fix: validate setServiceMutatorType mask input

The proceed bitmask is bridged from JS as a double and was narrowed to
int (Android) / NSInteger (iOS) with an unchecked cast. A fractional,
NaN/Infinity, or out-of-32-bit-range value was silently truncated or
coerced and could install a proceed policy other than the caller's
intent (security-relevant: the mask decides which failure statuses may
proceed). Reject such masks before applying the mutator on both
platforms. Adds Android and iOS native regression tests.

Author: ivolz

CHANGELOG.md

@@ -4,6 +4,7 @@
 - **iOS `approov.plist` is now optional (fixes a launch crash)**: When Approov is initialized natively from a bundled `approov.config`, the iOS module no longer raises `ApproovPropsNotFound` at launch if a bundled `approov.plist` is absent. It now logs and runs with default properties, matching the Android layer where a missing `approov.props` is tolerated. This lets an `approov.config`-only native integration run without shipping an empty placeholder `approov.plist`. A present-but-unreadable plist still raises, since that indicates a genuine misconfiguration. (Reported by PropertyGuru.)
 - **Added — JS-selectable request policy (security-relevant)**: New `ApproovService.setServiceMutatorType(mask, { sign })` method plus `ApproovService.ReturnDecision` bit flags and `ApproovService.MutatorPreset` presets let an app choose the per-status proceed/block policy — and whether the outbound request is still HTTP Message Signed — entirely from JavaScript, with no native mutator code. The `mask` lists which Approov **failure** statuses may proceed; a failure status not in the mask blocks the request, surfacing identically on both platforms as a failed `fetch()` (`IOException` / `Network request failed` on Android, an `NSError` failure on iOS). Named presets (`DEFAULT`, `ALWAYS_PROCEED`, `PROCEED_IF_UNAVAILABLE`, `PROCEED_DEV_CLEARTEXT`) cover the common cases; the development-only `PROCEED_DEV_CLEARTEXT` forwards Metro's cleartext dev bundle, which the SDK reports as `BAD_URL` (issue #30). **Security caveat:** proceeding on `MITM_DETECTED` or `REJECTED` disables the protection those statuses provide, so keep those bits out of production masks unless you fully intend to. Pair with `setUseApproovStatusIfNoToken(true)` to surface the failure status to the backend in the token header. Behaviour is identical on Android and iOS.
 - **Fixed — service mutator now resets on re-initialization (security-relevant)**: A configuration-change re-initialization previously left a custom service mutator installed; it now resets to the built-in message-signing default on both Android and iOS whenever the config actually changes. A same-config re-init still preserves the installed mutator, so re-apply `setServiceMutatorType` after a config-change re-init if you still need a custom policy.
+- **Hardened — `setServiceMutatorType` mask validation (security-relevant)**: The proceed bitmask is bridged from JavaScript as a floating-point number and is now rejected on both Android and iOS unless it is a finite, integral, 32-bit value. A fractional, `NaN`/`Infinity`, or out-of-range mask would previously have been silently truncated or coerced by the native narrowing cast, potentially installing a policy other than the one intended; such inputs now reject the promise instead of being applied. Covered by new Android and iOS native regression tests. (Copilot review, PR #32.)
 
 ## [3.5.15] - 2026-07-01
 - **Gradle 9 Compatibility Fix**: Migrated the Android build from the unmaintained `com.github.johnrengelman.shadow` plugin 8.1.1 to the maintained fork `com.gradleup.shadow` 8.3.11. The old plugin fails on Gradle 9 with `MissingPropertyException: No such property: mode` (Gradle 9 removed `FileCopyDetails.mode`), halting the whole application build. The replacement uses the same `ShadowJar` task class and produces an identical shaded BouncyCastle jar; verified on Gradle 8.8, 8.10.2, and 9.0.0. Minimum supported Gradle remains 8.3 (React Native 0.76+ ships 8.10+), so no consumer action is required beyond updating the package.

android/src/main/java/io/approov/reactnative/ApproovService.java

@@ -265,6 +265,19 @@ public static ApproovServiceMutator getServiceMutator() {
     @ReactMethod
     public void setServiceMutatorType(double maskDouble, boolean sign, Promise promise) {
         try {
+            // The mask is bridged from JavaScript as a double. Reject any value that is
+            // not a finite, integral, 32-bit quantity before narrowing to int: a
+            // fractional value (e.g. 1.5), NaN/Infinity, or an out-of-range magnitude
+            // would otherwise be silently truncated or coerced by the (int) cast and
+            // could install a policy other than the one the caller intended. This is
+            // security-relevant: the mask decides which failure statuses may proceed.
+            if (Double.isNaN(maskDouble) || Double.isInfinite(maskDouble)
+                    || maskDouble != Math.floor(maskDouble)
+                    || maskDouble < Integer.MIN_VALUE || maskDouble > Integer.MAX_VALUE) {
+                promise.reject("setServiceMutatorType",
+                        "invalid mutator mask: expected a finite 32-bit integer bitmask, got " + maskDouble);
+                return;
+            }
             int mask = (int) maskDouble;
             if (mask == MUTATOR_PRESET_DEFAULT) {   // restore out-of-box signing default (sign flag N/A)
                 ApproovDefaultMessageSigning signer = new ApproovDefaultMessageSigning();

android/src/test/java/io/approov/reactnative/ApproovServicePublicApiTest.java

@@ -256,6 +256,55 @@ public void isInterceptorActiveReturnsFalseWhenNoApproovInterceptorIsPresent() {
         }
     }
 
+    // Regression for the setServiceMutatorType mask validation (Copilot review, PR #32).
+    // The proceed bitmask is bridged from JavaScript as a double; a non-finite, fractional,
+    // or out-of-32-bit-range value must be rejected before it is narrowed to int, so it can
+    // never be silently coerced into an unintended (security-relevant) proceed policy.
+    @Test
+    public void setServiceMutatorTypeRejectsNonFiniteOrNonIntegralMasks() {
+        double[] invalidMasks = {
+            1.5,                              // fractional
+            Double.NaN,                       // not a number
+            Double.POSITIVE_INFINITY,         // +infinity
+            Double.NEGATIVE_INFINITY,         // -infinity
+            (double) Integer.MAX_VALUE + 1.0, // above the signed 32-bit range
+            (double) Integer.MIN_VALUE - 1.0, // below the signed 32-bit range
+        };
+        try (MockedStatic<Approov> approov = mockStatic(Approov.class)) {
+            for (double mask : invalidMasks) {
+                Promise promise = mock(Promise.class);
+
+                newService().setServiceMutatorType(mask, true, promise);
+
+                org.mockito.Mockito.verify(promise)
+                    .reject(org.mockito.ArgumentMatchers.eq("setServiceMutatorType"), anyString());
+                org.mockito.Mockito.verify(promise, org.mockito.Mockito.never()).resolve(any());
+            }
+        }
+    }
+
+    // The guard must not reject a well-formed mask: the DEFAULT sentinel (-1), an all-block
+    // mask (0), and a composed in-range bitmask all pass validation and resolve.
+    @Test
+    public void setServiceMutatorTypeAcceptsValidIntegralMasks() {
+        double[] validMasks = {
+            -1.0, // MUTATOR_PRESET_DEFAULT — restore the built-in signing default
+            0.0,  // block every maskable failure status
+            (double) (PolicyMutator.BIT_NO_NETWORK | PolicyMutator.BIT_POOR_NETWORK),
+        };
+        try (MockedStatic<Approov> approov = mockStatic(Approov.class)) {
+            for (double mask : validMasks) {
+                Promise promise = mock(Promise.class);
+
+                newService().setServiceMutatorType(mask, true, promise);
+
+                org.mockito.Mockito.verify(promise).resolve(any());
+                org.mockito.Mockito.verify(promise, org.mockito.Mockito.never())
+                    .reject(org.mockito.ArgumentMatchers.eq("setServiceMutatorType"), anyString());
+            }
+        }
+    }
+
     private boolean hasPinHash(CertificatePinner pinner, String expectedHashBase64) throws Exception {
         for (Object pin : pinner.getPins()) {
             Object hash = pin.getClass().getMethod("getHash").invoke(pin);

ios/ApproovService.m

@@ -484,7 +484,23 @@ - (instancetype)init {
                   resolver : (RCTPromiseResolveBlock)resolve
                   rejecter : (RCTPromiseRejectBlock)reject) {
   @try {
-    NSInteger maskValue = (NSInteger)mask;
+    // The mask is bridged from JavaScript as a double. Reject any value that is
+    // not a finite, integral, 32-bit quantity before narrowing: a fractional
+    // value (e.g. 1.5), NaN/Infinity, or an out-of-range magnitude would
+    // otherwise be silently truncated or coerced and could install a policy
+    // other than the one the caller intended. This is security-relevant: the
+    // mask decides which failure statuses may proceed. The in-range check is
+    // evaluated first so the round-trip cast that verifies integrality is only
+    // reached for values already known to be within int32_t range.
+    if (!(mask >= INT32_MIN && mask <= INT32_MAX) || mask != (double)(int32_t)mask) {
+      reject(@"setServiceMutatorType",
+             [NSString stringWithFormat:
+                          @"invalid mutator mask: expected a finite 32-bit integer bitmask, got %g",
+                          mask],
+             nil);
+      return;
+    }
+    int32_t maskValue = (int32_t)mask;
     if (maskValue == -1) {
       // MutatorPreset.DEFAULT: restore the built-in message-signing default.
       [[ApproovServiceMutatorBridge shared] resetToDefault];

tests/ios/native/ApproovNativeTests.m

@@ -63,6 +63,10 @@ - (void)isInitialized:(RCTPromiseResolveBlock)resolve
              rejecter:(RCTPromiseRejectBlock)reject;
 - (void)isApproovEnabled:(RCTPromiseResolveBlock)resolve
                 rejecter:(RCTPromiseRejectBlock)reject;
+- (void)setServiceMutatorType:(double)mask
+                         sign:(BOOL)sign
+                     resolver:(RCTPromiseResolveBlock)resolve
+                     rejecter:(RCTPromiseRejectBlock)reject;
 @end
 
 @implementation RCTTestNetworkDelegate
@@ -651,6 +655,59 @@ static void TestNSURLSessionExposesStatusHeaderWhenTokenMissingAndAllowed(void)
   [NSURLProtocol unregisterClass:[CaptureProtocol class]];
 }
 
+// Regression for the setServiceMutatorType mask validation (Copilot review, PR #32).
+// The proceed bitmask is bridged from JavaScript as a double; a non-finite, fractional,
+// or out-of-32-bit-range value must be rejected before it is narrowed, so it can never be
+// silently coerced into an unintended (security-relevant) proceed policy. A well-formed
+// mask (including the DEFAULT sentinel -1) must still be accepted. This mirrors the Android
+// ApproovServicePublicApiTest coverage so both platforms enforce identical behaviour.
+static void TestSetServiceMutatorTypeValidatesMask(void) {
+  const double invalidMasks[] = {
+      1.5,           // fractional
+      NAN,           // not a number
+      INFINITY,      // +infinity
+      -INFINITY,     // -infinity
+      2147483648.0,  // 2^31, above the signed 32-bit range
+      -2147483649.0  // -(2^31) - 1, below the signed 32-bit range
+  };
+  for (size_t i = 0; i < sizeof(invalidMasks) / sizeof(invalidMasks[0]); i++) {
+    ApproovService *service = FreshService();
+    __block BOOL didResolve = NO;
+    __block NSString *rejectionCode = nil;
+    [service setServiceMutatorType:invalidMasks[i]
+                              sign:YES
+                          resolver:^(__unused id value) { didResolve = YES; }
+                          rejecter:^(NSString *code, __unused NSString *message,
+                                     __unused NSError *error) { rejectionCode = code; }];
+    AssertTrue(!didResolve,
+               [NSString stringWithFormat:@"invalid mask %g should not resolve",
+                                          invalidMasks[i]]);
+    AssertEqualObjects(@"setServiceMutatorType", rejectionCode,
+               [NSString stringWithFormat:@"invalid mask %g should reject with setServiceMutatorType",
+                                          invalidMasks[i]]);
+  }
+
+  const double validMasks[] = {
+      -1.0,  // MutatorPreset.DEFAULT — restore the built-in signing default
+      0.0,   // block every maskable failure status
+      20.0   // BIT_NO_NETWORK (1 << 3) | BIT_POOR_NETWORK (1 << 4)
+  };
+  for (size_t i = 0; i < sizeof(validMasks) / sizeof(validMasks[0]); i++) {
+    ApproovService *service = FreshService();
+    __block BOOL didResolve = NO;
+    __block NSString *rejectionCode = nil;
+    [service setServiceMutatorType:validMasks[i]
+                              sign:YES
+                          resolver:^(__unused id value) { didResolve = YES; }
+                          rejecter:^(NSString *code, __unused NSString *message,
+                                     __unused NSError *error) { rejectionCode = code; }];
+    AssertTrue(didResolve,
+               [NSString stringWithFormat:@"valid mask %g should resolve", validMasks[i]]);
+    AssertTrue(rejectionCode == nil,
+               [NSString stringWithFormat:@"valid mask %g should not reject", validMasks[i]]);
+  }
+}
+
 int main(void) {
   @autoreleasepool {
     NSArray<void (^)(void)> *tests = @[
@@ -666,6 +723,7 @@ int main(void) {
       ^{ TestReactFetchStylePoorNetworkReturnsSyntheticResponseWithoutRecursion(); },
       ^{ TestFetchWithApproovRejectsInvalidURLs(); },
       ^{ TestNSURLSessionExposesStatusHeaderWhenTokenMissingAndAllowed(); },
+      ^{ TestSetServiceMutatorTypeValidatesMask(); },
     ];
 
     for (void (^testBlock)(void) in tests) {