freerasp-react-native 3.4.0 → 3.6.0

package/README.md

@@ -9,7 +9,6 @@ freeRASP for React Native is a mobile in-app protection and security monitoring
 # :notebook_with_decorative_cover: Table of contents
 
 - [Overview](#overview)
-- [Requirements](#requirements)
 - [Usage](#usage)
   - [(Optional) Create a new React Native demo application](#optional-create-a-new-react-native-demo-application)
   - [Step 1: Install the plugin](#step-1-install-the-plugin)
@@ -65,13 +64,6 @@ Learn more about commercial features at [https://talsec.app](https://talsec.app)
 
 Learn more about freemium freeRASP features at [GitHub main repository](https://github.com/talsec/Free-RASP-Community).
 
-# Requirements
-
-Following minimal version requirements have to be met
-in order to run freeRASP in your app:
-
-- `react-native` >= `0.65.3`
-
 # Usage
 
 We will guide you step-by-step, but you can always check the expected result in the example folder.
@@ -164,7 +156,7 @@ const config = {
 
    - `packageName` _: string_ - package name of your app you chose when you created it
    - `certificateHashes` _: string[]_ - hash of the certificate of the key which was used to sign the application. **Hash which is passed here must be encoded in Base64 form.** If you are not sure how to get your certificate hash, you can check out the guide on our [Github wiki](https://github.com/talsec/Free-RASP-Community/wiki/Getting-your-signing-certificate-hash-of-app). Multiple hashes are supported, e.g. if you are using a different one for the Huawei App Gallery.
-   - `supportedAlternativeStores` _: string[] | undefined_ - Google Play Store and Huawei AppGallery are supported out of the box, you **don't have to assign anything**. You can add other stores like the Samsung Galaxy Store in the example code (```com.sec.android.app.samsungapps```). For more information, visit the  [Detecting Unofficial Installation](https://github.com/talsec/Free-RASP-Community/wiki/Threat-detection#detecting-unofficial-installation) wiki page.
+   - `supportedAlternativeStores` _: string[] | undefined_ - Google Play Store and Huawei AppGallery are supported out of the box, you **don't have to assign anything**. You can add other stores like the Samsung Galaxy Store in the example code (`com.sec.android.app.samsungapps`). For more information, visit the [Detecting Unofficial Installation](https://github.com/talsec/Free-RASP-Community/wiki/Threat-detection#detecting-unofficial-installation) wiki page.
 
 1. `iosConfig` _: object | undefined_ - required for iOS devices, has following keys:
    - `appBundleId` _: string_ - Bundle ID of your app
@@ -387,12 +379,14 @@ To receive Security Reports, fill out the _watcherMail_ field in [config](#confi
 
 ![dashboard](https://raw.githubusercontent.com/talsec/Free-RASP-Community/master/visuals/dashboard.png)
 
-# :money_with_wings: Talsec Commercial Subscriptions 
+# :money_with_wings: Talsec Commercial Subscriptions
+
 Talsec offers commercial plans on top of freeRASP (Business RASP+):
-* No limits of Fair Usage Policy (100K App Downloads) 
-* No Data Collection from your app
-* FinTech grade security, features and SLA (see more in [this post](https://github.com/orgs/talsec/discussions/5))
-* Protect APIs and risk scoring by AppiCrypt®
+
+- No limits of Fair Usage Policy (100K App Downloads)
+- No Data Collection from your app
+- FinTech grade security, features and SLA (see more in [this post](https://github.com/orgs/talsec/discussions/5))
+- Protect APIs and risk scoring by AppiCrypt®
 
 Learn more at [talsec.app](https://talsec.app).
 
@@ -400,11 +394,11 @@ Not to overlook, the one of the most valued commercial features is [AppiCrypt®]
 
 It allows easy-to-implement API protection and App Integrity verification on the backend to prevent API abuse:
 
--   Bruteforce attacks
--   Botnets
--   API abuse by App impersonation
--   Session-hijacking
--   DDoS
+- Bruteforce attacks
+- Botnets
+- API abuse by App impersonation
+- Session-hijacking
+- DDoS
 
 It is a unified solution that works across all mobile platforms without dependency on external web services (i.e., without extra latency, an additional point of failure, and maintenance costs).
 

package/android/build.gradle

@@ -78,14 +78,15 @@ rootProject.allprojects {
 }
 
 def kotlin_version = getExtOrDefault("kotlinVersion")
+def react_native_version = getExtOrDefault("reactNativeVersion")
 
 dependencies {
   // For < 0.71, this will be from the local maven repo
   // For > 0.71, this will be replaced by `com.facebook.react:react-android:$version` by react gradle plugin
   //noinspection GradleDynamicVersion
-  implementation "com.facebook.react:react-native"
+  implementation "com.facebook.react:react-native:$react_native_version"
   implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
-  implementation "com.aheaditec.talsec.security:TalsecSecurity-Community-ReactNative:8.3.0"
+  implementation "com.aheaditec.talsec.security:TalsecSecurity-Community-ReactNative:9.0.0"
 }
 
 if (isNewArchitectureEnabled()) {

package/android/gradle.properties

@@ -2,4 +2,5 @@ FreeraspReactNative_kotlinVersion=1.7.0
 FreeraspReactNative_minSdkVersion=23
 FreeraspReactNative_targetSdkVersion=31
 FreeraspReactNative_compileSdkVersion=33
-FreeraspReactNative_ndkversion=21.4.7075529
+FreeraspReactNative_ndkversion=21.4.7075529
+FreeraspReactNative_reactNativeVersion=+

package/android/src/main/java/com/freeraspreactnative/FreeraspReactNativeModule.kt

@@ -4,93 +4,85 @@ import com.aheaditec.talsec_security.security.api.Talsec
 import com.aheaditec.talsec_security.security.api.TalsecConfig
 import com.aheaditec.talsec_security.security.api.ThreatListener
 import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.Promise
 import com.facebook.react.bridge.ReactApplicationContext
 import com.facebook.react.bridge.ReactContextBaseJavaModule
 import com.facebook.react.bridge.ReactMethod
-import com.facebook.react.bridge.WritableMap
 import com.facebook.react.bridge.ReadableMap
+import com.facebook.react.bridge.WritableArray
 import com.facebook.react.modules.core.DeviceEventManagerModule
 
 class FreeraspReactNativeModule(val reactContext: ReactApplicationContext) :
-  ReactContextBaseJavaModule(reactContext), ThreatListener.ThreatDetected,
-  FreeraspDeviceStateListener.DeviceStateListener {
+  ReactContextBaseJavaModule(reactContext) {
 
-  private val listener = ThreatListener(this, FreeraspDeviceStateListener)
+  private val listener = ThreatListener(FreeraspThreatHandler, FreeraspThreatHandler)
 
   override fun getName(): String {
     return NAME
   }
 
+  init {
+    appReactContext = reactContext
+  }
+
   @ReactMethod
   fun talsecStart(
-    options: ReadableMap
+    options: ReadableMap,
+    promise: Promise
   ) {
 
     try {
       val config = parseTalsecConfig(options)
-      FreeraspDeviceStateListener.listener = this
+      FreeraspThreatHandler.listener = ThreatListener
       listener.registerListener(reactContext)
       Talsec.start(reactContext, config)
-      sendOngoingPluginResult("started", null)
+      promise.resolve("freeRASP started")
 
     } catch (e: Exception) {
       val params = Arguments.createMap().apply {
         putString("message", e.message)
       }
-      sendOngoingPluginResult("initializationError", params)
+      promise.reject("initializationError", params)
     }
   }
 
+  /**
+   * Method to get the random identifiers of callbacks
+   */
   @ReactMethod
-  fun addListener(@Suppress("UNUSED_PARAMETER") eventName: String) {
-    // Set up any upstream listeners or background tasks as necessary
+  fun getThreatIdentifiers(promise: Promise) {
+    promise.resolve(Threat.getThreatValues())
   }
 
+  /**
+   * Method to setup the message passing between native and React Native
+   * @return list of [THREAT_CHANNEL_NAME, THREAT_CHANNEL_KEY]
+   */
   @ReactMethod
-  fun removeListeners(@Suppress("UNUSED_PARAMETER") count: Int) {
-    // Remove upstream listeners, stop unnecessary background tasks
-  }
-
-  override fun onRootDetected() {
-    sendOngoingPluginResult("privilegedAccess", null)
-  }
-
-  override fun onDebuggerDetected() {
-    sendOngoingPluginResult("debug", null)
-  }
-
-  override fun onEmulatorDetected() {
-    sendOngoingPluginResult("simulator", null)
-  }
-
-  override fun onTamperDetected() {
-    sendOngoingPluginResult("appIntegrity", null)
-  }
-
-  override fun onUntrustedInstallationSourceDetected() {
-    sendOngoingPluginResult("unofficialStore", null)
+  fun getThreatChannelData(promise: Promise) {
+    val channelData: WritableArray = Arguments.createArray()
+    channelData.pushString(THREAT_CHANNEL_NAME)
+    channelData.pushString(THREAT_CHANNEL_KEY)
+    promise.resolve(channelData)
   }
 
-  override fun onHookDetected() {
-    sendOngoingPluginResult("hooks", null)
-  }
-
-  override fun onDeviceBindingDetected() {
-    sendOngoingPluginResult("deviceBinding", null)
-  }
-
-  override fun onObfuscationIssuesDetected() {
-    sendOngoingPluginResult("obfuscationIssues", null)
+  /**
+   * We never send an invalid callback over our channel.
+   * Therefore, if this happens, we want to kill the app.
+   */
+  @ReactMethod
+  fun onInvalidCallback() {
+    android.os.Process.killProcess(android.os.Process.myPid())
   }
 
-  override fun deviceStateChangeDetected(threatType: String) {
-    sendOngoingPluginResult(threatType, null)
+  @ReactMethod
+  fun addListener(@Suppress("UNUSED_PARAMETER") eventName: String) {
+    // Set up any upstream listeners or background tasks as necessary
   }
 
-  private fun sendOngoingPluginResult(eventName: String, params: WritableMap?) {
-    reactContext
-      .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
-      .emit(eventName, params)
+  @ReactMethod
+  fun removeListeners(@Suppress("UNUSED_PARAMETER") count: Int) {
+    // Remove upstream listeners, stop unnecessary background tasks
   }
 
   private fun parseTalsecConfig(config: ReadableMap): TalsecConfig {
@@ -125,5 +117,23 @@ class FreeraspReactNativeModule(val reactContext: ReactApplicationContext) :
 
   companion object {
     const val NAME = "FreeraspReactNative"
+    val THREAT_CHANNEL_NAME = (10000..999999999).random()
+      .toString() // name of the channel over which threat callbacks are sent
+    val THREAT_CHANNEL_KEY = (10000..999999999).random()
+      .toString() // key of the argument map under which threats are expected
+    private lateinit var appReactContext: ReactApplicationContext
+    private fun notifyListeners(threat: Threat) {
+      val params = Arguments.createMap()
+      params.putInt(THREAT_CHANNEL_KEY, threat.value)
+      appReactContext
+        .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter::class.java)
+        .emit(THREAT_CHANNEL_NAME, params)
+    }
+  }
+
+  internal object ThreatListener : FreeraspThreatHandler.TalsecReactNative {
+    override fun threatDetected(threatType: Threat) {
+      notifyListeners(threatType)
+    }
   }
 }

package/android/src/main/java/com/freeraspreactnative/FreeraspThreatHandler.kt

@@ -0,0 +1,52 @@
+package com.freeraspreactnative
+
+import com.aheaditec.talsec_security.security.api.ThreatListener
+
+internal object FreeraspThreatHandler : ThreatListener.ThreatDetected, ThreatListener.DeviceState {
+
+  internal var listener: TalsecReactNative? = null
+
+  override fun onRootDetected() {
+    listener?.threatDetected(Threat.PrivilegedAccess)
+  }
+
+  override fun onDebuggerDetected() {
+    listener?.threatDetected(Threat.Debug)
+  }
+
+  override fun onEmulatorDetected() {
+    listener?.threatDetected(Threat.Simulator)
+  }
+
+  override fun onTamperDetected() {
+    listener?.threatDetected(Threat.AppIntegrity)
+  }
+
+  override fun onUntrustedInstallationSourceDetected() {
+    listener?.threatDetected(Threat.UnofficialStore)
+  }
+
+  override fun onHookDetected() {
+    listener?.threatDetected(Threat.Hooks)
+  }
+
+  override fun onDeviceBindingDetected() {
+    listener?.threatDetected(Threat.DeviceBinding)
+  }
+
+  override fun onObfuscationIssuesDetected() {
+    listener?.threatDetected(Threat.ObfuscationIssues)
+  }
+
+  override fun onUnlockedDeviceDetected() {
+    listener?.threatDetected(Threat.Passcode)
+  }
+
+  override fun onHardwareBackedKeystoreNotAvailableDetected() {
+    listener?.threatDetected(Threat.SecureHardwareNotAvailable)
+  }
+
+  internal interface TalsecReactNative {
+    fun threatDetected(threatType: Threat)
+  }
+}

package/android/src/main/java/com/freeraspreactnative/Threat.kt

@@ -0,0 +1,44 @@
+package com.freeraspreactnative
+
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.WritableArray
+
+/**
+ * Sealed class to represent the error codes.
+ *
+ * Sealed classes are used because of obfuscation - enums classes are not obfuscated well enough.
+ *
+ * @property value integer value of the error code.
+ */
+internal sealed class Threat(val value: Int) {
+  object AppIntegrity : Threat((10000..999999999).random())
+  object PrivilegedAccess : Threat((10000..999999999).random())
+  object Debug : Threat((10000..999999999).random())
+  object Hooks : Threat((10000..999999999).random())
+  object Passcode : Threat((10000..999999999).random())
+  object Simulator : Threat((10000..999999999).random())
+  object SecureHardwareNotAvailable : Threat((10000..999999999).random())
+  object DeviceBinding : Threat((10000..999999999).random())
+  object UnofficialStore : Threat((10000..999999999).random())
+  object ObfuscationIssues : Threat((10000..999999999).random())
+
+  companion object {
+    internal fun getThreatValues(): WritableArray {
+      return Arguments.fromList(
+        listOf(
+          AppIntegrity.value,
+          PrivilegedAccess.value,
+          Debug.value,
+          Hooks.value,
+          Passcode.value,
+          Simulator.value,
+          SecureHardwareNotAvailable.value,
+          DeviceBinding.value,
+          UnofficialStore.value,
+          ObfuscationIssues.value
+        )
+      )
+
+    }
+  }
+}

package/ios/FreeraspReactNative.m

@@ -4,7 +4,14 @@
 
 @interface RCT_EXTERN_MODULE(FreeraspReactNative, RCTEventEmitter)
 
-RCT_EXTERN_METHOD(talsecStart:(NSDictionary*)options)
+RCT_EXTERN_METHOD(talsecStart:(NSDictionary*)options
+                  withResolver:(RCTPromiseResolveBlock)resolve
+                  withRejecter:(RCTPromiseRejectBlock)reject)
+RCT_EXTERN_METHOD(getThreatChannelData:(RCTPromiseResolveBlock)resolve
+                  withRejecter:(RCTPromiseRejectBlock)reject)
+RCT_EXTERN_METHOD(getThreatIdentifiers:(RCTPromiseResolveBlock)resolve
+                  withRejecter:(RCTPromiseRejectBlock)reject)
+RCT_EXTERN_METHOD(onInvalidCallback)
 
 + (BOOL)requiresMainQueueSetup
 {

package/ios/FreeraspReactNative.swift

@@ -5,22 +5,26 @@ import TalsecRuntime
 class FreeraspReactNative: RCTEventEmitter {
 
     public static var shared:FreeraspReactNative?
+    
+    let threatChannelKey = String(Int.random(in: 100_000..<999_999_999)) // key of the argument map under which threats are expected
+    let threatChannelName = String(Int.random(in: 100_000..<999_999_999)) // name of the channel over which threat callbacks are sent
+    let threatIdentifierList = (1...12).map { _ in Int.random(in: 100_000..<999_999_999) }
 
     override init() {
         super.init()
         FreeraspReactNative.shared = self
     }
 
-    @objc(talsecStart:)
-    func talsecStart(options: NSDictionary) -> Void {
+    @objc(talsecStart:withResolver:withRejecter:)
+    func talsecStart(options: NSDictionary, resolve: RCTPromiseResolveBlock, rejecter reject: RCTPromiseRejectBlock) -> Void {
         do {
             try initializeTalsec(talsecConfig: options)
         }
         catch let error as NSError {
-            self.sendEvent(withName: "initializationError", body: error.localizedDescription)
+            reject("initialization_error", "Could not initialize freeRASP", error)
             return
         }
-        self.sendEvent(withName: "started", body: "started")
+        resolve("freeRASP started")
     }
 
     func initializeTalsec(talsecConfig: NSDictionary) throws {
@@ -41,25 +45,90 @@ class FreeraspReactNative: RCTEventEmitter {
         let config = TalsecConfig(appBundleIds: [appBundleIds], appTeamId: appTeamId, watcherMailAddress: watcherMailAddress, isProd: isProd)
         Talsec.start(config: config)
     }
+    
+    /**
+     * Method to setup the message passing between native and React Native
+     */
+    @objc(getThreatChannelData:withRejecter:)
+    private func getThreatChannelData(resolve: RCTPromiseResolveBlock, rejecter reject: RCTPromiseRejectBlock) -> Void {
+        resolve([threatChannelName, threatChannelKey])
+    }
+    
+    func dispatchEvent(securityThreat: SecurityThreat) -> Void {
+        FreeraspReactNative.shared!.sendEvent(withName: threatChannelName, body: [threatChannelKey: securityThreat.callbackIdentifier])
+    }
+    
+    /**
+     * Method to get the random identifiers of callbacks
+     */
+    @objc(getThreatIdentifiers:withRejecter:)
+    private func getThreatIdentifiers(resolve: RCTPromiseResolveBlock, rejecter reject: RCTPromiseRejectBlock) -> Void {
+        resolve(getThreatIdentifiers())
+    }
+    
+    /**
+     * We never send an invalid callback over our channel.
+     * Therefore, if this happens, we want to kill the app.
+     */
+    @objc(onInvalidCallback)
+    private func onInvalidCallback() -> Void {
+        abort()
+    }
+    
+    private func getThreatIdentifiers() -> [Int] {
+        return SecurityThreat.allCases
+            .filter {
+                threat in threat.rawValue != "passcodeChange"
+            }
+            .map {
+                threat in threat.callbackIdentifier
+            }
+    }
 
     override func supportedEvents() -> [String]! {
-        return ["initializationError", "started", "privilegedAccess", "debug", "simulator", "appIntegrity", "unofficialStore", "hooks", "deviceBinding", "deviceID", "secureHardwareNotAvailable", "passcodeChange", "passcode"]
+        return [threatChannelName]
     }
 }
 
-extension SecurityThreatCenter: SecurityThreatHandler {
+/// An extension to unify callback names with RN ones.
+extension SecurityThreat {
 
+    var callbackIdentifier: Int {
+        switch self {
+            case .signature:
+            return FreeraspReactNative.shared!.threatIdentifierList[0]
+            case .jailbreak:
+                return FreeraspReactNative.shared!.threatIdentifierList[1]
+            case .debugger:
+                return FreeraspReactNative.shared!.threatIdentifierList[2]
+            case .runtimeManipulation:
+                return FreeraspReactNative.shared!.threatIdentifierList[3]
+            case .passcode:
+                return FreeraspReactNative.shared!.threatIdentifierList[4]
+            case .passcodeChange:
+                return FreeraspReactNative.shared!.threatIdentifierList[5]
+            case .simulator:
+                return FreeraspReactNative.shared!.threatIdentifierList[6]
+            case .missingSecureEnclave:
+                return FreeraspReactNative.shared!.threatIdentifierList[7]
+            case .deviceChange:
+                return FreeraspReactNative.shared!.threatIdentifierList[8]
+            case .deviceID:
+                return FreeraspReactNative.shared!.threatIdentifierList[9]
+            case .unofficialStore:
+            return FreeraspReactNative.shared!.threatIdentifierList[10]
+            @unknown default:
+                abort()
+        }
+    }
+}
 
-    static let threatEventMap: [String: String] = [
-        "missingSecureEnclave": "secureHardwareNotAvailable",
-        "device binding": "deviceBinding",
-    ]
+extension SecurityThreatCenter: SecurityThreatHandler {
     
     public func threatDetected(_ securityThreat: TalsecRuntime.SecurityThreat) {
-        let threatName = SecurityThreatCenter.threatEventMap[securityThreat.rawValue] ?? securityThreat.rawValue
-        if (threatName == "passcodeChange") {
+        if (securityThreat.rawValue == "passcodeChange") {
             return
         }
-        FreeraspReactNative.shared!.sendEvent(withName: threatName, body: threatName)
+        FreeraspReactNative.shared!.dispatchEvent(securityThreat: securityThreat)
     }
 }

package/ios/TalsecRuntime.xcframework/Info.plist

@@ -6,30 +6,30 @@
 	<array>
 		<dict>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64_x86_64-simulator</string>
+			<string>ios-arm64</string>
 			<key>LibraryPath</key>
 			<string>TalsecRuntime.framework</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
-				<string>x86_64</string>
 			</array>
 			<key>SupportedPlatform</key>
 			<string>ios</string>
-			<key>SupportedPlatformVariant</key>
-			<string>simulator</string>
 		</dict>
 		<dict>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64</string>
+			<string>ios-arm64_x86_64-simulator</string>
 			<key>LibraryPath</key>
 			<string>TalsecRuntime.framework</string>
 			<key>SupportedArchitectures</key>
 			<array>
 				<string>arm64</string>
+				<string>x86_64</string>
 			</array>
 			<key>SupportedPlatform</key>
 			<string>ios</string>
+			<key>SupportedPlatformVariant</key>
+			<string>simulator</string>
 		</dict>
 	</array>
 	<key>CFBundlePackageType</key>

package/ios/TalsecRuntime.xcframework/ios-arm64/TalsecRuntime.framework/Headers/CurlWrapper.h

@@ -16,7 +16,7 @@
 #include <unistd.h>
 #include <string.h>
 
-struct MRBKHkNLymuB {
+struct IJEoyzefwvew {
     char *memory;
     size_t size;
     CURLcode ret;

package/ios/TalsecRuntime.xcframework/ios-arm64/TalsecRuntime.framework/Headers/TalsecRuntime-Swift.h

@@ -1,6 +1,6 @@
 #if 0
 #elif defined(__arm64__) && __arm64__
-// Generated by Apple Swift version 5.8 (swiftlang-5.8.0.124.2 clang-1403.0.22.11.100)
+// Generated by Apple Swift version 5.8.1 (swiftlang-5.8.0.124.5 clang-1403.0.22.11.100)
 #ifndef TALSECRUNTIME_SWIFT_H
 #define TALSECRUNTIME_SWIFT_H
 #pragma clang diagnostic push
@@ -281,7 +281,7 @@ typedef unsigned int swift_uint4  __attribute__((__ext_vector_type__(4)));
 
 #if defined(__OBJC__)
 
-SWIFT_EXTERN void __gEpMdsSyQvqeuMjBPsfuvPt(void);
+SWIFT_EXTERN void __FlQXVgtWTdusubZZgVYGfrP(void);
 
 #endif
 #if defined(__cplusplus)