native-update 1.4.9 → 3.1.0

package/ios/Plugin/LiveUpdate/LiveUpdatePlugin.swift

@@ -11,6 +11,15 @@ class LiveUpdatePlugin {
     private var session: URLSession!
     private var downloadTask: URLSessionDownloadTask?
     private let securityManager = SecurityManager()
+
+    // UserDefaults keys for the A2 (boot-time re-verify) and A3
+    // (crash-loop auto-rollback) defenses. Mirrors the Android constants
+    // in LiveUpdatePlugin.kt so the two platforms stay in lockstep.
+    private static let activeBundleKey = "native_update_active_bundle"
+    private static let previousBundleKey = "native_update_previous_active_bundle"
+    private static let pendingBundleKey = "native_update_pending_verify_bundle"
+    private static let pendingAttemptsKey = "native_update_pending_verify_attempts"
+    private static let maxPendingAttempts = 2
     
     init(plugin: CAPPlugin) {
         self.plugin = plugin
@@ -125,76 +134,103 @@ class LiveUpdatePlugin {
         }
         
         Task {
+            let bundleId = "bundle-\(Date().timeIntervalSince1970)"
+            let downloadDir = getUpdatesDirectory().appendingPathComponent(bundleId)
+            var downloadSucceeded = false
+            defer {
+                // Remove the download directory if anything in download/
+                // verify/extract failed. Without this, every failed
+                // download leaks an empty bundle-<ts>/ directory that
+                // never gets cleaned up.
+                if !downloadSucceeded {
+                    try? FileManager.default.removeItem(at: downloadDir)
+                }
+            }
             do {
-                let bundleId = "bundle-\(Date().timeIntervalSince1970)"
-                let downloadDir = getUpdatesDirectory().appendingPathComponent(bundleId)
                 try FileManager.default.createDirectory(at: downloadDir, withIntermediateDirectories: true)
-                
-                // Start download
+
                 let downloadedFile = try await downloadBundle(from: url, to: downloadDir, bundleId: bundleId)
-                
-                // Verify checksum
+
                 let calculatedChecksum = try calculateChecksum(for: downloadedFile)
                 if calculatedChecksum != checksum {
-                    try FileManager.default.removeItem(at: downloadedFile)
                     call.reject("CHECKSUM_ERROR", "Bundle checksum validation failed")
                     return
                 }
-                
-                // Verify signature if provided
+
                 if let signature = call.getString("signature"),
                    let publicKey = (config?["security"] as? [String: Any])?["publicKey"] as? String,
                    (config?["security"] as? [String: Any])?["enableSignatureValidation"] as? Bool == true {
-                    
+
                     let fileData = try Data(contentsOf: downloadedFile)
                     let securityManager = SecurityManager()
-                    
+
                     if !securityManager.verifySignature(data: fileData, signature: signature, publicKeyString: publicKey) {
-                        try FileManager.default.removeItem(at: downloadedFile)
                         call.reject("SIGNATURE_ERROR", "Bundle signature validation failed")
                         return
                     }
                 }
-                
-                // Create bundle info
-                let bundleInfo: [String: Any] = [
+
+                // Extract immediately so the bundle is bootable, but DO
+                // NOT swap the WebView's serverBasePath here. set() does
+                // that. This matches Android's contract — download stages
+                // a verified bundle, set() activates it.
+                try extractZipBundleForBundle(bundleId: bundleId, zipUrl: downloadedFile)
+
+                let extractedPath = getUpdatesDirectory()
+                    .appendingPathComponent(bundleId)
+                    .appendingPathComponent("www")
+                    .path
+
+                var bundleInfo: [String: Any] = [
                     "bundleId": bundleId,
                     "version": version,
                     "path": downloadedFile.path,
+                    "extractedPath": extractedPath,
                     "downloadTime": Date().timeIntervalSince1970 * 1000,
                     "size": try FileManager.default.attributesOfItem(atPath: downloadedFile.path)[.size] ?? 0,
                     "status": "READY",
                     "checksum": checksum,
                     "verified": true
                 ]
-                
-                // Save bundle info
+                if let signature = call.getString("signature") {
+                    bundleInfo["signature"] = signature
+                }
                 saveBundleInfo(bundleInfo)
-                
-                // Extract the bundle
-                try extractAndApplyBundle(downloadedFile, bundleId: bundleId)
-                
-                // Notify state change
+
                 stateChangeListener?([
                     "status": "READY",
                     "bundleId": bundleId,
                     "version": version
                 ])
-                
+
+                downloadSucceeded = true
                 call.resolve(bundleInfo)
             } catch {
                 call.reject("DOWNLOAD_ERROR", error.localizedDescription)
             }
         }
     }
-    
+
     func set(_ call: CAPPluginCall) {
         guard let bundleId = call.getString("bundleId") else {
             call.reject("Bundle ID is required")
             return
         }
-        
+
+        // Activation = update the active-bundle pointer AND swap the
+        // WebView's serverBasePath. Previously the swap happened in
+        // download(), which auto-activated bundles before the host app
+        // had a chance to call set(). That broke parity with Android
+        // and meant a partially-completed download could end up live.
+        let bundles = UserDefaults.standard.dictionary(forKey: "native_update_bundles") ?? [:]
+        guard let bundleInfo = bundles[bundleId] as? [String: Any],
+              let extractedPath = bundleInfo["extractedPath"] as? String else {
+            call.reject("Bundle not found or not extracted: \(bundleId)")
+            return
+        }
+
         setActiveBundle(bundleId)
+        configureWebViewPath(extractedPath)
         call.resolve()
     }
     
@@ -467,7 +503,22 @@ class LiveUpdatePlugin {
     }
     
     private func setActiveBundle(_ bundleId: String) {
-        UserDefaults.standard.set(bundleId, forKey: "native_update_active_bundle")
+        let defaults = UserDefaults.standard
+        let currentActive = defaults.string(forKey: Self.activeBundleKey)
+
+        defaults.set(bundleId, forKey: Self.activeBundleKey)
+
+        // Preserve the previous active bundle as a rollback target. Skip
+        // self-activation so we don't nuke a real previous-bundle pointer.
+        if let previous = currentActive, previous != bundleId {
+            defaults.set(previous, forKey: Self.previousBundleKey)
+        }
+
+        // Mark this activation as pending-verify. notifyAppReady() clears
+        // it; otherwise the next cold start counts against the bundle and
+        // eventually rolls back to the previous known-good bundle.
+        defaults.set(bundleId, forKey: Self.pendingBundleKey)
+        defaults.set(0, forKey: Self.pendingAttemptsKey)
     }
     
     private func clearAllBundles() {
@@ -542,46 +593,249 @@ class LiveUpdatePlugin {
     }
     
     private func markBundleAsVerified() {
-        UserDefaults.standard.set(true, forKey: "native_update_current_bundle_verified")
+        // notifyAppReady() is the host app's "I booted clean on this bundle"
+        // signal. Clear the pending-verify state so cold starts after this
+        // no longer count against the bundle.
+        let defaults = UserDefaults.standard
+        defaults.set(true, forKey: "native_update_current_bundle_verified")
+        defaults.removeObject(forKey: Self.pendingBundleKey)
+        defaults.removeObject(forKey: Self.pendingAttemptsKey)
     }
-    
-    // MARK: - Bundle Extraction and WebView Configuration
-    
-    private func extractAndApplyBundle(_ bundleUrl: URL, bundleId: String) throws {
-        let extractedPath = getUpdatesDirectory().appendingPathComponent(bundleId).appendingPathComponent("www")
 
-        do {
-            // Extract the zip bundle
-            try extractZipBundle(from: bundleUrl, to: extractedPath)
+    /// Called from NativeUpdatePlugin.load() on every cold start. Runs two
+    /// independent defenses, both silent when no OTA bundle is active:
+    ///
+    ///   A2 — re-hash the active bundle and verify it still matches the
+    ///        checksum stored at install time. If signature + publicKey are
+    ///        configured, also re-verify the signature. Catches on-disk
+    ///        tampering on jailbroken devices.
+    ///   A3 — if the active bundle was never confirmed by notifyAppReady()
+    ///        on the previous launch, treat this cold start as a failed
+    ///        boot. After maxPendingAttempts failures, rollback to the
+    ///        previous known-good bundle to break the crash loop.
+    ///
+    /// On any failure the method rolls back and fires an
+    /// updateStateChanged event with status "ROLLBACK" so the host app
+    /// and analytics layer can observe it.
+    func verifyActiveBundleOnBoot() {
+        let defaults = UserDefaults.standard
 
-            // Update bundle info with extracted path
-            var bundleInfo = getAllBundles().first { $0["bundleId"] as? String == bundleId } ?? [:]
-            bundleInfo["extractedPath"] = extractedPath.path
-            bundleInfo["status"] = "READY"
-            saveBundleInfo(bundleInfo)
+        // A3: crash-loop detection.
+        if let pendingBundleId = defaults.string(forKey: Self.pendingBundleKey) {
+            let nextAttempt = defaults.integer(forKey: Self.pendingAttemptsKey) + 1
+            if nextAttempt > Self.maxPendingAttempts {
+                rollbackToPrevious(
+                    reason: "auto-rollback after \(nextAttempt) failed cold starts",
+                    fromBundleId: pendingBundleId
+                )
+                defaults.removeObject(forKey: Self.pendingBundleKey)
+                defaults.removeObject(forKey: Self.pendingAttemptsKey)
+                return
+            }
+            defaults.set(nextAttempt, forKey: Self.pendingAttemptsKey)
+        }
+
+        // A2: integrity re-verify. Only for non-default active bundles.
+        guard let activeBundleId = defaults.string(forKey: Self.activeBundleKey),
+              activeBundleId != "default" else {
+            return
+        }
+
+        guard let bundleInfo = getBundleInfoById(activeBundleId) else {
+            rollbackToPrevious(
+                reason: "active bundle info missing from UserDefaults",
+                fromBundleId: activeBundleId
+            )
+            return
+        }
+
+        guard let bundlePath = bundleInfo["path"] as? String, !bundlePath.isEmpty,
+              let expectedChecksum = bundleInfo["checksum"] as? String, !expectedChecksum.isEmpty else {
+            return
+        }
 
-            // Configure WebView to use new path
-            configureWebViewPath(extractedPath.path)
+        let bundleURL = URL(fileURLWithPath: bundlePath)
+        guard FileManager.default.fileExists(atPath: bundlePath) else {
+            rollbackToPrevious(
+                reason: "bundle file missing on disk",
+                fromBundleId: activeBundleId
+            )
+            return
+        }
+
+        do {
+            let actualChecksum = try calculateChecksum(for: bundleURL)
+            if actualChecksum != expectedChecksum {
+                rollbackToPrevious(
+                    reason: "bundle checksum mismatch on boot",
+                    fromBundleId: activeBundleId
+                )
+                return
+            }
         } catch {
-            // Get the safe bundle path (current working bundle)
-            let safePath = UserDefaults.standard.string(forKey: "native_update_webview_path") ?? "/"
+            rollbackToPrevious(
+                reason: "bundle checksum computation failed: \(error.localizedDescription)",
+                fromBundleId: activeBundleId
+            )
+            return
+        }
 
-            // Rollback to safe bundle
-            try? rollbackToSafeBundle(currentPath: extractedPath.path, safePath: safePath)
+        // Signature re-verify when both a signature and a public key are
+        // available. Absence of either is treated as "not configured" and
+        // skipped — Phase A1 already enforces fail-closed at download time.
+        if let signature = bundleInfo["signature"] as? String, !signature.isEmpty,
+           let publicKey = (config?["security"] as? [String: Any])?["publicKey"] as? String,
+           !publicKey.isEmpty {
+            do {
+                let bytes = try Data(contentsOf: bundleURL)
+                if !securityManager.verifySignature(
+                    data: bytes,
+                    signature: signature,
+                    publicKeyString: publicKey
+                ) {
+                    rollbackToPrevious(
+                        reason: "bundle signature mismatch on boot",
+                        fromBundleId: activeBundleId
+                    )
+                }
+            } catch {
+                rollbackToPrevious(
+                    reason: "bundle signature check failed: \(error.localizedDescription)",
+                    fromBundleId: activeBundleId
+                )
+            }
+        }
+    }
 
-            // Re-throw the error
-            throw error
+    private func rollbackToPrevious(reason: String, fromBundleId: String) {
+        let defaults = UserDefaults.standard
+        let previous = defaults.string(forKey: Self.previousBundleKey)
+        if let previous = previous {
+            defaults.set(previous, forKey: Self.activeBundleKey)
+        } else {
+            defaults.removeObject(forKey: Self.activeBundleKey)
         }
+        defaults.removeObject(forKey: Self.previousBundleKey)
+
+        stateChangeListener?([
+            "status": "ROLLBACK",
+            "bundleId": fromBundleId,
+            "rolledBackTo": previous ?? "default",
+            "reason": reason
+        ])
+    }
+
+    private func getBundleInfoById(_ bundleId: String) -> [String: Any]? {
+        let defaults = UserDefaults.standard
+        let bundles = defaults.dictionary(forKey: "native_update_bundles") ?? [:]
+        return bundles[bundleId] as? [String: Any]
     }
     
+    // MARK: - Bundle Extraction and WebView Configuration
+    
+    /// Extract a downloaded zip into `bundles/{bundleId}/www/`. Does NOT
+    /// touch `setServerBasePath` — activation is owned by set().
+    private func extractZipBundleForBundle(bundleId: String, zipUrl: URL) throws {
+        let extractedPath = getUpdatesDirectory()
+            .appendingPathComponent(bundleId)
+            .appendingPathComponent("www")
+        do {
+            try extractZipBundle(from: zipUrl, to: extractedPath)
+        } catch {
+            // Roll back the partial extraction so a re-download is clean.
+            try? FileManager.default.removeItem(at: extractedPath)
+            throw error
+        }
+    }
+
+    private func extractAndApplyBundle(_ bundleUrl: URL, bundleId: String) throws {
+        // Legacy path retained for any caller still using it. Extracts
+        // and immediately activates — equivalent to the old behavior.
+        try extractZipBundleForBundle(bundleId: bundleId, zipUrl: bundleUrl)
+        let extractedPath = getUpdatesDirectory()
+            .appendingPathComponent(bundleId)
+            .appendingPathComponent("www")
+        var bundleInfo = getAllBundles().first { $0["bundleId"] as? String == bundleId } ?? [:]
+        bundleInfo["extractedPath"] = extractedPath.path
+        bundleInfo["status"] = "READY"
+        saveBundleInfo(bundleInfo)
+        configureWebViewPath(extractedPath.path)
+    }
+    
+    /// Hard cap on total uncompressed size of an OTA bundle. Protects
+    /// against zip-bombs (a small zip that expands to gigabytes and fills
+    /// the device). Chosen as 5x the default 100MB downloaded-bundle limit
+    /// — enough headroom for typical web-app bundles after minification
+    /// reverses, below a threshold that would be hostile on mobile.
+    private static let maxUncompressedBundleBytes: UInt64 = 500 * 1024 * 1024
+
     private func extractZipBundle(from zipUrl: URL, to destinationUrl: URL) throws {
-        // Ensure destination directory exists
+        // Ensure destination directory exists.
         try FileManager.default.createDirectory(at: destinationUrl, withIntermediateDirectories: true, attributes: nil)
 
-        // Extract the ZIP archive using ZIPFoundation
+        // Inspect every entry before extracting anything. Three defenses:
+        //   1. zip-slip — an entry whose destination path resolves outside
+        //      the intended directory would let a malicious bundle write
+        //      over any file in the app sandbox (e.g. overwriting
+        //      built-in code) when unzipItem later runs.
+        //   2. symlink attack — symlinks in the archive can redirect
+        //      subsequent writes outside the sandbox even if the entry
+        //      itself resolves cleanly.
+        //   3. zip-bomb — sum of uncompressed sizes capped; refuses to
+        //      extract an archive that would exhaust device storage.
+        guard let archive = Archive(url: zipUrl, accessMode: .read) else {
+            throw NSError(domain: "LiveUpdatePlugin", code: 7, userInfo: [
+                NSLocalizedDescriptionKey: "Could not open bundle archive for inspection"
+            ])
+        }
+
+        let canonicalDestination = destinationUrl
+            .standardizedFileURL
+            .resolvingSymlinksInPath()
+            .path
+        let destinationPrefix = canonicalDestination.hasSuffix("/")
+            ? canonicalDestination
+            : canonicalDestination + "/"
+
+        var totalUncompressed: UInt64 = 0
+
+        for entry in archive {
+            if entry.type == .symlink {
+                throw NSError(domain: "LiveUpdatePlugin", code: 8, userInfo: [
+                    NSLocalizedDescriptionKey: "Bundle contains symlink entry (refused): \(entry.path)"
+                ])
+            }
+
+            if entry.path.hasPrefix("/") {
+                throw NSError(domain: "LiveUpdatePlugin", code: 9, userInfo: [
+                    NSLocalizedDescriptionKey: "Bundle entry has absolute path (refused): \(entry.path)"
+                ])
+            }
+
+            let entryURL = destinationUrl
+                .appendingPathComponent(entry.path)
+                .standardizedFileURL
+            let entryPath = entryURL.resolvingSymlinksInPath().path
+
+            if entryPath != canonicalDestination && !entryPath.hasPrefix(destinationPrefix) {
+                throw NSError(domain: "LiveUpdatePlugin", code: 10, userInfo: [
+                    NSLocalizedDescriptionKey: "Bundle entry escapes destination (zip-slip refused): \(entry.path)"
+                ])
+            }
+
+            let (newTotal, overflow) = totalUncompressed.addingReportingOverflow(entry.uncompressedSize)
+            if overflow || newTotal > Self.maxUncompressedBundleBytes {
+                throw NSError(domain: "LiveUpdatePlugin", code: 11, userInfo: [
+                    NSLocalizedDescriptionKey: "Bundle exceeds maximum uncompressed size (\(Self.maxUncompressedBundleBytes) bytes) — possible zip-bomb"
+                ])
+            }
+            totalUncompressed = newTotal
+        }
+
+        // All entries passed inspection — safe to extract.
         try FileManager.default.unzipItem(at: zipUrl, to: destinationUrl)
 
-        // Verify extraction succeeded by checking for index.html
+        // Verify extraction succeeded by checking for index.html.
         let indexPath = destinationUrl.appendingPathComponent("index.html")
         guard FileManager.default.fileExists(atPath: indexPath.path) else {
             throw NSError(domain: "LiveUpdatePlugin", code: 6, userInfo: [
@@ -589,7 +843,7 @@ class LiveUpdatePlugin {
             ])
         }
 
-        // Clean up the ZIP file after successful extraction
+        // Clean up the ZIP file after successful extraction.
         try? FileManager.default.removeItem(at: zipUrl)
     }
     

package/ios/Plugin/NativeUpdatePlugin.swift

@@ -33,6 +33,14 @@ public class NativeUpdatePlugin: CAPPlugin {
         appUpdatePlugin.setEventListener { [weak self] eventName, data in
             self?.notifyListeners(eventName, data: data)
         }
+
+        // Boot-time integrity re-verify + crash-loop auto-rollback. Runs
+        // before any host-app code touches the WebView so a tampered or
+        // crash-looping bundle never gets a chance to load. Signature
+        // re-verify runs again after configure() when the publicKey
+        // arrives from the host app; checksum re-verify here is
+        // sufficient to catch most tampering.
+        liveUpdatePlugin.verifyActiveBundleOnBoot()
     }
     
     @objc func initialize(_ call: CAPPluginCall) {
@@ -60,16 +68,21 @@ public class NativeUpdatePlugin: CAPPlugin {
     }
     
     @objc func cleanup(_ call: CAPPluginCall) {
-        // Clean up any resources
         liveUpdatePlugin.cleanup()
-        // Disable background updates through the plugin method
-        let disableCall = CAPPluginCall(
-            callbackId: "cleanup_disable",
-            options: [:],
-            success: { _ in },
-            error: { _ in }
-        )
-        backgroundUpdatePlugin.disableBackgroundUpdates(disableCall)
+        // CAPACITOR-SDK-WORKAROUND (assumes Capacitor 8.x):
+        // We cannot manufacture a synthetic CAPPluginCall to forward into
+        // backgroundUpdatePlugin.disableBackgroundUpdates(_:) because
+        // CAPPluginCall(callbackId:options:success:error:) is `internal`
+        // in the public Capacitor SDK — referencing it produces a
+        // compile error against the shipped framework. The internal
+        // `disableBackgroundUpdatesInternal()` shim wraps the same
+        // teardown logic and is the ONLY entry point that doesn't
+        // require a CAPPluginCall.
+        //
+        // Revisit on every Capacitor major bump: if the constructor
+        // becomes public, replace the shim with a real synthetic call.
+        // Tracked in docs/project-audit/PRODUCTION-READINESS-AUDIT-2026-05-08.md (item I2).
+        backgroundUpdatePlugin.disableBackgroundUpdatesInternal()
         call.resolve()
     }
     

package/ios/Plugin/Security/SecurityManager.swift

@@ -25,7 +25,8 @@ class SecurityManager {
                 "pins": getCertificatePins()
             ],
             "validateInputs": config?["validateInputs"] as? Bool ?? true,
-            "secureStorage": config?["secureStorage"] as? Bool ?? true
+            // Hard-coded true since v2 — secure storage is no longer opt-out.
+            "secureStorage": true
         ]
     }
     
@@ -142,21 +143,17 @@ class SecurityManager {
         return digest.map { String(format: "%02x", $0) }.joined()
     }
     
+    /// Writes always land in the Keychain since v2. The old
+    /// `secureStorage: false` opt-out was removed because the default
+    /// ran in plaintext UserDefaults unless a host app explicitly opted
+    /// in — which meant most integrations stored API keys in a trivially
+    /// readable location. See matching change in SecurityManager.kt.
     func saveSecureData(key: String, value: String) {
-        if isSecureStorageEnabled() {
-            keychain.set(value, forKey: key)
-        } else {
-            // Fallback to UserDefaults (not recommended)
-            UserDefaults.standard.set(value, forKey: key)
-        }
+        keychain.set(value, forKey: key)
     }
-    
+
     func getSecureData(key: String) -> String? {
-        if isSecureStorageEnabled() {
-            return keychain.string(forKey: key)
-        } else {
-            return UserDefaults.standard.string(forKey: key)
-        }
+        return keychain.string(forKey: key)
     }
     
     func validatePath(_ path: String) -> Bool {
@@ -189,8 +186,10 @@ class SecurityManager {
         return config?["enforceHttps"] as? Bool ?? true
     }
     
+    /// Unconditionally true since v2. Kept so `getSecurityInfo()` still
+    /// reports the capability to callers.
     func isSecureStorageEnabled() -> Bool {
-        return config?["secureStorage"] as? Bool ?? true
+        return true
     }
     
     func isInputValidationEnabled() -> Bool {