Fixed upload/download encrypted file API (#383)

fix: Fixed upload/download encrypted file API.

Fixed upload/download encrypted file API. When file is encrypted application/octet-stream data format is enforced regardless of original file type (image/jpeg, video/mp4, text/plain) or server's suggested Content-Type from generateUploadUrl.

fix: Removed redundant buffering when parsing encrypted data.

* PubNub SDK v12.0.1 release.

---------

Co-authored-by: PubNub Release Bot <120067856+pubnub-release-bot@users.noreply.github.com>

Author: marcin-cebo

.pubnub.yml

@@ -1,9 +1,9 @@
 name: kotlin
-version: 12.0.0
+version: 12.0.1
 schema: 1
 scm: github.com/pubnub/kotlin
 files:
-  - build/libs/pubnub-kotlin-12.0.0-all.jar
+  - build/libs/pubnub-kotlin-12.0.1-all.jar
 sdks:
   - 
       type: library
@@ -23,8 +23,8 @@ sdks:
             -
               distribution-type: library
               distribution-repository: maven
-              package-name: pubnub-kotlin-12.0.0
-              location: https://repo.maven.apache.org/maven2/com/pubnub/pubnub-kotlin/12.0.0/pubnub-kotlin-12.0.0.jar
+              package-name: pubnub-kotlin-12.0.1
+              location: https://repo.maven.apache.org/maven2/com/pubnub/pubnub-kotlin/12.0.1/pubnub-kotlin-12.0.1.jar
               supported-platforms:
                 supported-operating-systems:
                   Android:
@@ -121,6 +121,13 @@ sdks:
                   license-url: https://www.apache.org/licenses/LICENSE-2.0.txt
                   is-required: Required
 changelog:
+  - date: 2025-11-19
+    version: v12.0.1
+    changes:
+      - type: bug
+        text: "Fixed upload/download encrypted file API. When file is encrypted application/octet-stream data format is enforced regardless of original file type (image/jpeg, video/mp4, text/plain) or server's suggested Content-Type from generateUploadUrl."
+      - type: bug
+        text: "Removed redundant buffering when parsing encrypted data."
   - date: 2025-11-10
     version: v12.0.0
     changes:

CHANGELOG.md

@@ -1,3 +1,10 @@
+## v12.0.1
+November 19 2025
+
+#### Fixed
+- Fixed upload/download encrypted file API. When file is encrypted application/octet-stream data format is enforced regardless of original file type (image/jpeg, video/mp4, text/plain) or server's suggested Content-Type from generateUploadUrl.
+- Removed redundant buffering when parsing encrypted data.
+
 ## v12.0.0
 November 10 2025
 

README.md

@@ -20,7 +20,7 @@ You will need the publish and subscribe keys to authenticate your app. Get your
      <dependency>
         <groupId>com.pubnub</groupId>
         <artifactId>pubnub-kotlin</artifactId>
-        <version>12.0.0</version>
+        <version>12.0.1</version>
      </dependency>
      ```
 

gradle.properties

@@ -18,7 +18,7 @@ RELEASE_SIGNING_ENABLED=true
 SONATYPE_HOST=DEFAULT
 SONATYPE_AUTOMATIC_RELEASE=false
 GROUP=com.pubnub
-VERSION_NAME=12.0.0
+VERSION_NAME=12.0.1
 POM_PACKAGING=jar
 
 POM_NAME=PubNub SDK

pubnub-kotlin/pubnub-kotlin-impl/src/integrationTest/kotlin/com/pubnub/api/integration/FilesIntegrationTest.kt

@@ -31,6 +31,111 @@ class FilesIntegrationTest : BaseIntegrationTest() {
         uploadListDownloadDelete(false)
     }
 
+    @Test
+    fun legacyEncryptedFileTransfer() {
+        uploadListDownloadDeleteFileWithCipher(true)
+    }
+
+    @Test
+    fun aesCbcEncryptedFileTransfer() {
+        uploadListDownloadDeleteFileWithCipher(false)
+    }
+
+    fun uploadListDownloadDeleteFileWithCipher(withLegacyCrypto: Boolean) {
+        if (withLegacyCrypto) {
+            clientConfig = {
+                cryptoModule = CryptoModule.createLegacyCryptoModule("enigma")
+            }
+        } else {
+            clientConfig = {
+                cryptoModule = CryptoModule.createAesCbcCryptoModule("enigma")
+            }
+        }
+
+        val channel: String = randomChannel()
+        val fileName = "logback.xml"
+        val message = "This is message"
+        val meta = "This is meta"
+        val customMessageType = "myCustomType"
+
+        // Read the logback.xml file from resources
+        val logbackResource = this.javaClass.classLoader.getResourceAsStream("logback.xml")
+            ?: throw IllegalStateException("logback.xml not found in resources")
+        val originalContent = logbackResource.readBytes()
+        val originalContentString = String(originalContent, StandardCharsets.UTF_8)
+
+        val connectedLatch = CountDownLatch(1)
+        val fileEventReceived = CountDownLatch(1)
+        pubnub.addListener(
+            object : SubscribeCallback() {
+                override fun status(
+                    pubnub: PubNub,
+                    status: PNStatus,
+                ) {
+                    if (status.category == PNStatusCategory.PNConnectedCategory) {
+                        connectedLatch.countDown()
+                    }
+                }
+
+                override fun file(
+                    pubnub: PubNub,
+                    result: PNFileEventResult,
+                ) {
+                    if (result.file.name == fileName && result.customMessageType == customMessageType) {
+                        fileEventReceived.countDown()
+                    }
+                }
+            },
+        )
+        pubnub.subscribe(channels = listOf(channel))
+        connectedLatch.await(10, TimeUnit.SECONDS)
+
+        val sendResult: PNFileUploadResult? =
+            ByteArrayInputStream(originalContent).use {
+                pubnub.sendFile(
+                    channel = channel,
+                    fileName = fileName,
+                    inputStream = it,
+                    message = message,
+                    meta = meta,
+                    customMessageType = customMessageType
+                ).sync()
+            }
+
+        if (sendResult == null) {
+            Assert.fail()
+            return
+        }
+        fileEventReceived.await(10, TimeUnit.SECONDS)
+
+        val (_, _, _, data) = pubnub.listFiles(channel = channel).sync()
+        val fileFoundOnList = data.find { it.id == sendResult.file.id } != null
+        Assert.assertTrue(fileFoundOnList)
+
+        val (_, byteStream) =
+            pubnub.downloadFile(
+                channel = channel,
+                fileName = fileName,
+                fileId = sendResult.file.id,
+            ).sync()
+
+        byteStream?.use {
+            val downloadedContent = it.readBytes()
+            val downloadedString = String(downloadedContent, StandardCharsets.UTF_8)
+            Assert.assertEquals(
+                "Downloaded content should match original logback.xml",
+                originalContentString,
+                downloadedString
+            )
+        }
+
+        pubnub.deleteFile(
+            channel = channel,
+            fileName = fileName,
+            fileId = sendResult.file.id,
+        ).sync()
+    }
+
     @Test
     fun testSendFileAndDeleteFileOnChannelEntity() {
         val sendFileResultReference: AtomicReference<PNFileUploadResult> = AtomicReference()
@@ -205,6 +310,126 @@ class FilesIntegrationTest : BaseIntegrationTest() {
         ).sync()
     }
 
+    @Test
+    fun uploadLargeEncryptedFileWithLegacyCryptoModule() {
+        uploadLargeEncryptedFileWithCryptoModule(withLegacyCrypto = true)
+    }
+
+    @Test
+    fun uploadLargeEncryptedFileWithAesCbcCryptoModule() {
+        uploadLargeEncryptedFileWithCryptoModule(withLegacyCrypto = false)
+    }
+
+    fun uploadLargeEncryptedFileWithCryptoModule(withLegacyCrypto: Boolean) {
+        clientConfig = {
+            cryptoModule = CryptoModule.createLegacyCryptoModule("enigma")
+        }
+        val channel: String = randomChannel()
+        val fileName = "large_file_${System.currentTimeMillis()}.bin"
+
+        // Create a large binary file (1MB) to test encryption
+        val largeContent = ByteArray(1024 * 1024) { it.toByte() }
+
+        val sendResult: PNFileUploadResult? =
+            ByteArrayInputStream(largeContent).use {
+                pubnub.sendFile(
+                    channel = channel,
+                    fileName = fileName,
+                    inputStream = it,
+                    message = "Large encrypted file test",
+                ).sync()
+            }
+
+        if (sendResult == null) {
+            Assert.fail("Failed to upload large encrypted file")
+            return
+        }
+
+        // Download and verify
+        val (_, byteStream) =
+            pubnub.downloadFile(
+                channel = channel,
+                fileName = fileName,
+                fileId = sendResult.file.id,
+            ).sync()
+
+        byteStream?.use {
+            val downloadedContent = it.readBytes()
+            Assert.assertArrayEquals(
+                "Downloaded encrypted content should match original",
+                largeContent,
+                downloadedContent
+            )
+        }
+
+        // Cleanup
+        pubnub.deleteFile(
+            channel = channel,
+            fileName = fileName,
+            fileId = sendResult.file.id,
+        ).sync()
+    }
+
+    @Test
+    fun uploadMultipleSizesWithEncryption() {
+        clientConfig = {
+            cryptoModule = CryptoModule.createLegacyCryptoModule("enigma")
+        }
+        val channel: String = randomChannel()
+
+        val testSizes = listOf(
+            100, // Small file
+            1024, // 1KB
+            10240, // 10KB
+            102400, // 100KB
+            524288 // 512KB
+        )
+
+        for (size in testSizes) {
+            val fileName = "test_${size}_${System.currentTimeMillis()}.bin"
+            val content = ByteArray(size) { (it % 256).toByte() }
+
+            val sendResult: PNFileUploadResult? =
+                ByteArrayInputStream(content).use {
+                    pubnub.sendFile(
+                        channel = channel,
+                        fileName = fileName,
+                        inputStream = it,
+                        message = "Test file size: $size",
+                    ).sync()
+                }
+
+            if (sendResult == null) {
+                Assert.fail("Failed to upload file of size $size")
+                return
+            }
+
+            // Download and verify
+            val (_, byteStream) =
+                pubnub.downloadFile(
+                    channel = channel,
+                    fileName = fileName,
+                    fileId = sendResult.file.id,
+                ).sync()
+
+            byteStream?.use {
+                val downloadedContent = it.readBytes()
+                Assert.assertArrayEquals(
+                    "Downloaded content should match original for size $size",
+                    content,
+                    downloadedContent
+                )
+            }
+
+            // Cleanup
+            pubnub.deleteFile(
+                channel = channel,
+                fileName = fileName,
+                fileId = sendResult.file.id,
+            ).sync()
+        }
+    }
+
     private fun readToString(inputStream: InputStream): String {
         Scanner(inputStream).useDelimiter("\\A").use { s ->
             return if (s.hasNext()) {

pubnub-kotlin/pubnub-kotlin-impl/src/main/kotlin/com/pubnub/internal/crypto/cryptor/HeaderParser.kt

@@ -36,12 +36,11 @@ internal class HeaderParser(val logConfig: LogConfig?) {
     )
 
     fun parseDataWithHeader(stream: BufferedInputStream): ParseResult<out InputStream> {
-        val bufferedInputStream = stream.buffered()
-        bufferedInputStream.mark(Int.MAX_VALUE) // TODO Can be calculated from spec
+        stream.mark(Int.MAX_VALUE) // TODO Can be calculated from spec
         val possibleInitialHeader = ByteArray(MINIMAL_SIZE_OF_CRYPTO_HEADER)
-        val initiallyRead = bufferedInputStream.read(possibleInitialHeader)
+        val initiallyRead = stream.read(possibleInitialHeader)
         if (!possibleInitialHeader.sliceArray(SENTINEL_STARTING_INDEX..SENTINEL_ENDING_INDEX).contentEquals(SENTINEL)) {
-            bufferedInputStream.reset()
+            stream.reset()
             return ParseResult.NoHeader
         }
 
@@ -58,17 +57,17 @@ internal class HeaderParser(val logConfig: LogConfig?) {
 
         val cryptorData: ByteArray =
             if (cryptorDataSizeFirstByte == THREE_BYTES_SIZE_CRYPTOR_DATA_INDICATOR) {
-                val cryptorDataSizeBytes = readExactlyNBytez(bufferedInputStream, 2)
+                val cryptorDataSizeBytes = readExactlyNBytez(stream, 2)
                 val cryptorDataSize = convertTwoBytesToIntBigEndian(cryptorDataSizeBytes[0], cryptorDataSizeBytes[1])
-                readExactlyNBytez(bufferedInputStream, cryptorDataSize)
+                readExactlyNBytez(stream, cryptorDataSize)
             } else {
                 if (cryptorDataSizeFirstByte == UByte.MIN_VALUE) {
                     byteArrayOf()
                 } else {
-                    readExactlyNBytez(bufferedInputStream, cryptorDataSizeFirstByte.toInt())
+                    readExactlyNBytez(stream, cryptorDataSizeFirstByte.toInt())
                 }
             }
-        return ParseResult.Success(cryptorId, cryptorData, bufferedInputStream)
+        return ParseResult.Success(cryptorId, cryptorData, stream)
     }
 
     private fun readExactlyNBytez(
@@ -130,9 +129,9 @@ internal class HeaderParser(val logConfig: LogConfig?) {
         val finalCryptorDataSize: ByteArray =
             if (cryptorDataSize < THREE_BYTES_SIZE_CRYPTOR_DATA_INDICATOR.toInt()) {
                 byteArrayOf(cryptorDataSize.toByte()) // cryptorDataSize will be stored on 1 byte
-            } else if (cryptorDataSize < MAX_VALUE_THAT_CAN_BE_STORED_ON_TWO_BYTES) {
-                // cryptorDataSize will be stored on 3 byte
-                byteArrayOf(cryptorDataSize.toByte()) + writeNumberOnTwoBytes(cryptorDataSize)
+            } else if (cryptorDataSize <= MAX_VALUE_THAT_CAN_BE_STORED_ON_TWO_BYTES) {
+                // cryptorDataSize will be stored on 3 bytes: indicator (255) + 2 bytes for actual size
+                byteArrayOf(THREE_BYTES_SIZE_CRYPTOR_DATA_INDICATOR.toByte()) + writeNumberOnTwoBytes(cryptorDataSize)
             } else {
                 throw PubNubException(
                     errorMessage = "Cryptor Data Size is: $cryptorDataSize whereas max cryptor data size is: $MAX_VALUE_THAT_CAN_BE_STORED_ON_TWO_BYTES",

pubnub-kotlin/pubnub-kotlin-impl/src/main/kotlin/com/pubnub/internal/endpoints/files/SendFileEndpoint.kt

@@ -86,14 +86,15 @@ class SendFileEndpoint internal constructor(
     ): ExtendedRemoteAction<PNFileUploadResult> {
         val result = AtomicReference<FileUploadRequestDetails>()
 
+        val isEncrypted = cryptoModule != null
         val content =
             cryptoModule?.encryptStream(InputStreamSeparator(inputStream))?.use {
                 it.readBytes()
             } ?: inputStream.readBytes()
         return ComposableRemoteAction.firstDo(generateUploadUrlFactory.create(channel, fileName)) // 1. generateUrl
             .then { res ->
                 result.set(res)
-                sendFileToS3Factory.create(fileName, content, res) // 2. upload to s3
+                sendFileToS3Factory.create(fileName, content, res, isEncrypted) // 2. upload to s3
             }.checkpoint().then {
                 val details = result.get()
                 publishFileMessageFactory.create( // 3. PublishFileMessage