@onekeyfe/react-native-bundle-update 3.0.30 → 3.0.32

package/android/src/main/java/com/margelo/nitro/reactnativebundleupdate/ReactNativeBundleUpdate.kt

@@ -409,10 +409,12 @@ object BundleUpdateStoreAndroid {
     /**
      * Subtype of the most recent calculateSHA256 failure on this thread, or
      * null if the last call succeeded. Surfaces the specific reason —
-     * FILE_NOT_FOUND / FILE_TRUNCATED / OOM / IO_<class> /
-     * UNEXPECTED_<class> — so analytics can split the previously opaque
-     * "Failed to calculate SHA256" bucket (mixpanel: 91.3 percent of
-     * verifyPackage failures) into actionable categories.
+     * FILE_NOT_FOUND / FILE_DISAPPEARED / FILE_TRUNCATED /
+     * PERMISSION_DENIED / OOM / IO_<class> / UNEXPECTED_<class> — so
+     * analytics can split the previously opaque "Failed to calculate
+     * SHA256" bucket (mixpanel: 91.3 percent of verifyPackage failures)
+     * into actionable categories. Keep this list in sync with the
+     * lastSHA256Failure.set(...) call sites in calculateSHA256 below.
      *
      * Note: 0-byte files are NOT treated as a failure. They hash to the
      * well-known empty-content SHA-256 and the caller's expected/actual
@@ -1487,7 +1489,14 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 partialBytes = 0L
             }
 
-            val body = response.body ?: throw Exception("Empty response body")
+            // Close the response before throwing on a null body — OkHttp
+            // holds connection resources on the response wrapper itself,
+            // and `throw` here exits the function before any byteStream()
+            // consumption would close it for us.
+            val body = response.body ?: run {
+                response.close()
+                throw Exception("Empty response body")
+            }
             val contentLength = body.contentLength()
             // Total size of the whole resource (not the slice). On 206 prefer
             // Content-Range's "/total" tail; fall back to partial+contentLength.
@@ -1576,8 +1585,16 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
                 // matches the verbatim guarantees documented on
                 // sanitizeErrorMessageForEvent.
                 OneKeyLog.error("BundleUpdate", "downloadBundle: failed: ${e.javaClass.simpleName}: ${e.message}")
-                sendEvent("update/error", message = sanitizeErrorMessageForEvent(e))
-                throw e
+                val sanitized = sanitizeErrorMessageForEvent(e)
+                sendEvent("update/error", message = sanitized)
+                // Rethrow with the same sanitized message so the Promise
+                // rejection surfacing to JS carries no /data/user/<u>/<pkg>/
+                // paths. Without this rewrap, FileNotFoundException etc.
+                // would re-leak via Promise.reject's message channel even
+                // though the event payload was already sanitized. Keep
+                // the original exception as `cause` so OneKeyLog (and any
+                // native crash reporter) still sees the full chain.
+                throw Exception(sanitized, e)
             } finally {
                 isDownloading.set(false)
             }

package/ios/ReactNativeBundleUpdate.swift

@@ -315,11 +315,15 @@ public class BundleUpdateStore: NSObject {
 
     /// Subtype of the most recent calculateSHA256 failure on this thread, or
     /// nil if the last call succeeded. Surfaces FILE_NOT_FOUND /
-    /// FILE_DISAPPEARED / IO_<NSError code> / UNEXPECTED so analytics can
-    /// split the previously opaque "Failed to calculate SHA256" bucket
-    /// (mixpanel: 91.3% of verifyPackage failures are Android; iOS shares
-    /// the calculator and inherits the same blind spot for its 14 ASC +
-    /// 2 verifyPackage Promise-destroyed cases).
+    /// FILE_DISAPPEARED / IO_<NSError code> so analytics can split the
+    /// previously opaque "Failed to calculate SHA256" bucket (mixpanel:
+    /// 91.3% of verifyPackage failures are Android; iOS shares the
+    /// calculator and inherits the same blind spot for its 14 ASC + 2
+    /// verifyPackage Promise-destroyed cases). Keep this list in sync
+    /// with the setSHA256Failure(...) call sites in calculateSHA256
+    /// below — Android's wider taxonomy (FILE_TRUNCATED / OOM /
+    /// UNEXPECTED_<class>) does not apply here because the iOS reader
+    /// surfaces every disk error as a single `IO_<NSError code>`.
     ///
     /// Note: 0-byte files are NOT treated as a failure. They hash to the
     /// well-known empty-content SHA256 and the caller's expected/actual
@@ -359,9 +363,15 @@ public class BundleUpdateStore: NSObject {
             var context = CC_SHA256_CTX()
             CC_SHA256_Init(&context)
             var threwError: Error?
-            // Wrap reads in try/catch via NSException bridge: FileHandle.readData
-            // can raise on read failure (NSFileHandleOperationException);
-            // ObjCRuntime catches those when bridged through NSObject methods.
+            // safeRead routes reads through FileHandle.read(upToCount:) on
+            // iOS 13.4+ — that variant surfaces disk failures as throwing
+            // NSError, which we catch here as Swift `Error`. On pre-13.4
+            // OS versions safeRead falls back to readData(ofLength:),
+            // which raises NSFileHandleOperationException; Swift cannot
+            // catch ObjC NSExceptions via try/catch, so on those legacy
+            // versions a read failure will still abort the process. We
+            // accept that on the floor since 13.4+ has been the deployment
+            // target for years.
             while autoreleasepool(invoking: {
                 do {
                     let data = try Self.safeRead(fileHandle: fileHandle, length: 8192)
@@ -1283,9 +1293,14 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
     private func snapshotResumeDataForBackgrounding() {
         guard let session = self.urlSession else { return }
         // Read both isDownloading AND activeDownloadFilePath inside the
-        // same stateQueue.sync block so a concurrent downloadBundle entry
-        // (which writes filePath BEFORE flipping isDownloading) cannot
-        // produce a torn read where isDownloading=true but filePath=nil.
+        // same stateQueue.sync block. A concurrent downloadBundle entry
+        // flips isDownloading=true at the start of the Promise body but
+        // only writes activeDownloadFilePath later (after the early
+        // guards / version + URL validation). Without this paired read,
+        // didEnterBackground could observe isDownloading=true while
+        // activeDownloadFilePath is still nil from a previous run, or —
+        // on the unwind via defer — see isDownloading=false alongside a
+        // not-yet-cleared path.
         let snapshot: (Bool, String?) = self.stateQueue.sync {
             (self.isDownloading, self.activeDownloadFilePath)
         }
@@ -1542,7 +1557,19 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
                 let nsError = error as NSError
                 OneKeyLog.error("BundleUpdate", "downloadBundle: download failed: \(nsError.domain) \(nsError.code) \(nsError.localizedDescription)")
                 self.sendEvent(type: "update/error", message: "\(nsError.domain) \(nsError.code)")
-                throw error
+                // Rethrow a sanitized NSError. The original `error` is a
+                // URLSession/system error whose `localizedDescription` may
+                // include the temp file path (e.g. NSURLErrorFailingURLString
+                // userInfo, or the ~/Library/.../CFNetworkDownload_*.tmp
+                // path on cancel-with-resume) — Promise rejections surface
+                // that string to JS, which would re-leak the paths the
+                // event-payload sanitization just stripped. Keep the full
+                // detail in OneKeyLog (above) and emit only `domain code`.
+                throw NSError(
+                    domain: nsError.domain,
+                    code: nsError.code,
+                    userInfo: [NSLocalizedDescriptionKey: "Download failed: \(nsError.domain) \(nsError.code)"]
+                )
 
             case .success(let (tempURL, response)):
                 // Successful completion ⇒ no longer need the resume blob.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-bundle-update",
-  "version": "3.0.30",
+  "version": "3.0.32",
   "description": "react-native-bundle-update",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",