react-native-update 10.49.0 → 10.51.0

package/android/src/main/java/cn/reactnative/modules/update/UpdateContext.java

@@ -47,6 +47,17 @@ public class UpdateContext {
     private static final int STATE_OP_CLEAR_ROLLBACK_MARK = 5;
     private static final int STATE_OP_RESOLVE_LAUNCH = 6;
     private static final String KEY_FIRST_LOAD_MARKED = "firstLoadMarked";
+    static final String VERSION_COMPLETE_FILE = ".pushy-complete";
+    // Bumped by resetToPackagedBundle. The cold-start check runs for minutes
+    // and may already hold a decision when the app resets to the packaged
+    // bundle; the orchestrator samples this counter and abandons activation
+    // (and its response cache) when the value moved, so an in-flight rescue
+    // can never resurrect the version the app just reset away from.
+    private static final java.util.concurrent.atomic.AtomicLong resetGeneration =
+        new java.util.concurrent.atomic.AtomicLong(0);
+    // Held by resetToPackagedBundle and by the cold-start check's commit, so
+    // the generation check and the writes it guards are one atomic step.
+    private static final Object commitLock = new Object();
     
     // Singleton instance
     private static volatile UpdateContext sInstance;
@@ -159,7 +170,9 @@ public class UpdateContext {
         });
     }
 
-    private String computeBundleHash() {
+    // Package-private: also the native cold-start check's request input
+    // (NativeCheckOrchestrator). Blocking — call off the main thread.
+    String computeBundleHash() {
         String cachePrefix = getPackageVersion() + "|" + getPackageLastUpdateTime() + "|";
         String cached = sp.getString(KEY_BUNDLE_HASH_CACHE, null);
         if (cached != null && cached.startsWith(cachePrefix)) {
@@ -211,23 +224,57 @@ public class UpdateContext {
         executor.execute(new DownloadTask(context, params));
     }
 
+    // Server-provided identifiers (hash/originHash/fileName) become child
+    // names under rootDir; anything that could resolve outside of it (path
+    // separators, "..", ".") must be rejected before touching the filesystem.
+    static boolean isSafePathComponent(String name) {
+        return name != null
+                && !name.isEmpty()
+                && !name.equals(".")
+                && !name.equals("..")
+                && !name.contains("/")
+                && !name.contains("\\")
+                && name.indexOf('\0') < 0;
+    }
+
+    private static boolean rejectUnsafeComponent(String name, DownloadFileListener listener) {
+        if (isSafePathComponent(name)) {
+            return false;
+        }
+        listener.onDownloadFailed(new IllegalArgumentException("Invalid path component: " + name));
+        return true;
+    }
+
     public interface DownloadFileListener {
         void onDownloadCompleted(DownloadTaskParams params);
         void onDownloadFailed(Throwable error);
     }
 
     public void downloadFullUpdate(String url, String hash, DownloadFileListener listener) {
+        downloadFullUpdate(url, hash, listener, 0);
+    }
+
+    void downloadFullUpdate(
+        String url, String hash, DownloadFileListener listener, long deadlineNanos
+    ) {
+        if (rejectUnsafeComponent(hash, listener)) {
+            return;
+        }
         DownloadTaskParams params = new DownloadTaskParams();
         params.type = DownloadTaskParams.TASK_TYPE_PATCH_FULL;
         params.url = url;
         params.hash = hash;
         params.listener = listener;
+        params.deadlineNanos = deadlineNanos;
         params.targetFile = new File(rootDir, hash + ".ppk");
         params.unzipDirectory = new File(rootDir, hash);
         enqueue(params);
     }
 
     public void downloadFile(String url, String hash, String fileName, DownloadFileListener listener) {
+        if (rejectUnsafeComponent(fileName, listener)) {
+            return;
+        }
         DownloadTaskParams params = new DownloadTaskParams();
         params.type = DownloadTaskParams.TASK_TYPE_PLAIN_DOWNLOAD;
         params.url = url;
@@ -246,23 +293,47 @@ public class UpdateContext {
     }
 
     public void downloadPatchFromApk(String url, String hash, DownloadFileListener listener) {
+        downloadPatchFromApk(url, hash, listener, 0);
+    }
+
+    void downloadPatchFromApk(
+        String url, String hash, DownloadFileListener listener, long deadlineNanos
+    ) {
+        if (rejectUnsafeComponent(hash, listener)) {
+            return;
+        }
         DownloadTaskParams params = new DownloadTaskParams();
         params.type = DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK;
         params.url = url;
         params.hash = hash;
         params.listener = listener;
+        params.deadlineNanos = deadlineNanos;
         params.targetFile = new File(rootDir, hash + ".apk.patch");
         params.unzipDirectory = new File(rootDir, hash);
         enqueue(params);
     }
 
     public void downloadPatchFromPpk(String url, String hash, String originHash, DownloadFileListener listener) {
+        downloadPatchFromPpk(url, hash, originHash, listener, 0);
+    }
+
+    void downloadPatchFromPpk(
+        String url,
+        String hash,
+        String originHash,
+        DownloadFileListener listener,
+        long deadlineNanos
+    ) {
+        if (rejectUnsafeComponent(hash, listener) || rejectUnsafeComponent(originHash, listener)) {
+            return;
+        }
         DownloadTaskParams params = new DownloadTaskParams();
         params.type = DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK;
         params.url = url;
         params.hash = hash;
         params.originHash = originHash;
         params.listener = listener;
+        params.deadlineNanos = deadlineNanos;
         params.targetFile = new File(rootDir, originHash + "-" + hash + ".ppk.patch");
         params.unzipDirectory = new File(rootDir, hash);
         params.originDirectory = new File(rootDir, originHash);
@@ -312,10 +383,24 @@ public class UpdateContext {
     }
 
     public void switchVersion(String hash) {
-        if (!new File(rootDir, hash+"/index.bundlejs").exists()) {
+        if (!isSafePathComponent(hash)) {
+            throw new IllegalArgumentException("Invalid hash: " + hash);
+        }
+        File versionDir = new File(rootDir, hash);
+        File bundleFile = new File(versionDir, "index.bundlejs");
+        if (!bundleFile.isFile()) {
             throw new IllegalStateException("Bundle version " + hash + " not found.");
         }
         StateCoreResult currentState = getStateSnapshot();
+        boolean isLegacyActivatedVersion = hash.equals(currentState.currentVersion)
+            || hash.equals(currentState.lastVersion);
+        if (!new File(versionDir, VERSION_COMPLETE_FILE).isFile()
+            && !isLegacyActivatedVersion) {
+            // Versions activated before completion markers were introduced are
+            // explicitly grandfathered through current/last state. An arbitrary
+            // markerless directory may be a crash-left partial install.
+            throw new IllegalStateException("Bundle version " + hash + " is incomplete.");
+        }
         StateCoreResult nextState = runStateCore(
             STATE_OP_SWITCH_VERSION,
             currentState,
@@ -409,6 +494,16 @@ public class UpdateContext {
      * for gray release bucketing and must not change on reset.
      */
     public void resetToPackagedBundle() {
+        synchronized (commitLock) {
+            resetToPackagedBundleLocked();
+        }
+    }
+
+    private void resetToPackagedBundleLocked() {
+        // Invalidate any in-flight cold-start round before clearing state: a
+        // round committing under the same lock afterwards sees the new
+        // generation and drops its result.
+        resetGeneration.incrementAndGet();
         StateCoreResult resetState = new StateCoreResult();
         resetState.packageVersion = getPackageVersion();
         resetState.buildTime = getBuildTime();
@@ -423,6 +518,8 @@ public class UpdateContext {
         }
         persistEditor(editor, "reset to packaged bundle");
         ignoreRollback = false;
+        // editor.clear() above already dropped the cached check response; it
+        // still advertised the version this reset removed.
         Log.i(TAG, "Reset to packaged bundle");
 
         DownloadTaskParams params = new DownloadTaskParams();
@@ -494,55 +591,112 @@ public class UpdateContext {
 
     public String getBundleUrl(String defaultAssetsUrl) {
         isUsingBundleUrl = true;
-        StateCoreResult currentState = getStateSnapshot();
-        StateCoreResult launchState = runStateCore(
-            STATE_OP_RESOLVE_LAUNCH,
-            currentState,
-            null,
-            ignoreRollback,
-            true
-        );
-        if (launchState.didRollback) {
-            // The crash-protection rollback: the new version never called
-            // markSuccess. Keep this visible in release logs.
-            Log.e(TAG, "Version " + currentState.currentVersion
-                + " was not marked as successful, rolling back to "
-                + launchState.currentVersion);
-        }
-        if (launchState.didRollback || launchState.consumedFirstTime) {
-            SharedPreferences.Editor editor = sp.edit();
-            applyState(editor, launchState);
+        String nativeCheckRolledBackVersion = null;
+        try {
+            StateCoreResult currentState = getStateSnapshot();
+            StateCoreResult launchState = runStateCore(
+                STATE_OP_RESOLVE_LAUNCH,
+                currentState,
+                null,
+                ignoreRollback,
+                true
+            );
+            nativeCheckRolledBackVersion = launchState.rolledBackVersion;
+            if (launchState.didRollback) {
+                // The crash-protection rollback: the new version never called
+                // markSuccess. Keep this visible in release logs.
+                Log.e(TAG, "Version " + currentState.currentVersion
+                    + " was not marked as successful, rolling back to "
+                    + launchState.currentVersion);
+            }
+            if (launchState.didRollback || launchState.consumedFirstTime) {
+                SharedPreferences.Editor editor = sp.edit();
+                applyState(editor, launchState);
+                if (launchState.consumedFirstTime) {
+                    editor.putBoolean(KEY_FIRST_LOAD_MARKED, true);
+                }
+                persistEditor(editor, "resolve launch");
+            }
             if (launchState.consumedFirstTime) {
-                editor.putBoolean(KEY_FIRST_LOAD_MARKED, true);
+                // bundleURL may be resolved multiple times in one process.
+                ignoreRollback = true;
+            }
+
+            String currentVersion = launchState.loadVersion;
+            if (currentVersion == null) {
+                return defaultAssetsUrl;
             }
-            persistEditor(editor, "resolve launch");
-        }
-        if (launchState.consumedFirstTime) {
-            // bundleURL may be resolved multiple times in one process.
-            ignoreRollback = true;
-        }
 
-        String currentVersion = launchState.loadVersion;
-        if (currentVersion == null) {
+            // Guard the rollback chain against cycles: a corrupted state returning
+            // an already-visited version would otherwise spin this loop forever on
+            // the main thread.
+            java.util.HashSet<String> visitedVersions = new java.util.HashSet<>();
+            while (currentVersion != null && visitedVersions.add(currentVersion)) {
+                File bundleFile = new File(rootDir, currentVersion+"/index.bundlejs");
+                if (!bundleFile.exists()) {
+                    Log.e(TAG, "Bundle version " + currentVersion + " not found.");
+                    currentVersion = this.rollBack();
+                    nativeCheckRolledBackVersion = rolledBackVersion();
+                    continue;
+                }
+                launchVersion = currentVersion;
+                nativeCheckRolledBackVersion = rolledBackVersion();
+                return bundleFile.toString();
+            }
+
+            nativeCheckRolledBackVersion = rolledBackVersion();
             return defaultAssetsUrl;
+        } finally {
+            // Even corrupted state or a state-core exception must not disable
+            // the next-launch rescue check. A null snapshot simply omits the
+            // rollback guard for this exceptional launch.
+            NativeCheckOrchestrator.schedule(this, nativeCheckRolledBackVersion);
         }
+    }
 
-        // Guard the rollback chain against cycles: a corrupted state returning
-        // an already-visited version would otherwise spin this loop forever on
-        // the main thread.
-        java.util.HashSet<String> visitedVersions = new java.util.HashSet<>();
-        while (currentVersion != null && visitedVersions.add(currentVersion)) {
-            File bundleFile = new File(rootDir, currentVersion+"/index.bundlejs");
-            if (!bundleFile.exists()) {
-                Log.e(TAG, "Bundle version " + currentVersion + " not found.");
-                currentVersion = this.rollBack();
-                continue;
+    /** Sampled/compared by the native check orchestrator; see resetGeneration. */
+    static long getResetGeneration() {
+        return resetGeneration.get();
+    }
+
+    /**
+     * Commit everything a cold-start round persists — version info, the
+     * activation, the response cache — under one lock that first re-checks the
+     * reset generation. resetToPackagedBundle takes the same lock, so there is
+     * no compare-and-act window: either the whole round lands, or the reset
+     * wins and none of it does. Returns whether the round was committed.
+     */
+    boolean commitNativeCheckResult(
+        long expectedGeneration,
+        String hash,
+        String hashInfoJson,
+        boolean activate,
+        String responseCacheJson
+    ) {
+        synchronized (commitLock) {
+            if (resetGeneration.get() != expectedGeneration) {
+                return false;
+            }
+            if (hash != null && hashInfoJson != null) {
+                setKv("hash_" + hash, hashInfoJson);
+            }
+            if (activate && hash != null) {
+                switchVersion(hash);
             }
-            launchVersion = currentVersion;
-            return bundleFile.toString();
+            if (responseCacheJson != null) {
+                setKv(NativeCheckOrchestrator.KEY_RESP_CACHE, responseCacheJson);
+            }
+            return true;
         }
+    }
 
-        return defaultAssetsUrl;
+    boolean hasCompletedVersion(String hash) {
+        if (!isSafePathComponent(hash)) {
+            return false;
+        }
+        File versionDir = new File(rootDir, hash);
+        return new File(versionDir, "index.bundlejs").isFile()
+            && new File(versionDir, VERSION_COMPLETE_FILE).isFile();
     }
 
     private String rollBack() {

package/android/src/main/java/cn/reactnative/modules/update/UpdateModuleImpl.java

@@ -41,11 +41,20 @@ public class UpdateModuleImpl {
 
             @Override
             public void onDownloadFailed(Throwable error) {
-                promise.reject(ErrorCodes.DOWNLOAD_FAILED, error);
+                promise.reject(downloadErrorCode(error), error);
             }
         });
     }
 
+    // Post-download failures (unzip / hdiff / resource copy, incl. copiesCrc
+    // verification) reject as PATCH_FAILED so JS-side telemetry can separate
+    // patch health from network health. DownloadTask wraps them.
+    private static String downloadErrorCode(Throwable error) {
+        return error instanceof PatchFailedException
+            ? ErrorCodes.PATCH_FAILED
+            : ErrorCodes.DOWNLOAD_FAILED;
+    }
+
     public static void downloadAndInstallApk(
         final ReactApplicationContext reactContext,
         UpdateContext updateContext,
@@ -84,7 +93,7 @@ public class UpdateModuleImpl {
 
             @Override
             public void onDownloadFailed(Throwable error) {
-                promise.reject(ErrorCodes.DOWNLOAD_FAILED, error);
+                promise.reject(downloadErrorCode(error), error);
             }
         });
     }
@@ -107,7 +116,7 @@ public class UpdateModuleImpl {
 
                 @Override
                 public void onDownloadFailed(Throwable error) {
-                    promise.reject(ErrorCodes.DOWNLOAD_FAILED, error);
+                    promise.reject(downloadErrorCode(error), error);
                 }
             });
         } catch (Exception e) {
@@ -215,10 +224,54 @@ public class UpdateModuleImpl {
         });
     }
 
+    /**
+     * Raw response cached by the native cold-start check, for the JS side to
+     * reuse instead of re-checking (§10.3). Empty string when absent; never
+     * rejects.
+     */
+    public static void getNativeCheckCache(
+        final UpdateContext updateContext,
+        final Promise promise
+    ) {
+        String cached = updateContext.getKv(NativeCheckOrchestrator.KEY_RESP_CACHE);
+        promise.resolve(cached == null ? "" : cached);
+    }
+
     private static void setUuidInternal(UpdateContext updateContext, String uuid) {
         updateContext.setKv("uuid", uuid);
     }
 
+    /**
+     * Provisioning for the native cold-start update check
+     * (NATIVE_CHECKUPDATE_DESIGN §10.1): the raw JSON persists as-is and is
+     * parsed on read by the orchestrator; absent config = check disabled.
+     * Validated at write time — a corrupt config would otherwise silently
+     * disable the native check forever with no signal.
+     */
+    public static void syncNativeConfig(
+        final UpdateContext updateContext,
+        final String config,
+        final Promise promise
+    ) {
+        if (config == null || config.isEmpty()) {
+            promise.reject(ErrorCodes.INVALID_OPTIONS, "config must be a JSON object string");
+            return;
+        }
+        try {
+            new JSONObject(config);
+        } catch (JSONException e) {
+            promise.reject(ErrorCodes.INVALID_OPTIONS, "config must be a JSON object string", e);
+            return;
+        }
+        StateSerialRunner.run(promise, ErrorCodes.FILE_OPERATION_FAILED, "syncNativeConfig", new StateSerialRunner.Operation() {
+            @Override
+            public void run() {
+                updateContext.setKv(NativeCheckOrchestrator.KEY_CONFIG, config);
+                promise.resolve(true);
+            }
+        });
+    }
+
     public static void setUuid(
         final UpdateContext updateContext,
         final String uuid,

package/android/src/newarch/cn/reactnative/modules/update/UpdateModule.java

@@ -88,6 +88,16 @@ public class UpdateModule extends NativePushySpec {
         UpdateModuleImpl.setUuid(updateContext, uuid, promise);
     }
 
+    @Override
+    public void syncNativeConfig(String config, Promise promise) {
+        UpdateModuleImpl.syncNativeConfig(updateContext, config, promise);
+    }
+
+    @Override
+    public void getNativeCheckCache(Promise promise) {
+        UpdateModuleImpl.getNativeCheckCache(updateContext, promise);
+    }
+
     @Override
     public void setLocalHashInfo(String hash, String info, Promise promise) {
         UpdateModuleImpl.setLocalHashInfo(updateContext, hash, info, promise);

package/android/src/oldarch/cn/reactnative/modules/update/UpdateModule.java

@@ -90,6 +90,16 @@ public class UpdateModule extends ReactContextBaseJavaModule {
         UpdateModuleImpl.setUuid(updateContext, uuid);
     }
 
+    @ReactMethod
+    public void syncNativeConfig(String config, Promise promise) {
+        UpdateModuleImpl.syncNativeConfig(updateContext, config, promise);
+    }
+
+    @ReactMethod
+    public void getNativeCheckCache(Promise promise) {
+        UpdateModuleImpl.getNativeCheckCache(updateContext, promise);
+    }
+
     @ReactMethod
     public void setLocalHashInfo(String hash, String info) {
         UpdateModuleImpl.setLocalHashInfo(updateContext, hash, info);

package/cpp/patch_core/digest.cpp

@@ -173,5 +173,58 @@ std::string Sha256File(const std::string& path) {
   return hasher.HexDigest();
 }
 
+namespace {
+
+struct Crc32TableHolder {
+  uint32_t table[256];
+
+  Crc32TableHolder() {
+    for (uint32_t i = 0; i < 256; i++) {
+      uint32_t value = i;
+      for (int bit = 0; bit < 8; bit++) {
+        value = (value & 1u) ? (value >> 1) ^ 0xEDB88320u : value >> 1;
+      }
+      table[i] = value;
+    }
+  }
+};
+
+const uint32_t* Crc32Table() {
+  // Function-local static: thread-safe one-time construction (C++11).
+  static const Crc32TableHolder holder;
+  return holder.table;
+}
+
+}  // namespace
+
+void Crc32::Update(const uint8_t* data, size_t length) {
+  const uint32_t* table = Crc32Table();
+  uint32_t state = state_;
+  for (size_t i = 0; i < length; i++) {
+    state = table[(state ^ data[i]) & 0xFFu] ^ (state >> 8);
+  }
+  state_ = state;
+}
+
+bool Crc32File(const std::string& path, uint32_t* out) {
+  std::FILE* file = std::fopen(path.c_str(), "rb");
+  if (file == nullptr) {
+    return false;
+  }
+  Crc32 crc;
+  uint8_t buffer[64 * 1024];
+  size_t read = 0;
+  while ((read = std::fread(buffer, 1, sizeof(buffer), file)) > 0) {
+    crc.Update(buffer, read);
+  }
+  const bool failed = std::ferror(file) != 0;
+  std::fclose(file);
+  if (failed) {
+    return false;
+  }
+  *out = crc.Value();
+  return true;
+}
+
 }  // namespace digest
 }  // namespace pushy

package/cpp/patch_core/digest.h

@@ -39,5 +39,23 @@ class Sha256 {
 // digest, or an empty string if the file cannot be read.
 std::string Sha256File(const std::string& path);
 
+// Streaming CRC32 (IEEE 802.3, reflected polynomial 0xEDB88320 — the zip /
+// zlib checksum). Used to verify pdiff copy sources against the CRCs the CLI
+// records from the origin package's zip entries (copiesCrc in __diff.json):
+// the values must be byte-compatible with what any zip tool would report.
+class Crc32 {
+ public:
+  void Update(const uint8_t* data, size_t length);
+
+  uint32_t Value() const { return state_ ^ 0xFFFFFFFFu; }
+
+ private:
+  uint32_t state_ = 0xFFFFFFFFu;
+};
+
+// CRC32 of a file on disk (streaming, bounded memory). Returns false if the
+// file cannot be read.
+bool Crc32File(const std::string& path, uint32_t* out);
+
 }  // namespace digest
 }  // namespace pushy

package/cpp/patch_core/patch_core.cpp

@@ -1,5 +1,7 @@
 #include "patch_core.h"
 
+#include "digest.h"
+
 #include <cerrno>
 #include <cstdio>
 #include <cstring>
@@ -532,8 +534,22 @@ Status ApplyPatchFromFileSource(
   }
 
   for (const CopyOperation& copy : options.manifest.copies) {
+    const std::string source_path = JoinPath(options.source_root, copy.from);
+    if (copy.has_expected_crc) {
+      uint32_t actual_crc = 0;
+      if (!digest::Crc32File(source_path, &actual_crc)) {
+        return Status::Error("Failed to read copy source " + source_path);
+      }
+      if (actual_crc != copy.expected_crc) {
+        // Rebuilt binary with drifted content at an unchanged path. Fail the
+        // patch — the caller falls back to the full package; never install a
+        // resource whose bytes differ from what the diff was generated against.
+        return Status::Error(
+            "Copy source content mismatch (crc32): " + copy.from);
+      }
+    }
     Status copy_status = CopyFile(
-        JoinPath(options.source_root, copy.from),
+        source_path,
         JoinPath(options.target_root, copy.to),
         true);
     if (!copy_status) {

package/cpp/patch_core/patch_core.h

@@ -1,5 +1,6 @@
 #pragma once
 
+#include <cstdint>
 #include <ctime>
 #include <string>
 #include <vector>
@@ -20,6 +21,13 @@ struct Status {
 struct CopyOperation {
   std::string from;
   std::string to;
+  // Manifest-declared CRC32 of the source content (__diff.json copiesCrc,
+  // present in pdiff manifests from CLI >= 2.21.2). When set, the copy source
+  // is verified before copying; a mismatch fails the whole patch so the JS
+  // strategy chain falls back to the full package instead of installing a
+  // wrong resource from a rebuilt binary.
+  bool has_expected_crc = false;
+  uint32_t expected_crc = 0;
 };
 
 struct PatchManifest {