iOS: add CodePushDiffManifest for parsing diff manifests

[ofalvai]

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[Copilot]

🟡 Changes recommended

The parser silently accepts several malformed version and collection values, potentially interpreting manifests incorrectly.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds iOS support for parsing versioned diff manifests and safely resolving manifest paths.

Changes:

• Adds diff-manifest models, parsing, and secure path resolution.
• Adds unit tests for parsing and path traversal.
• Registers implementation and tests with Xcode targets.

File summaries

File	Description
ios/CodePushTests/CodePushTests-Bridging-Header.h	Exposes the manifest API to Swift tests.
ios/CodePushTests/CodePushDiffManifestTests.swift	Tests parsing and path safety.
ios/CodePush/CodePushDiffManifest.m	Implements manifest parsing and path resolution.
ios/CodePush/CodePushDiffManifest.h	Defines manifest models and APIs.
ios/CodePush.xcodeproj/project.pbxproj	Adds sources and tests to Xcode targets.

Review details

Suppressed comments (2)

ios/CodePush/CodePushDiffManifest.m:118

• A present but non-array deletedFiles value is currently treated exactly like an omitted field, so malformed input such as {"deletedFiles":"old.js"} parses successfully and silently retains files that the manifest intended to remove. Reject non-null values of the wrong container type before applying the optional-field default.

    NSArray *deletedFilesJSON = json[@"deletedFiles"];
    NSMutableArray<NSString *> *deletedFiles = [NSMutableArray array];
    if ([deletedFilesJSON isKindOfClass:[NSArray class]]) {

ios/CodePush/CodePushDiffManifest.m:130

• A present patchedFiles value with the wrong container type is silently converted to an empty dictionary. For a version 2 update this skips every declared binary patch rather than reporting a malformed manifest, which can leave copied old-package bytes in the candidate update. Reject non-null, non-dictionary values before parsing entries.

    NSDictionary *patchedFilesJSON = json[@"patchedFiles"];
    NSMutableDictionary<NSString *, CodePushPatchedFileEntry *> *patchedFiles = [NSMutableDictionary dictionary];
    if ([patchedFilesJSON isKindOfClass:[NSDictionary class]]) {

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.