React Native Security: Securing Cross-Platform Mobile App...

// SecureStorage.ts
// Production-ready secure storage for React Native

import { NativeModules, Platform } from 'react-native';

/**
 * Custom error types for secure storage operations
 */
export class SecureStorageError extends Error {
    constructor(
        message: string,
        public code: string,
        public originalError?: Error
    ) {
        super(message);
        this.name = 'SecureStorageError';
    }
}

/**
 * Secure storage interface for cross-platform keychain/keystore access
 */
interface SecureStorageInterface {
    setItem(key: string, value: string): Promise<void>;
    getItem(key: string): Promise<string | null>;
    removeItem(key: string): Promise<void>;
    clear(): Promise<void>;
}

class SecureStorage implements SecureStorageInterface {
    private nativeModule: any;

    constructor() {
        if (Platform.OS === 'ios') {
            this.nativeModule = NativeModules.RNSecureStorage;
        } else if (Platform.OS === 'android') {
            this.nativeModule = NativeModules.RNSecureStorage;
        } else {
            throw new SecureStorageError(
                'Secure storage not supported on this platform',
                'PLATFORM_NOT_SUPPORTED'
            );
        }

        if (!this.nativeModule) {
            throw new SecureStorageError(
                'Secure storage native module not found',
                'MODULE_NOT_FOUND'
            );
        }
    }

    /**
     * Store a value securely in keychain/keystore
     * @param key Storage key (must be unique)
     * @param value Value to store (will be encrypted)
     * @throws SecureStorageError if operation fails
     */
    async setItem(key: string, value: string): Promise<void> {
        try {
            // Validate input
            if (!key || typeof key !== 'string') {
                throw new SecureStorageError(
                    'Invalid key: must be a non-empty string',
                    'INVALID_KEY'
                );
            }

            if (typeof value !== 'string') {
                throw new SecureStorageError(
                    'Invalid value: must be a string',
                    'INVALID_VALUE'
                );
            }

            if (key.length > 256) {
                throw new SecureStorageError(
                    'Key too long: maximum 256 characters',
                    'KEY_TOO_LONG'
                );
            }

            // Store securely
            await this.nativeModule.setItem(key, value);
        } catch (error: any) {
            if (error instanceof SecureStorageError) {
                throw error;
            }
            throw new SecureStorageError(
                `Failed to store item: ${error.message}`,
                'STORAGE_FAILED',
                error
            );
        }
    }

    /**
     * Retrieve a value from secure storage
     * @param key Storage key
     * @returns Stored value or null if not found
     * @throws SecureStorageError if operation fails
     */
    async getItem(key: string): Promise<string | null> {
        try {
            if (!key || typeof key !== 'string') {
                throw new SecureStorageError(
                    'Invalid key: must be a non-empty string',
                    'INVALID_KEY'
                );
            }

            const value = await this.nativeModule.getItem(key);
            return value;
        } catch (error: any) {
            if (error instanceof SecureStorageError) {
                throw error;
            }

            // Handle "item not found" gracefully
            if (error.code === 'ITEM_NOT_FOUND' || error.message?.includes('not found')) {
                return null;
            }

            throw new SecureStorageError(
                `Failed to retrieve item: ${error.message}`,
                'RETRIEVAL_FAILED',
                error
            );
        }
    }

    /**
     * Remove an item from secure storage
     * @param key Storage key
     * @throws SecureStorageError if operation fails
     */
    async removeItem(key: string): Promise<void> {
        try {
            if (!key || typeof key !== 'string') {
                throw new SecureStorageError(
                    'Invalid key: must be a non-empty string',
                    'INVALID_KEY'
                );
            }

            await this.nativeModule.removeItem(key);
        } catch (error: any) {
            if (error instanceof SecureStorageError) {
                throw error;
            }
            throw new SecureStorageError(
                `Failed to remove item: ${error.message}`,
                'REMOVAL_FAILED',
                error
            );
        }
    }

    /**
     * Clear all items from secure storage
     * @throws SecureStorageError if operation fails
     */
    async clear(): Promise<void> {
        try {
            await this.nativeModule.clear();
        } catch (error: any) {
            if (error instanceof SecureStorageError) {
                throw error;
            }
            throw new SecureStorageError(
                `Failed to clear storage: ${error.message}`,
                'CLEAR_FAILED',
                error
            );
        }
    }
}

// Export singleton instance
export const secureStorage = new SecureStorage();

// Export class for testing
export { SecureStorage };

//
// RNSecureStorage.swift
// Native iOS secure storage module
//

import Foundation
import Security

@objc(RNSecureStorage)
class RNSecureStorage: NSObject {
    
    private let service = Bundle.main.bundleIdentifier ?? "com.yourapp.securestorage"
    
    @objc
    func setItem(_ key: String, value: String, resolver: @escaping RCTPromiseResolveBlock, rejecter: @escaping RCTPromiseRejectBlock) {
        // Validate input
        guard !key.isEmpty, key.count <= 256 else {
            rejecter("INVALID_KEY", "Key must be between 1 and 256 characters", nil)
            return
        }
        
        // Delete existing item if present
        deleteItem(key: key)
        
        // Prepare query
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key,
            kSecValueData as String: value.data(using: .utf8)!,
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]
        
        // Add item
        let status = SecItemAdd(query as CFDictionary, nil)
        
        if status == errSecSuccess {
            resolver(nil)
        } else {
            rejecter("STORAGE_FAILED", "Failed to store item: \(status)", NSError(domain: NSOSStatusErrorDomain, code: Int(status)))
        }
    }
    
    @objc
    func getItem(_ key: String, resolver: @escaping RCTPromiseResolveBlock, rejecter: @escaping RCTPromiseRejectBlock) {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]
        
        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        
        if status == errSecSuccess {
            if let data = result as? Data, let value = String(data: data, encoding: .utf8) {
                resolver(value)
            } else {
                rejecter("DECODE_FAILED", "Failed to decode stored value", nil)
            }
        } else if status == errSecItemNotFound {
            resolver(nil)
        } else {
            rejecter("RETRIEVAL_FAILED", "Failed to retrieve item: \(status)", NSError(domain: NSOSStatusErrorDomain, code: Int(status)))
        }
    }
    
    @objc
    func removeItem(_ key: String, resolver: @escaping RCTPromiseResolveBlock, rejecter: @escaping RCTPromiseRejectBlock) {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key
        ]
        
        let status = SecItemDelete(query as CFDictionary)
        
        if status == errSecSuccess || status == errSecItemNotFound {
            resolver(nil)
        } else {
            rejecter("REMOVAL_FAILED", "Failed to remove item: \(status)", NSError(domain: NSOSStatusErrorDomain, code: Int(status)))
        }
    }
    
    @objc
    func clear(_ resolver: @escaping RCTPromiseResolveBlock, rejecter: @escaping RCTPromiseRejectBlock) {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service
        ]
        
        let status = SecItemDelete(query as CFDictionary)
        
        if status == errSecSuccess || status == errSecItemNotFound {
            resolver(nil)
        } else {
            rejecter("CLEAR_FAILED", "Failed to clear storage: \(status)", NSError(domain: NSOSStatusErrorDomain, code: Int(status)))
        }
    }
    
    private func deleteItem(key: String) {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key
        ]
        SecItemDelete(query as CFDictionary)
    }
}

import { SecureStorage } from './SecureStorage';

describe('SecureStorage', () => {
  let secureStorage: SecureStorage;

  beforeEach(() => {
    secureStorage = new SecureStorage();
  });

  it('should store and retrieve data securely', async () => {
    const testData = 'sensitive_data';
    await secureStorage.setItem('test_key', testData);
    const retrieved = await secureStorage.getItem('test_key');
    expect(retrieved).toBe(testData);
  });

  it('should throw error on invalid key', async () => {
    await expect(secureStorage.getItem('')).rejects.toThrow();
  });

  it('should remove item correctly', async () => {
    await secureStorage.setItem('test', 'data');
    await secureStorage.removeItem('test');
    const result = await secureStorage.getItem('test');
    expect(result).toBeNull();
  });
});

// BridgeSecurity.ts
// Production-ready bridge communication security

import { NativeModules } from 'react-native';

interface BridgeMessage {
    action: string;
    data: any;
    timestamp: number;
    signature?: string;
}

class BridgeSecurity {
    private static readonly ALLOWED_ACTIONS = [
        'getSecureData',
        'storeSecureData',
        'validateToken'
    ];
    
    /**
     * Validate bridge message before processing
     */
    static validateMessage(message: BridgeMessage): boolean {
        // Check action is allowed
        if (!this.ALLOWED_ACTIONS.includes(message.action)) {
            console.error(`Unauthorized bridge action: ${message.action}`);
            return false;
        }
        
        // Validate timestamp (prevent replay attacks)
        const now = Date.now();
        const messageAge = now - message.timestamp;
        if (messageAge > 60000 || messageAge < 0) { // 1 minute window
            console.error('Message timestamp invalid');
            return false;
        }
        
        // Validate data structure
        if (!message.data || typeof message.data !== 'object') {
            console.error('Invalid message data');
            return false;
        }
        
        return true;
    }
    
    /**
     * Sanitize data before sending to native
     */
    static sanitizeData(data: any): any {
        if (typeof data === 'string') {
            // Remove potentially dangerous characters
            return data.replace(/[<>\"']/g, '');
        }
        
        if (Array.isArray(data)) {
            return data.map(item => this.sanitizeData(item));
        }
        
        if (typeof data === 'object' && data !== null) {
            const sanitized: any = {};
            for (const key in data) {
                if (data.hasOwnProperty(key)) {
                    sanitized[key] = this.sanitizeData(data[key]);
                }
            }
            return sanitized;
        }
        
        return data;
    }
}

// Secure bridge wrapper
export class SecureBridge {
    private static nativeModule = NativeModules.SecureNativeModule;
    
    /**
     * Send secure message to native module
     */
    static async sendSecureMessage(action: string, data: any): Promise<any> {
        const message: BridgeMessage = {
            action,
            data: BridgeSecurity.sanitizeData(data),
            timestamp: Date.now()
        };
        
        if (!BridgeSecurity.validateMessage(message)) {
            throw new Error('Invalid bridge message');
        }
        
        try {
            return await this.nativeModule.handleMessage(message);
        } catch (error) {
            console.error('Bridge communication failed:', error);
            throw error;
        }
    }
}

// InputValidator.ts
// Production-ready input validation and sanitization

export class InputValidator {
    /**
     * Validate and sanitize user input
     */
    static validateInput(input: string, type: 'email' | 'url' | 'text' | 'number'): {
        valid: boolean;
        sanitized?: string;
        error?: string;
    } {
        if (!input || typeof input !== 'string') {
            return { valid: false, error: 'Invalid input type' };
        }
        
        switch (type) {
            case 'email':
                return this.validateEmail(input);
            case 'url':
                return this.validateURL(input);
            case 'number':
                return this.validateNumber(input);
            default:
                return this.validateText(input);
        }
    }
    
    private static validateEmail(email: string) {
        const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
        const sanitized = email.trim().toLowerCase();
        
        if (!emailRegex.test(sanitized)) {
            return { valid: false, error: 'Invalid email format' };
        }
        
        // Check for XSS attempts
        if (sanitized.includes('<') || sanitized.includes('>')) {
            return { valid: false, error: 'Invalid characters in email' };
        }
        
        return { valid: true, sanitized };
    }
    
    private static validateURL(url: string) {
        try {
            const urlObj = new URL(url);
            // Only allow https
            if (urlObj.protocol !== 'https:') {
                return { valid: false, error: 'Only HTTPS URLs allowed' };
            }
            return { valid: true, sanitized: urlObj.href };
        } catch {
            return { valid: false, error: 'Invalid URL format' };
        }
    }
    
    private static validateNumber(input: string) {
        const num = parseFloat(input);
        if (isNaN(num)) {
            return { valid: false, error: 'Invalid number' };
        }
        return { valid: true, sanitized: num.toString() };
    }
    
    private static validateText(text: string) {
        // Remove potentially dangerous characters
        const sanitized = text
            .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
            .replace(/<[^>]+>/g, '')
            .trim();
        
        if (sanitized.length === 0) {
            return { valid: false, error: 'Empty input after sanitization' };
        }
        
        return { valid: true, sanitized };
    }
}

// SecureStorage.test.ts
import { SecureStorage } from './SecureStorage';

describe('SecureStorage', () => {
    let storage: SecureStorage;
    
    beforeEach(() => {
        storage = new SecureStorage();
    });
    
    it('should store and retrieve values', async () => {
        await storage.setItem('test-key', 'test-value');
        const value = await storage.getItem('test-key');
        expect(value).toBe('test-value');
    });
    
    it('should throw error for invalid key', async () => {
        await expect(storage.setItem('', 'value')).rejects.toThrow();
    });
    
    it('should remove items', async () => {
        await storage.setItem('test-key', 'value');
        await storage.removeItem('test-key');
        const value = await storage.getItem('test-key');
        expect(value).toBeNull();
    });
});

#!/bin/bash
# React Native Security Cleanup Script
# Production-ready cleanup for build artifacts and sensitive data

set -euo pipefail

echo "Cleaning React Native build artifacts..."

# Clean iOS build
if [ -d "ios" ]; then
    cd ios
    xcodebuild clean || true
    rm -rf build/
    rm -rf DerivedData/
    cd ..
fi

# Clean Android build
if [ -d "android" ]; then
    cd android
    ./gradlew clean || true
    rm -rf build/
    rm -rf .gradle/
    cd ..
fi

# Clean node modules cache
rm -rf node_modules/.cache
rm -rf .metro/

# Remove sensitive files
find . -name "*.key" -delete
find . -name "*.pem" -delete
find . -name ".env.local" -delete

echo "Cleanup complete"