@onekeyfe/react-native-split-bundle-loader 3.0.20 → 3.0.21

package/android/src/main/java/com/splitbundleloader/SplitBundleLoaderModule.kt

@@ -7,8 +7,10 @@ import com.facebook.react.bridge.Promise
 import com.facebook.react.bridge.ReactApplicationContext
 import com.facebook.react.module.annotations.ReactModule
 import java.io.File
+import java.io.FileInputStream
 import java.io.FileOutputStream
 import java.io.IOException
+import java.security.MessageDigest
 import java.util.concurrent.Semaphore
 
 /**
@@ -171,6 +173,13 @@ class SplitBundleLoaderModule(reactContext: ReactApplicationContext) :
         try {
             ensureExtractDirFreshForCurrentInstall(reactApplicationContext)
             val absolutePath = resolveSegmentPath(relativePath, sha256)
+            if (absolutePath != null && !verifySha256(absolutePath, sha256)) {
+                promise.reject(
+                    "SPLIT_BUNDLE_SHA256_MISMATCH",
+                    "Segment SHA-256 mismatch: $relativePath"
+                )
+                return
+            }
             if (absolutePath != null) {
                 promise.resolve(absolutePath)
             } else {
@@ -195,10 +204,6 @@ class SplitBundleLoaderModule(reactContext: ReactApplicationContext) :
         sha256: String,
         promise: Promise
     ) {
-        // NOTE (#44): sha256 param is not verified at load time by design.
-        // Per §6.4.1, runtime trusts that OTA install has already verified
-        // segment integrity. Builtin segments are signed as part of the APK/IPA.
-        // If runtime SHA-256 verification is needed, add it here.
         try {
             ensureExtractDirFreshForCurrentInstall(reactApplicationContext)
             val segId = segmentId.toInt()
@@ -212,6 +217,18 @@ class SplitBundleLoaderModule(reactContext: ReactApplicationContext) :
                 return
             }
 
+            // Per-segment integrity check at load time. Replaces the legacy
+            // assumption that install-time validation is sufficient: now
+            // BundleUpdate skips full-tree sha256 on startup hot path, so
+            // segment integrity is enforced lazily here.
+            if (!verifySha256(absolutePath, sha256)) {
+                promise.reject(
+                    "SPLIT_BUNDLE_SHA256_MISMATCH",
+                    "Segment SHA-256 mismatch: $relativePath (key=$segmentKey)"
+                )
+                return
+            }
+
             // Use ReactContext.registerSegment which works in both bridge
             // and bridgeless modes. In bridge mode it delegates to
             // CatalystInstance; in bridgeless mode it delegates to ReactHost.
@@ -409,4 +426,70 @@ class SplitBundleLoaderModule(reactContext: ReactApplicationContext) :
             null
         }
     }
+
+    /**
+     * Reflectively asks bundle-update whether the current bundle's manifest
+     * is required to ship per-segment SHA-256s (three-bundle / split-thread
+     * format). When this returns true, an empty [expected] in [verifySha256]
+     * is treated as a hard fail instead of the back-compat skip.
+     *
+     * Returns false (back-compat allowed) if the symbol is absent — older
+     * bundle-update versions don't expose this and we don't want to wedge
+     * the loader on an upgrade race.
+     */
+    private fun currentBundleRequiresPerSegmentHash(): Boolean {
+        return try {
+            val bundleUpdateStore = Class.forName(
+                "com.margelo.nitro.reactnativebundleupdate.BundleUpdateStoreAndroid"
+            )
+            val method = bundleUpdateStore.getMethod(
+                "currentBundleRequiresPerSegmentHash",
+                Context::class.java
+            )
+            // Kotlin `object` instance methods need INSTANCE; @JvmStatic
+            // exposes a static method with the same name. Try the static
+            // call first, then fall back to INSTANCE so we work either way
+            // if the bundle-update side toggles @JvmStatic in the future.
+            val result = try {
+                method.invoke(null, reactApplicationContext)
+            } catch (_: NullPointerException) {
+                val instance = bundleUpdateStore.getField("INSTANCE").get(null)
+                method.invoke(instance, reactApplicationContext)
+            } catch (_: IllegalArgumentException) {
+                val instance = bundleUpdateStore.getField("INSTANCE").get(null)
+                method.invoke(instance, reactApplicationContext)
+            }
+            (result as? Boolean) ?: false
+        } catch (_: Exception) {
+            false
+        }
+    }
+
+    /**
+     * Streams [path] and compares its SHA-256 against [expected] (hex,
+     * case-insensitive). When [expected] is empty, defers to bundle-update:
+     * three-bundle format manifests must ship per-segment hashes (fail
+     * closed); older formats are allowed to omit them (back-compat).
+     */
+    private fun verifySha256(path: String, expected: String): Boolean {
+        if (expected.isEmpty()) {
+            return !currentBundleRequiresPerSegmentHash()
+        }
+        return try {
+            val md = MessageDigest.getInstance("SHA-256")
+            FileInputStream(path).use { input ->
+                val buf = ByteArray(64 * 1024)
+                while (true) {
+                    val n = input.read(buf)
+                    if (n <= 0) break
+                    md.update(buf, 0, n)
+                }
+            }
+            val actual = md.digest().joinToString("") { "%02x".format(it) }
+            actual.equals(expected, ignoreCase = true)
+        } catch (e: Exception) {
+            SBLLogger.warn("verifySha256 failed for $path: ${e.message}")
+            false
+        }
+    }
 }

package/ios/SplitBundleLoader.mm

@@ -4,10 +4,76 @@
 #import <ReactCommon/RCTHost+Internal.h>
 #import <ReactCommon/RCTInstance.h>
 #import <objc/runtime.h>
+#import <CommonCrypto/CommonDigest.h>
 #include <jsi/jsi.h>
 
 @implementation SplitBundleLoader
 
+// Reflectively asks bundle-update whether the current bundle's manifest is
+// required to ship per-segment SHA-256s (three-bundle / split-thread format).
+// When this returns YES, an empty `expected` in verifySha256OfFile:expected:
+// is treated as a hard fail instead of the back-compat skip. Returns NO when
+// the symbol is absent so older bundle-update versions don't wedge the loader.
++ (BOOL)currentBundleRequiresPerSegmentHash
+{
+    Class cls = NSClassFromString(@"ReactNativeBundleUpdate.BundleUpdateStore");
+    if (!cls) return NO;
+    SEL sel = NSSelectorFromString(@"currentBundleRequiresPerSegmentHash");
+    if (![cls respondsToSelector:sel]) return NO;
+    NSMethodSignature *sig = [cls methodSignatureForSelector:sel];
+    if (!sig) return NO;
+    // BOOL on Apple platforms is signed char (or bool on arm64); accept both.
+    const char *retType = sig.methodReturnType;
+    if (strcmp(retType, @encode(BOOL)) != 0 &&
+        strcmp(retType, @encode(char)) != 0 &&
+        strcmp(retType, @encode(bool)) != 0) {
+        return NO;
+    }
+    NSInvocation *inv = [NSInvocation invocationWithMethodSignature:sig];
+    inv.target = cls;
+    inv.selector = sel;
+    [inv invoke];
+    BOOL result = NO;
+    [inv getReturnValue:&result];
+    return result;
+}
+
+// Segment-time SHA-256 verification helper. Returns YES on match, NO on
+// mismatch or read failure. Streams the file with a fixed-size buffer so a
+// large segment doesn't pull the whole bundle into memory just to hash it.
++ (BOOL)verifySha256OfFile:(NSString *)path expected:(NSString *)expected
+{
+    if (expected.length == 0) {
+        // Defer to bundle-update: three-bundle format manifests must ship
+        // per-segment hashes (fail closed); older formats are allowed to omit
+        // them (back-compat).
+        return ![SplitBundleLoader currentBundleRequiresPerSegmentHash];
+    }
+    NSFileHandle *handle = [NSFileHandle fileHandleForReadingAtPath:path];
+    if (!handle) {
+        return NO;
+    }
+    CC_SHA256_CTX ctx;
+    CC_SHA256_Init(&ctx);
+    @try {
+        const NSUInteger chunk = 64 * 1024;
+        while (1) {
+            NSData *data = [handle readDataOfLength:chunk];
+            if (data.length == 0) break;
+            CC_SHA256_Update(&ctx, data.bytes, (CC_LONG)data.length);
+        }
+    } @finally {
+        [handle closeFile];
+    }
+    unsigned char digest[CC_SHA256_DIGEST_LENGTH];
+    CC_SHA256_Final(digest, &ctx);
+    NSMutableString *hex = [NSMutableString stringWithCapacity:CC_SHA256_DIGEST_LENGTH * 2];
+    for (int i = 0; i < CC_SHA256_DIGEST_LENGTH; i++) {
+        [hex appendFormat:@"%02x", digest[i]];
+    }
+    return [hex caseInsensitiveCompare:expected] == NSOrderedSame;
+}
+
 - (std::shared_ptr<facebook::react::TurboModule>)getTurboModule:
     (const facebook::react::ObjCTurboModule::InitParams &)params
 {
@@ -175,13 +241,19 @@
         }
 
         NSString *absolutePath = [SplitBundleLoader resolveAbsolutePath:relativePath];
-        if (absolutePath) {
-            resolve(absolutePath);
-        } else {
+        if (!absolutePath) {
             reject(@"SPLIT_BUNDLE_NOT_FOUND",
                    [NSString stringWithFormat:@"Segment file not found: %@", relativePath],
                    nil);
+            return;
         }
+        if (![SplitBundleLoader verifySha256OfFile:absolutePath expected:sha256]) {
+            reject(@"SPLIT_BUNDLE_SHA256_MISMATCH",
+                   [NSString stringWithFormat:@"Segment SHA-256 mismatch: %@", relativePath],
+                   nil);
+            return;
+        }
+        resolve(absolutePath);
     } @catch (NSException *exception) {
         reject(@"SPLIT_BUNDLE_RESOLVE_ERROR", exception.reason, nil);
     }
@@ -263,6 +335,13 @@
             return;
         }
 
+        if (![SplitBundleLoader verifySha256OfFile:absolutePath expected:sha256]) {
+            reject(@"SPLIT_BUNDLE_SHA256_MISMATCH",
+                   [NSString stringWithFormat:@"Segment SHA-256 mismatch: %@ (key=%@)", relativePath, segmentKey],
+                   nil);
+            return;
+        }
+
         // Register segment (#13: supports both bridge and bridgeless)
         NSError *regError = nil;
         if ([SplitBundleLoader registerSegment:segId path:absolutePath error:&regError]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-split-bundle-loader",
-  "version": "3.0.20",
+  "version": "3.0.21",
   "description": "react-native-split-bundle-loader",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",
@@ -82,6 +82,7 @@
     "typescript": "^5.9.2"
   },
   "peerDependencies": {
+    "@onekeyfe/react-native-bundle-update": ">=3.0.21",
     "react": "*",
     "react-native": "*"
   },