[android] FATAL EXCEPTION: decoding JWT token (when installing signed update)

[miqmago]

Description

Expected a fine restart after download and install succeeded.
All was working fine with cordova-plugin-webview@2.3.1 and started to crash with cordova-plugin-webview@4.1.3. Really weird because error is raised in native code SignedJWT.parse(jwt).
Crashes after restart and can't start again, entering in a crash loop with following error:

04-30 23:25:31.763 20170-20286/com.app E/AndroidRuntime: FATAL EXCEPTION: AsyncTask #4
    Process: com.app PID: 20170
    java.lang.RuntimeException: An error occurred while executing doInBackground()
        at android.os.AsyncTask$3.done(AsyncTask.java:309)
        at java.util.concurrent.FutureTask.finishCompletion(FutureTask.java:354)
        at java.util.concurrent.FutureTask.setException(FutureTask.java:223)
        at java.util.concurrent.FutureTask.run(FutureTask.java:242)
        at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:234)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
        at java.lang.Thread.run(Thread.java:818)
     Caused by: java.lang.NoClassDefFoundError: com.nimbusds.jose.util.Base64URL
        at com.nimbusds.jose.JOSEObject.split(JOSEObject.java:238)
        at com.nimbusds.jwt.SignedJWT.parse(SignedJWT.java:110)
        at com.microsoft.cordova.CodePush.verifyAndDecodeJWT(CodePush.java:176)
        at com.microsoft.cordova.CodePush.access$100(CodePush.java:40)
        at com.microsoft.cordova.CodePush$1.doInBackground(CodePush.java:134)
        at com.microsoft.cordova.CodePush$1.doInBackground(CodePush.java:116)
        at android.os.AsyncTask$2.call(AsyncTask.java:295)
        at java.util.concurrent.FutureTask.run(FutureTask.java:237)
        at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:234) 
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113) 
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588) 
        at java.lang.Thread.run(Thread.java:818) 

Reproduction

I've tried to place this logs on CodePush.java:

    private Map<String, Object> verifyAndDecodeJWT(String jwt, PublicKey publicKey) throws CodePushException {
        try {
            Log.d("*** HERETHELOG ***", jwt);
            SignedJWT signedJWT = SignedJWT.parse(jwt);
            Log.d("*** HERETHELOG ***", "ok");
            JWSVerifier verifier = new RSASSAVerifier((RSAPublicKey) publicKey);
            if (signedJWT.verify(verifier)) {
                Map<String, Object> claims = signedJWT.getJWTClaimsSet().getClaims();
                Utilities.logMessage("JWT verification succeeded, payload content: " + claims.toString());
                return claims;
            }
            throw new CodePushException("JWT verification failed: wrong signature");
        } catch (Exception e) {
            Log.d("*** HERETHELOG ***", e.getMessage());
            throw new CodePushException(e);
        }
    }

With following result:

04-30 23:33:29.662 20461-20461/com.app I/chromium: [INFO:CONSOLE(157)] "[CodePush] Verifying signature for folder path: /codepush/deploy/versions/64b7d1e211cda8fe7d38d953439437c6483f516279a7cc2e71ed4de90794a801/", source: http://localhost:8100/__ion-dev-server/ion-dev.js?v=3.2.4 (157)
04-30 23:33:29.668 20461-20601/com.appD/*** HERETHELOG ***: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJjbG...
04-30 23:33:29.670 20461-20601/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.util.Base64>

So it prints first log but not second one neither the third one. Strange thing because SignedJWT.parse(jwt) is inside a try{} catch {} block, but app crashes...

• I've tried to verify the jwt token with https://jwt.io/ and it seems the token can be parsed, content seems fine and the signature is valid.

• I've tried to remove cordova-plugin-push and install again with no success.

• I've tried to remove signature at all, recompile app and it works fine.

Also getting lots of this:

04-30 23:40:56.913 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.util.Base64>
04-30 23:40:56.913 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.util.Base64>
04-30 23:40:56.914 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.util.Base64URL>
04-30 23:40:56.914 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.util.Base64URL>
04-30 23:40:56.914 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.util.Base64URL>
04-30 23:40:56.916 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.Algorithm>
04-30 23:40:56.916 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.Algorithm>
04-30 23:40:56.917 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.Algorithm>
04-30 23:40:56.917 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.JWSAlgorithm>
04-30 23:40:56.917 20784-20929/com.app I/art: Rejecting re-init on previously-failed class java.lang.Class<com.nimbusds.jose.JWSAlgorithm>

I suppose one for each install intent.

Additional Information

• cordova-plugin-code-push version: 1.12.2

• List of installed plugins:
  code-push 3.0.1 "CodePushAcquisition"
  cordova-play-services-version-adapter 1.0.2 "Cordova/Ionic Google Play Services Versions Incompatibility Adapter"
  cordova-plugin-advanced-http 2.4.1 "Advanced HTTP plugin"
  cordova-plugin-app-version 0.1.9 "AppVersion"
  cordova-plugin-appcenter-analytics 0.5.1 "App Center Analytics for Cordova"
  cordova-plugin-appcenter-shared 0.5.1 "App Center shared code for Cordova"
  cordova-plugin-apprate 1.5.0 "AppRate"
  cordova-plugin-background-mode 0.7.3 "BackgroundMode"
  cordova-plugin-badge 0.8.8 "Badge"
  cordova-plugin-code-push 1.12.2 "CodePush"
  cordova-plugin-compat 1.2.0 "Compat"
  cordova-plugin-device 2.0.2 "Device"
  cordova-plugin-dialogs 2.0.1 "Notification"
  cordova-plugin-file 6.0.2 "File"
  cordova-plugin-file-transfer 1.6.3 "File Transfer"
  cordova-plugin-geolocation 4.0.2 "Geolocation"
  cordova-plugin-googleplus 7.0.1 "Google SignIn"
  cordova-plugin-health 1.0.5 "Cordova Health"
  cordova-plugin-inappbrowser 3.2.0 "InAppBrowser"
  cordova-plugin-ionic-keyboard 2.1.2 "cordova-plugin-ionic-keyboard"
  cordova-plugin-ionic-webview 4.1.3 "cordova-plugin-ionic-webview"
  cordova-plugin-iosrtc 6.0.9 "iosrtc"
  cordova-plugin-local-notification 0.9.0-beta.2 "LocalNotification"
  cordova-plugin-localization-strings 3.2.1 "Localization"
  cordova-plugin-media 5.0.3 "Media"
  cordova-plugin-nativestorage 2.3.2 "NativeStorage"
  cordova-plugin-network-information 2.0.1 "Network Information"
  cordova-plugin-screen-orientation 3.0.1 "Screen Orientation"
  cordova-plugin-splashscreen 5.0.2 "Splashscreen"
  cordova-plugin-statusbar 2.4.3 "StatusBar"
  cordova-plugin-vibration 3.1.1 "Vibration"
  cordova-plugin-whitelist 1.3.3 "Whitelist"
  cordova-plugin-zip 3.1.0 "cordova-plugin-zip"
  cordova-sqlite-storage 3.2.0 "Cordova sqlite storage plugin - cordova-sqlite-storage plugin version"
  cordova-support-google-services 1.1.0 "cordova-support-google-services"
  es6-promise-plugin 4.2.2 "Promise"
  phonegap-plugin-media-recorder 1.1.0 "Media Recorder"
  phonegap-plugin-media-stream 1.2.1 "MediaStream"
  phonegap-plugin-multidex 1.0.0 "Multidex"
  phonegap-plugin-push 2.2.3 "PushPlugin"

• Cordova version: android 8.1.0

• iOS/Android/Windows version: Android 6.0.1

• Does this reproduce on a debug build or release build? Both build and release

• Does this reproduce on a simulator, or only on a physical device? Physical device

[dpogue]

This also just started affecting one of my apps, did a CodePush update over the weekend and woke up to a tonne of crash reports and angry users.

It appears to be caused by the changes in #601
Downgrading the CodePush plugin to 1.12.1 works.

This is a pretty major issue, and it's rather disappointing that changes get released with apparently no testing on actual devices.
/cc @ahdbilal

[nakedgun]

Same issue. As @dpogue said, the only fix was downgrading to 1.12.1.

[alexandergoncharov-zz]

Hi all,
Thanks for reporting!

Unfortunately, I can't reproduce this issue. Could you please provide some demo app with reproducing issue and reprosteps? I would like to reproduce and investigate it.

[jacksonkr]

@alexandergoncharov I can also validate via #648

[Krasavinigor]

Hi there!
Sorry for the late response. Unfortunately, now we should slow down supporting. For more info, please check #666.

For this issue we created a new branch with a workaround: https://github.com/microsoft/cordova-plugin-code-push/tree/fix-signed-bundles-crashes. To install the latest version from this branch, you can use:
npm install https://github.com/microsoft/cordova-plugin-code-push.git#fix-signed-bundles-crashes

Thanks,
Igor

[brassier]

@Krasavinigor - Can you explain why this was done with a new branch, as opposed to an update to the main repo and a new release/update? Is this something that only impacts some apps, and thus only some people will need this new branch?

[Krasavinigor]

Hi @brassier! Sorry for the late response.
I created a new branch because it's only a workaround for fixing the signed issue. Now some customers have an issue with signing updates for Cordova/Ionic apps. The reason is PR: 601. But this PR also fixes another issue Bug: 600, which affected a few customers. So, this branch doesn't contain a full fix for both issues. Now we're making service more stable and don't have much time for developing and resolving these issues.

Thanks,
Igor

[ludufre]

Since #601 I have to undo that changes every re-add Android platform...

[jacksonkr]

@Krasavinigor I typically use cordova plug add [plugin name] to install my plugins. How can I go about installing the plugin by using this specific branch instead ? Cheers