
@@ -122,7 +122,14 @@ class BundleFileStorageServiceTest {
         val service = createService(rootDir, preferences)
 
         val stagingDir = createBundleDir(rootDir, "staging-bundle")
-        writeManifest(stagingDir, listOf("dist/missing.android.bundle"))
+        writeFile(stagingDir, "dist/staging.android.bundle")
+        writeManifest(
+            stagingDir,
+            listOf(
+                "dist/staging.android.bundle",
+                "assets/missing.png",
+            ),
+        )
 
         val stableDir = createBundleDir(rootDir, "stable-bundle")
         val stableBundleFile = writeFile(stableDir, "dist/stable.android.bundle")
@@ -141,7 +148,7 @@ class BundleFileStorageServiceTest {
         val selection = service.prepareLaunch(null)
         val report = service.notifyAppReady()
 
-        assertEquals(stableBundleFile.canonicalFile.absolutePath, selection.bundleUrl)
+        assertEquals(stableBundleFile.absolutePath, selection.bundleUrl)
         assertEquals(stableDir.name, selection.launchedBundleId)
         assertFalse(selection.shouldRollbackOnCrash)
         assertFalse(stagingDir.exists())
@@ -153,7 +160,7 @@ class BundleFileStorageServiceTest {
         assertEquals(stableDir.name, metadata?.stagingBundleId)
         assertNull(metadata?.stableBundleId)
         assertFalse(metadata?.verificationPending ?: true)
-        assertEquals(stableBundleFile.canonicalFile.absolutePath, preferences.getItem("HotUpdaterBundleURL"))
+        assertEquals(stableBundleFile.absolutePath, preferences.getItem("HotUpdaterBundleURL"))
     }
 
     @Test
@@ -416,9 +423,10 @@ class BundleFileStorageServiceTest {
             BundleFileStorageService::class.java.getDeclaredMethod(
                 "resolveBundleFile",
                 File::class.java,
+                String::class.java,
             )
         method.isAccessible = true
-        return method.invoke(service, bundleDir) as File?
+        return method.invoke(service, bundleDir, bundleDir.name) as File?
     }
 
     private fun invokeCanUseManifestDrivenInstall(service: BundleFileStorageService): Boolean {

package/android/src/test/java/com/hotupdater/RelativePathResolverTest.kt

@@ -0,0 +1,41 @@
+package com.hotupdater
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Rule
+import org.junit.Test
+import org.junit.rules.TemporaryFolder
+import java.io.File
+
+class RelativePathResolverTest {
+    @get:Rule
+    val temporaryFolder = TemporaryFolder()
+
+    @Test
+    fun `resolves a standard archive directory entry ending in a slash`() {
+        val root = temporaryFolder.root
+
+        val resolved = RelativePathResolver.resolveInside(root, "drawable-mdpi/")
+
+        assertEquals(
+            File(root, "drawable-mdpi").canonicalFile,
+            resolved?.canonicalFile,
+        )
+    }
+
+    @Test
+    fun `rejects unsafe archive directory paths ending in a slash`() {
+        val root = temporaryFolder.root
+        val unsafePaths =
+            listOf(
+                "/",
+                "../",
+                "drawable-mdpi/../",
+                "drawable-mdpi//",
+            )
+
+        unsafePaths.forEach { path ->
+            assertNull(path, RelativePathResolver.resolveInside(root, path))
+        }
+    }
+}

package/android/src/test/java/com/hotupdater/TarArchiveInputStreamTest.kt

@@ -0,0 +1,68 @@
+package com.hotupdater
+
+import org.apache.commons.compress.archivers.tar.TarArchiveOutputStream
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertThrows
+import org.junit.Test
+import java.io.ByteArrayInputStream
+import java.io.ByteArrayOutputStream
+import org.apache.commons.compress.archivers.tar.TarArchiveEntry as CommonsTarArchiveEntry
+
+class TarArchiveInputStreamTest {
+    @Test
+    fun `reads a long basename from a POSIX PAX header`() {
+        val path = "raw/${"long-name-".repeat(14)}asset.bmp"
+        val contents = "pax asset".toByteArray()
+        val archive = createPaxArchive(path, contents)
+
+        TarArchiveInputStream(ByteArrayInputStream(archive)).use { tar ->
+            val entry = tar.getNextEntry()
+
+            assertEquals(path, entry?.name)
+            assertArrayEquals(contents, tar.readBytes())
+            assertNull(tar.getNextEntry())
+        }
+    }
+
+    @Test
+    fun `rejects path traversal from a POSIX PAX header`() {
+        val path = "../${"long-name-".repeat(14)}asset.bmp"
+        val archive =
+            createPaxArchive(
+                path = path,
+                contents = "malicious".toByteArray(),
+                headerPath = "safe.bmp",
+            )
+
+        val error =
+            assertThrows(SecurityException::class.java) {
+                TarArchiveInputStream(ByteArrayInputStream(archive)).use { tar ->
+                    tar.getNextEntry()
+                }
+            }
+
+        assertEquals("Path traversal detected: $path", error.message)
+    }
+
+    private fun createPaxArchive(
+        path: String,
+        contents: ByteArray,
+        headerPath: String = path,
+    ): ByteArray {
+        val output = ByteArrayOutputStream()
+        TarArchiveOutputStream(output).use { tar ->
+            tar.setLongFileMode(TarArchiveOutputStream.LONGFILE_POSIX)
+            val entry =
+                CommonsTarArchiveEntry(headerPath).apply {
+                    size = contents.size.toLong()
+                    if (path != headerPath) addPaxHeader("path", path)
+                }
+            tar.putArchiveEntry(entry)
+            tar.write(contents)
+            tar.closeArchiveEntry()
+        }
+        return output.toByteArray()
+    }
+}

package/ios/HotUpdater/Internal/BundleFileStorageService.swift

@@ -1141,7 +1141,10 @@ class BundleFileStorageService: BundleStorageService {
         let fallbackBundleId = metadata.stableBundleId.flatMap { candidate in
             if case .success(let storeDir) = bundleStoreDir() {
                 let stableBundleDir = (storeDir as NSString).appendingPathComponent(candidate)
-                if case .success(let bundlePath) = findBundleFile(in: stableBundleDir), bundlePath != nil {
+                if case .success(let bundlePath) = findBundleFile(
+                    in: stableBundleDir,
+                    expectedBundleId: candidate
+                ), bundlePath != nil {
                     return candidate
                 }
             }
@@ -1163,7 +1166,10 @@ class BundleFileStorageService: BundleStorageService {
         if let fallbackBundleId,
            case .success(let storeDir) = bundleStoreDir() {
             let fallbackBundleDir = (storeDir as NSString).appendingPathComponent(fallbackBundleId)
-            if case .success(let bundlePath) = findBundleFile(in: fallbackBundleDir), let bundlePath {
+            if case .success(let bundlePath) = findBundleFile(
+                in: fallbackBundleDir,
+                expectedBundleId: fallbackBundleId
+            ), let bundlePath {
                 let _ = setBundleURL(localPath: bundlePath)
             }
         } else {
@@ -1278,9 +1284,45 @@ class BundleFileStorageService: BundleStorageService {
      * @param directoryPath Directory to search in
      * @return Result with path to bundle file or error
      */
-    func findBundleFile(in directoryPath: String) -> Result<String?, Error> {
+    func findBundleFile(
+        in directoryPath: String,
+        expectedBundleId: String? = nil
+    ) -> Result<String?, Error> {
         NSLog("[BundleStorage] Searching for bundle file in directory: \(directoryPath)")
 
+        let manifestPath = (directoryPath as NSString).appendingPathComponent("manifest.json")
+        if fileSystem.fileExists(atPath: manifestPath) {
+            guard let manifest = readManifest(in: directoryPath),
+                  let parsedManifest = parseBundleManifest(from: manifest),
+                  expectedBundleId == nil || parsedManifest.bundleId == expectedBundleId else {
+                return .success(nil)
+            }
+
+            do {
+                var bundlePaths: [String] = []
+                for assetPath in parsedManifest.assets.keys {
+                    let assetURL = try ArchiveExtractionUtilities.extractionURL(
+                        for: assetPath,
+                        destinationRoot: directoryPath
+                    )
+                    guard fileSystem.fileExists(atPath: assetURL.path),
+                          let attributes = try? fileSystem.attributesOfItem(atPath: assetURL.path),
+                          attributes[.type] as? FileAttributeType == .typeRegular else {
+                        return .success(nil)
+                    }
+
+                    let fileName = assetURL.lastPathComponent
+                    if fileName.hasSuffix(".bundle") || fileName == "main.jsbundle" {
+                        bundlePaths.append(assetURL.path)
+                    }
+                }
+
+                return .success(bundlePaths.count == 1 ? bundlePaths[0] : nil)
+            } catch {
+                return .failure(error)
+            }
+        }
+
         let iosBundlePath = (directoryPath as NSString).appendingPathComponent("index.ios.bundle")
         if self.fileSystem.fileExists(atPath: iosBundlePath) {
             NSLog("[BundleStorage] Found iOS bundle atPath: \(iosBundlePath)")
@@ -1421,12 +1463,39 @@ class BundleFileStorageService: BundleStorageService {
      */
     func getCachedBundleURL() -> URL? {
         do {
-            guard let savedURLString = try self.preferences.getItem(forKey: "HotUpdaterBundleURL"),
-                  let bundleURL = URL(string: savedURLString),
-                  self.fileSystem.fileExists(atPath: bundleURL.path) else {
+            guard let savedURLString = try self.preferences.getItem(forKey: "HotUpdaterBundleURL") else {
+                return nil
+            }
+
+            let savedURL = URL(string: savedURLString)
+            let bundleURL = (
+                (savedURL?.isFileURL == true ? savedURL : nil)
+                    ?? URL(fileURLWithPath: savedURLString)
+            ).standardizedFileURL
+            guard self.fileSystem.fileExists(atPath: bundleURL.path),
+                  case .success(let storeDir) = bundleStoreDir() else {
+                return nil
+            }
+
+            let storeURL = URL(fileURLWithPath: storeDir, isDirectory: true).standardizedFileURL
+            let storePrefix = storeURL.path + "/"
+            guard bundleURL.path.hasPrefix(storePrefix),
+                  let bundleId = bundleURL.path
+                    .dropFirst(storePrefix.count)
+                    .split(separator: "/")
+                    .first
+                    .map(String.init) else {
+                return nil
+            }
+
+            let bundleDirectory = storeURL.appendingPathComponent(bundleId).path
+            guard case .success(let resolvedBundlePath) = findBundleFile(
+                in: bundleDirectory,
+                expectedBundleId: bundleId
+            ), let resolvedBundlePath else {
                 return nil
             }
-            return bundleURL
+            return URL(fileURLWithPath: resolvedBundlePath)
         } catch {
             NSLog("[BundleStorage] Error getting cached bundle URL: \(error.localizedDescription)")
             return nil
@@ -1454,7 +1523,10 @@ class BundleFileStorageService: BundleStorageService {
         if let stagingId = metadata.stagingBundleId,
            case .success(let storeDir) = bundleStoreDir() {
             let stagingBundleDir = (storeDir as NSString).appendingPathComponent(stagingId)
-            if case .success(let bundlePath) = findBundleFile(in: stagingBundleDir), let bundlePath {
+            if case .success(let bundlePath) = findBundleFile(
+                in: stagingBundleDir,
+                expectedBundleId: stagingId
+            ), let bundlePath {
                 return LaunchSelection(
                     bundleURL: URL(fileURLWithPath: bundlePath),
                     launchedBundleId: stagingId,
@@ -1470,7 +1542,10 @@ class BundleFileStorageService: BundleStorageService {
         if let stableId = metadata.stableBundleId,
            case .success(let storeDir) = bundleStoreDir() {
             let stableBundleDir = (storeDir as NSString).appendingPathComponent(stableId)
-            if case .success(let bundlePath) = findBundleFile(in: stableBundleDir), let bundlePath {
+            if case .success(let bundlePath) = findBundleFile(
+                in: stableBundleDir,
+                expectedBundleId: stableId
+            ), let bundlePath {
                 return LaunchSelection(
                     bundleURL: URL(fileURLWithPath: bundlePath),
                     launchedBundleId: stableId,
@@ -1552,7 +1627,10 @@ class BundleFileStorageService: BundleStorageService {
             let finalBundleDir = (storeDir as NSString).appendingPathComponent(bundleId)
             
             if self.fileSystem.fileExists(atPath: finalBundleDir) {
-                let findResult = self.findBundleFile(in: finalBundleDir)
+                let findResult = self.findBundleFile(
+                    in: finalBundleDir,
+                    expectedBundleId: bundleId
+                )
                 switch findResult {
                 case .success(let existingBundlePath):
                     if let bundlePath = existingBundlePath {
@@ -1969,7 +2047,7 @@ class BundleFileStorageService: BundleStorageService {
             let manifestDestination = (tmpDir as NSString).appendingPathComponent("manifest.json")
             try writeManifestFile(targetManifest, to: manifestDestination)
 
-            switch self.findBundleFile(in: tmpDir) {
+            switch self.findBundleFile(in: tmpDir, expectedBundleId: bundleId) {
             case .success(let maybeBundlePath):
                 guard let bundlePathInTmp = maybeBundlePath else {
                     throw BundleStorageError.invalidBundle
@@ -2289,7 +2367,7 @@ class BundleFileStorageService: BundleStorageService {
                 progressHandler: progressHandler,
                 progress: UpdateProgress.bundleValidation
             )
-            switch self.findBundleFile(in: tmpDir) {
+            switch self.findBundleFile(in: tmpDir, expectedBundleId: bundleId) {
             case .success(let maybeBundlePath):
                 if let bundlePathInTmp = maybeBundlePath {
                     NSLog("[BundleStorage] Found valid bundle in tmpDir: \(bundlePathInTmp)")

package/lib/commonjs/sdkVersion.js

@@ -4,5 +4,5 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.HOT_UPDATER_SDK_VERSION = void 0;
-const HOT_UPDATER_SDK_VERSION = exports.HOT_UPDATER_SDK_VERSION = "0.36.3";
+const HOT_UPDATER_SDK_VERSION = exports.HOT_UPDATER_SDK_VERSION = "0.36.5";
 //# sourceMappingURL=sdkVersion.js.map

package/lib/module/sdkVersion.js

@@ -1,4 +1,4 @@
 "use strict";
 
-export const HOT_UPDATER_SDK_VERSION = "0.36.3";
+export const HOT_UPDATER_SDK_VERSION = "0.36.5";
 //# sourceMappingURL=sdkVersion.js.map

package/lib/typescript/commonjs/sdkVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const HOT_UPDATER_SDK_VERSION = "0.36.3";
+export declare const HOT_UPDATER_SDK_VERSION = "0.36.5";
 //# sourceMappingURL=sdkVersion.d.ts.map

package/lib/typescript/module/sdkVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const HOT_UPDATER_SDK_VERSION = "0.36.3";
+export declare const HOT_UPDATER_SDK_VERSION = "0.36.5";
 //# sourceMappingURL=sdkVersion.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/react-native",
-  "version": "0.36.3",
+  "version": "0.36.5",
   "description": "React Native OTA solution for self-hosted",
   "source": "./src/index.ts",
   "main": "./lib/commonjs/index.js",
@@ -131,14 +131,14 @@
     "react-native-builder-bob": "0.41.0",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "hot-updater": "0.36.3"
+    "hot-updater": "0.36.5"
   },
   "dependencies": {
     "use-sync-external-store": "1.5.0",
-    "@hot-updater/cli-tools": "0.36.3",
-    "@hot-updater/js": "0.36.3",
-    "@hot-updater/core": "0.36.3",
-    "@hot-updater/plugin-core": "0.36.3"
+    "@hot-updater/cli-tools": "0.36.5",
+    "@hot-updater/js": "0.36.5",
+    "@hot-updater/core": "0.36.5",
+    "@hot-updater/plugin-core": "0.36.5"
   },
   "scripts": {
     "build": "node ./scripts/sync-sdk-version.mjs run -- bob build && tsc -p plugin/tsconfig.build.json",

package/src/sdkVersion.ts

@@ -1 +1 @@
-export const HOT_UPDATER_SDK_VERSION = "0.36.3";
+export const HOT_UPDATER_SDK_VERSION = "0.36.5";