@onekeyfe/react-native-bundle-crypto 3.0.157-alpha.251 → 3.0.157-alpha.254

package/README.md

@@ -2,6 +2,8 @@
 
 react-native-bundle-crypto
 
+[Native behavior specification](docs/SPEC.md)
+
 ## Installation
 
 ```sh

package/ReactNativeBundleCrypto.podspec

@@ -18,6 +18,7 @@ Pod::Spec.new do |s|
     "ios/**/*.{m,mm}",
     "cpp/**/*.{hpp,cpp}",
   ]
+  s.exclude_files = "ios/tests/**/*"
 
   # Vendored Gopenpgp framework: GPG cleartext/detached signature verification.
   # This is the single in-tree copy used by bundle-crypto and by modules that
@@ -32,4 +33,8 @@ Pod::Spec.new do |s|
   add_nitrogen_files(s)
 
   install_modules_dependencies(s)
+
+  s.test_spec "Tests" do |test_spec|
+    test_spec.source_files = "ios/tests/**/*.swift"
+  end
 end

package/android/build.gradle

@@ -133,4 +133,6 @@ dependencies {
   // react-native-app-update (the modules this security logic was migrated from).
   implementation "org.bouncycastle:bcpg-jdk15to18:1.78.1"
   implementation "org.bouncycastle:bcprov-jdk15to18:1.78.1"
+
+  testImplementation "junit:junit:4.13.2"
 }

package/android/src/main/java/com/margelo/nitro/reactnativebundlecrypto/BundleCryptoCore.kt

@@ -391,8 +391,14 @@ object BundleCryptoCore {
       return false
     }
     val jsBundleDir = dir.absolutePath + "/"
+    val resolvedDir = try { dir.canonicalFile.toPath() } catch (e: Exception) { return false }
     val expected = HashMap<String, String>()
-    for (entry in entries) expected[entry.relativePath] = entry.sha256
+    for (entry in entries) {
+      if (entry.relativePath.isEmpty() || File(entry.relativePath).isAbsolute) return false
+      val resolvedFile = try { File(dir, entry.relativePath).canonicalFile.toPath() } catch (e: Exception) { return false }
+      if (resolvedFile == resolvedDir || !resolvedFile.startsWith(resolvedDir)) return false
+      expected[entry.relativePath] = entry.sha256
+    }
 
     if (!validateFilesRecursive(dir, expected, jsBundleDir)) return false
 

package/android/src/test/java/com/margelo/nitro/nativelogger/OneKeyLog.kt

@@ -0,0 +1,10 @@
+package com.margelo.nitro.nativelogger
+
+// Host-JVM test fixture: keep the production crypto core and BouncyCastle real
+// while avoiding the production logger's Android/Nitro JNI initialization.
+object OneKeyLog {
+  @JvmStatic
+  fun error(tag: String, message: String) = Unit
+  @JvmStatic
+  fun info(tag: String, message: String) = Unit
+}

package/android/src/test/java/com/margelo/nitro/reactnativebundlecrypto/BundleCryptoCoreTest.kt

@@ -0,0 +1,135 @@
+package com.margelo.nitro.reactnativebundlecrypto
+
+import java.io.File
+import java.nio.file.Files
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.rules.TemporaryFolder
+
+class BundleCryptoCoreTest {
+  @get:Rule val temporaryFolder = TemporaryFolder()
+
+  private val expectedSignedHash = "2ada9c871104fc40649fa3de67a7d8e33faadc18e9abd587e8bb85be0a003eba"
+
+  // Existing release-key test vector, also used by BundleUpdate.testVerification.
+  private val signedMetadata = """-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+{
+  "fileName": "metadata.json",
+  "sha256": "2ada9c871104fc40649fa3de67a7d8e33faadc18e9abd587e8bb85be0a003eba",
+  "size": 158590,
+  "generatedAt": "2025-09-19T07:49:13.000Z"
+}
+-----BEGIN PGP SIGNATURE-----
+
+iQJCBAEBCAAsFiEE62iuVE8f3YzSZGJPs2mmepC/OHsFAmjNJ1IOHGRldkBvbmVr
+ZXkuc28ACgkQs2mmepC/OHs6Rw/9FKHl5aNsE7V0IsFf/l+h16BYKFwVsL69alMk
+CFLna8oUn0+tyECF6wKBKw5pHo5YR27o2pJfYbAER6dygDF6WTZ1lZdf5QcBMjGA
+LCeXC0hzUBzSSOH4bKBTa3fHp//HdSV1F2OnkymbXqYN7WXvuQPLZ0nV6aU88hCk
+HgFifcvkXAnWKoosUtj0Bban/YBRyvmQ5C2akxUPEkr4Yck1QXwzJeNRd7wMXHjH
+JFK6lJcuABiB8wpJDXJkFzKs29pvHIK2B2vdOjU2rQzKOUwaKHofDi5C4+JitT2b
+2pSeYP3PAxXYw6XDOmKTOiC7fPnfLjtcPjNYNFCezVKZT6LKvZW9obnW8Q9LNJ4W
+okMPgHObkabv3OqUaTA9QNVfI/X9nvggzlPnaKDUrDWTf7n3vlrdexugkLtV/tJA
+uguPlI5hY7Ue5OW7ckWP46hfmq1+UaIdeUY7dEO+rPZDz6KcArpaRwBiLPBhneIr
+/X3KuMzS272YbPbavgCZGN9xJR5kZsEQE5HhPCbr6Nf0qDnh+X8mg0tAB/U6F+ZE
+o90sJL1ssIaYvST+VWVaGRr4V5nMDcgHzWSF9Q/wm22zxe4alDaBdvOlUseW0iaM
+n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
+91Js0rQ=
+=A/Ii
+-----END PGP SIGNATURE-----"""
+
+  @Test
+  fun signedMetadataRejectsChangedBodyAndUnsignedInput() {
+    val tampered = signedMetadata.replace("158590", "158591")
+    val rejected = BundleCryptoCore.verifyGpgCleartext(tampered)
+    assertFalse(rejected.valid)
+    assertNull(rejected.sha256)
+    assertEquals("SIGNATURE_INVALID", rejected.reason)
+
+    val unsigned = BundleCryptoCore.verifyGpgCleartext("{\"sha256\":\"$expectedSignedHash\"}")
+    assertFalse(unsigned.valid)
+    assertNull(unsigned.sha256)
+    assertEquals("NOT_PGP_SIGNED_MESSAGE", unsigned.reason)
+  }
+
+  @Test
+  fun validSignatureWithWrongAscBodyIsRejectedAfterVerification() {
+    val result = BundleCryptoCore.verifyDetachedAsc(signedMetadata)
+    assertFalse(result.valid)
+    assertNull(result.sha256)
+    assertEquals("SHA256_TOKEN_INVALID", result.reason)
+  }
+
+  @Test
+  fun directoryHashesRejectChangedMissingAndUnlistedFiles() {
+    val bundle = temporaryFolder.newFolder("bundle")
+    val nested = File(bundle, "nested/bundle").apply { mkdirs() }
+    val file = File(nested, "index.js").apply { writeText("abc") }
+    File(bundle, "metadata.json").writeText("ignored")
+
+    val hashes = BundleCryptoCore.hashDir(bundle.absolutePath)
+    assertEquals(1, hashes.size)
+    assertEquals("nested/bundle/index.js", hashes.single().relativePath)
+    assertEquals("ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad", hashes.single().sha256)
+    assertTrue(BundleCryptoCore.verifyDirAgainstHashes(bundle.absolutePath, hashes))
+
+    file.writeText("changed")
+    assertFalse(BundleCryptoCore.verifyDirAgainstHashes(bundle.absolutePath, hashes))
+    file.delete()
+    assertFalse(BundleCryptoCore.verifyDirAgainstHashes(bundle.absolutePath, hashes))
+
+    file.writeText("abc")
+    File(bundle, "evil-metadata.json").writeText("unlisted")
+    assertFalse(BundleCryptoCore.verifyDirAgainstHashes(bundle.absolutePath, hashes))
+  }
+
+  @Test
+  fun directoryHashesRejectExpectedPathsOutsideBundle() {
+    val root = temporaryFolder.newFolder("root")
+    val bundle = File(root, "bundle").apply { mkdirs() }
+    val outside = File(root, "outside.txt").apply { writeText("outside") }
+    val wrongHash = "0".repeat(64)
+
+    assertFalse(
+      BundleCryptoCore.verifyDirAgainstHashes(
+        bundle.absolutePath,
+        listOf(BundleCryptoCore.DirHash("../outside.txt", wrongHash))
+      )
+    )
+    assertFalse(
+      BundleCryptoCore.verifyDirAgainstHashes(
+        bundle.absolutePath,
+        listOf(BundleCryptoCore.DirHash(outside.absolutePath, wrongHash))
+      )
+    )
+    Files.createSymbolicLink(File(bundle, "link.txt").toPath(), outside.toPath())
+    assertFalse(
+      BundleCryptoCore.verifyDirAgainstHashes(
+        bundle.absolutePath,
+        listOf(BundleCryptoCore.DirHash("link.txt", wrongHash))
+      )
+    )
+    assertFalse(
+      BundleCryptoCore.verifyDirAgainstHashes(
+        bundle.absolutePath,
+        listOf(BundleCryptoCore.DirHash("", wrongHash))
+      )
+    )
+  }
+
+  @Test
+  fun extractedPathSafetyRejectsSymlinks() {
+    val bundle = temporaryFolder.newFolder("extracted")
+    val outside = temporaryFolder.newFile("outside.txt").apply { writeText("outside") }
+    File(bundle, "index.js").writeText("inside")
+    assertTrue(BundleCryptoCore.validateExtractedPathSafety(bundle.absolutePath))
+
+    Files.createSymbolicLink(File(bundle, "escape").toPath(), outside.toPath())
+    assertFalse(BundleCryptoCore.validateExtractedPathSafety(bundle.absolutePath))
+  }
+}

package/ios/BundleCryptoCore.swift

@@ -411,9 +411,17 @@ public enum BundleCryptoCore {
     }
     // Normalize the directory prefix so relative paths match.
     let normalizedDir = (dirPath as NSString).hasSuffix("/") ? dirPath : dirPath + "/"
+    let resolvedDir = (dirPath as NSString).resolvingSymlinksInPath
+    let resolvedPrefix = resolvedDir == "/" ? "/" : resolvedDir + "/"
 
     var expected: [String: String] = [:]
-    for entry in entries { expected[entry.relativePath] = entry.sha256 }
+    for entry in entries {
+      guard !entry.relativePath.isEmpty,
+            !(entry.relativePath as NSString).isAbsolutePath else { return false }
+      let resolvedFile = ((normalizedDir + entry.relativePath) as NSString).resolvingSymlinksInPath
+      guard resolvedFile.hasPrefix(resolvedPrefix) else { return false }
+      expected[entry.relativePath] = entry.sha256
+    }
 
     guard let enumerator = fm.enumerator(atPath: dirPath) else { return false }
     while let file = enumerator.nextObject() as? String {

package/ios/tests/BundleCryptoCoreTests.swift

@@ -0,0 +1,136 @@
+import Foundation
+import ReactNativeBundleCrypto
+import XCTest
+
+final class BundleCryptoCoreTests: XCTestCase {
+  private let expectedSignedHash = "2ada9c871104fc40649fa3de67a7d8e33faadc18e9abd587e8bb85be0a003eba"
+
+  // Existing release-key test vector, also used by BundleUpdate.testVerification.
+  private let signedMetadata = """
+    -----BEGIN PGP SIGNED MESSAGE-----
+    Hash: SHA256
+
+    {
+      "fileName": "metadata.json",
+      "sha256": "2ada9c871104fc40649fa3de67a7d8e33faadc18e9abd587e8bb85be0a003eba",
+      "size": 158590,
+      "generatedAt": "2025-09-19T07:49:13.000Z"
+    }
+    -----BEGIN PGP SIGNATURE-----
+
+    iQJCBAEBCAAsFiEE62iuVE8f3YzSZGJPs2mmepC/OHsFAmjNJ1IOHGRldkBvbmVr
+    ZXkuc28ACgkQs2mmepC/OHs6Rw/9FKHl5aNsE7V0IsFf/l+h16BYKFwVsL69alMk
+    CFLna8oUn0+tyECF6wKBKw5pHo5YR27o2pJfYbAER6dygDF6WTZ1lZdf5QcBMjGA
+    LCeXC0hzUBzSSOH4bKBTa3fHp//HdSV1F2OnkymbXqYN7WXvuQPLZ0nV6aU88hCk
+    HgFifcvkXAnWKoosUtj0Bban/YBRyvmQ5C2akxUPEkr4Yck1QXwzJeNRd7wMXHjH
+    JFK6lJcuABiB8wpJDXJkFzKs29pvHIK2B2vdOjU2rQzKOUwaKHofDi5C4+JitT2b
+    2pSeYP3PAxXYw6XDOmKTOiC7fPnfLjtcPjNYNFCezVKZT6LKvZW9obnW8Q9LNJ4W
+    okMPgHObkabv3OqUaTA9QNVfI/X9nvggzlPnaKDUrDWTf7n3vlrdexugkLtV/tJA
+    uguPlI5hY7Ue5OW7ckWP46hfmq1+UaIdeUY7dEO+rPZDz6KcArpaRwBiLPBhneIr
+    /X3KuMzS272YbPbavgCZGN9xJR5kZsEQE5HhPCbr6Nf0qDnh+X8mg0tAB/U6F+ZE
+    o90sJL1ssIaYvST+VWVaGRr4V5nMDcgHzWSF9Q/wm22zxe4alDaBdvOlUseW0iaM
+    n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
+    91Js0rQ=
+    =A/Ii
+    -----END PGP SIGNATURE-----
+    """
+
+  func testSignedMetadataAcceptsReleaseKeyAndRejectsTampering() {
+    let verified = BundleCryptoCore.verifyGpgCleartext(signedMetadata)
+    XCTAssertTrue(verified.valid)
+    XCTAssertEqual(verified.sha256, expectedSignedHash)
+    XCTAssertNil(verified.reason)
+
+    let tampered = signedMetadata.replacingOccurrences(of: "158590", with: "158591")
+    let rejected = BundleCryptoCore.verifyGpgCleartext(tampered)
+    XCTAssertFalse(rejected.valid)
+    XCTAssertNil(rejected.sha256)
+    XCTAssertNotNil(rejected.reason)
+
+    let unsigned = BundleCryptoCore.verifyGpgCleartext("{\"sha256\":\"\(expectedSignedHash)\"}")
+    XCTAssertFalse(unsigned.valid)
+    XCTAssertNil(unsigned.sha256)
+    XCTAssertEqual(unsigned.reason, "NOT_PGP_SIGNED_MESSAGE")
+  }
+
+  func testDirectoryHashesRejectChangedMissingAndUnlistedFiles() throws {
+    try withTemporaryDirectory { root in
+      let bundle = root.appendingPathComponent("bundle", isDirectory: true)
+      let nested = bundle.appendingPathComponent("nested/bundle", isDirectory: true)
+      try FileManager.default.createDirectory(at: nested, withIntermediateDirectories: true)
+      let file = nested.appendingPathComponent("index.js")
+      try "abc".write(to: file, atomically: true, encoding: .utf8)
+      try "ignored".write(to: bundle.appendingPathComponent("metadata.json"), atomically: true, encoding: .utf8)
+
+      let hashes = try BundleCryptoCore.hashDir(bundle.path)
+      XCTAssertEqual(hashes.count, 1)
+      XCTAssertEqual(hashes.first?.relativePath, "nested/bundle/index.js")
+      XCTAssertEqual(hashes.first?.sha256, "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad")
+      XCTAssertTrue(BundleCryptoCore.verifyDirAgainstHashes(dirPath: bundle.path, entries: hashes))
+
+      try "changed".write(to: file, atomically: true, encoding: .utf8)
+      XCTAssertFalse(BundleCryptoCore.verifyDirAgainstHashes(dirPath: bundle.path, entries: hashes))
+      try FileManager.default.removeItem(at: file)
+      XCTAssertFalse(BundleCryptoCore.verifyDirAgainstHashes(dirPath: bundle.path, entries: hashes))
+
+      try "abc".write(to: file, atomically: true, encoding: .utf8)
+      try "unlisted".write(to: bundle.appendingPathComponent("evil-metadata.json"), atomically: true, encoding: .utf8)
+      XCTAssertFalse(BundleCryptoCore.verifyDirAgainstHashes(dirPath: bundle.path, entries: hashes))
+    }
+  }
+
+  func testExtractedPathSafetyRejectsSymlinks() throws {
+    try withTemporaryDirectory { root in
+      let destination = root.appendingPathComponent("bundle", isDirectory: true)
+      let outside = root.appendingPathComponent("outside.txt")
+      try FileManager.default.createDirectory(at: destination, withIntermediateDirectories: true)
+      try "outside".write(to: outside, atomically: true, encoding: .utf8)
+      try "inside".write(to: destination.appendingPathComponent("index.js"), atomically: true, encoding: .utf8)
+      XCTAssertTrue(BundleCryptoCore.validateExtractedPathSafety(destination.path))
+
+      try FileManager.default.createSymbolicLink(
+        at: destination.appendingPathComponent("escape"),
+        withDestinationURL: outside
+      )
+      XCTAssertFalse(BundleCryptoCore.validateExtractedPathSafety(destination.path))
+    }
+  }
+
+  func testDirectoryHashesRejectExpectedPathsOutsideBundle() throws {
+    try withTemporaryDirectory { root in
+      let bundle = root.appendingPathComponent("bundle", isDirectory: true)
+      let outside = root.appendingPathComponent("outside.txt")
+      try FileManager.default.createDirectory(at: bundle, withIntermediateDirectories: true)
+      try "outside".write(to: outside, atomically: true, encoding: .utf8)
+      let wrongHash = String(repeating: "0", count: 64)
+
+      XCTAssertFalse(BundleCryptoCore.verifyDirAgainstHashes(
+        dirPath: bundle.path,
+        entries: [.init(relativePath: "../outside.txt", sha256: wrongHash)]
+      ))
+      XCTAssertFalse(BundleCryptoCore.verifyDirAgainstHashes(
+        dirPath: bundle.path,
+        entries: [.init(relativePath: outside.path, sha256: wrongHash)]
+      ))
+      try FileManager.default.createSymbolicLink(
+        at: bundle.appendingPathComponent("link.txt"),
+        withDestinationURL: outside
+      )
+      XCTAssertFalse(BundleCryptoCore.verifyDirAgainstHashes(
+        dirPath: bundle.path,
+        entries: [.init(relativePath: "link.txt", sha256: wrongHash)]
+      ))
+      XCTAssertFalse(BundleCryptoCore.verifyDirAgainstHashes(
+        dirPath: bundle.path,
+        entries: [.init(relativePath: "", sha256: wrongHash)]
+      ))
+    }
+  }
+
+  private func withTemporaryDirectory(_ body: (URL) throws -> Void) throws {
+    let root = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: true)
+    try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    defer { try? FileManager.default.removeItem(at: root) }
+    try body(root)
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-bundle-crypto",
-  "version": "3.0.157-alpha.251",
+  "version": "3.0.157-alpha.254",
   "description": "react-native-bundle-crypto",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",