[simonhamp]

Hardening for the parts of the bridge a web view can reach. These matter because routes/api.php is registered with no middleware (no CSRF, session or auth), and external navigations open in the system browser, so the attacker in scope is script running on the app's own origin: an XSS in the app, or a third-party script the app bundles. That script can POST freely to /_native/api/call and /_native/api/events.

Four fixes. The PHP-side changes ship in this package; the Swift/Kotlin/C changes only reach an app after native:install --force and a rebuild.

1. Seal async task payloads with the app key

The background runner used to unserialize() whatever it found in storage/framework/async/payload/<id>.task. Anything able to write that file could have the app run it.

The payload is now encrypted with Laravel's encrypter under the current app key, bound to a purpose prefix and the task id. The runner only runs a payload this app sealed for that task, and drops anything else (a planted file, a payload moved to another id, or something else the app key encrypted). readPayload() only looks up UUID ids, since the id becomes part of a path. An app with no app key can no longer dispatch async tasks; it fails through ->failed(). On device there is always a key.

2. Stop a web view page driving the async bridge

AsyncTask.Dispatch and AsyncTask.Complete are registered bridge functions, so a page could call them through /_native/api/call.

• The task id is spliced into PHP the async lane evaluates, so it must now be a UUID before it reaches that lane (refused in Swift, Kotlin and the C lane). A non-UUID id was a code-injection route.
• AsyncTask.Complete now only answers calls made on an async-lane thread, so a page can't post an arbitrary event into a native screen's runloop.
• The timeout path always posts AsyncTaskFailed with the task's own id; native no longer takes an event name from the call.
• NativeCallController refuses the AsyncTask. prefix from a web view.

3. Gate /_native/api/events to known event classes

DispatchEventFromAppController instantiated any class a page named, with named constructor arguments from the page, gated only by class_exists(). That is an arbitrary-object-instantiation gadget (for example SplFileObject in write mode truncates or creates a file at any writable path).

A new marker interface, Native\Mobile\Events\Contracts\DispatchableFromNative, is now required; the endpoint refuses any class that doesn't implement it. The 26 core device-event classes implement it, and BroadcastsGlobally extends it so app and plugin global events are unchanged.

Behaviour note (patch-level): a plugin that dispatches its own non-global event class through this endpoint must add the marker to that class.

4. Confine File.Move / File.Copy, and the /_assets path

File.Move and File.Copy are exposed in the JS bridge, so pages may call them, and they took unrestricted absolute paths. Separately, the iOS /_assets handler joined the URL path onto public/ without removing ...

• The file functions now canonicalise from/to (resolving .. and symlinks), require the source in temp/cache/storage and the destination in app storage, and refuse public/, .env, *.sqlite, bootstrap/cache, storage/framework and storage/logs. Legitimate capture-to-storage moves still work. This closes both the copy-into-public/-and-read-back exfil and the overwrite/DoS.
• PHPSchemeHandler (iOS) and PHPWebViewClient (Android) canonicalise the asset path and confine it to public/, so a request can't escape it.

Notes for review

• Affected versions: the async findings (1, 2) exist from 4.5.0; the events and file findings (3, 4) are older. Patched in 4.6.1.
• Tests: AsyncTaskBridgeTest, NativeCallControllerTest, AssetPathTraversalTest, FileFunctionsConfinementTest, plus additions to the async transport and completion tests. The new tests fail against main.
• Full Pest suite green, Pint and PHPStan clean. iOS Debug and unsigned Release built; Android release AAB built with the changed classes compiled and :app:testDebugUnitTest green. The iOS /_assets traversal fix was confirmed on a simulator (a crafted /_assets/.. request returns 404 instead of the file).

🤖 Generated with Claude Code