Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switch to Secure Object Archiving APIs #1259

Open
guraghav opened this issue Jul 25, 2022 · 0 comments
Open

Switch to Secure Object Archiving APIs #1259

guraghav opened this issue Jul 25, 2022 · 0 comments

Comments

@guraghav
Copy link

Hello,

Created this issue to address the vulnerability with using NSCoding. The NSCoding does not verify the type of object upon deserialization and therefore is vulnerable to object substitution attacks.

To mitigate this vulnerability, Apple introduced the NSSecureCoding protocol along with the following secure methods of NSKeyedArchiver and NSKeyedUnarchiver, which are robust against this type of attack:

// Secure NSKeyedUnarchiver methods
- (instancetype)initForReadingFromData:(NSData *)data error:(NSError **)error;
+ (id)unarchivedObjectOfClass:(Class)cls fromData:(NSData *)data error:(NSError **)error;
+ (id)unarchivedObjectOfClasses:(NSSet<Class> *)classes fromData:(NSData *)data error:(NSError **)error;

// Secure NSKeyedArchiver methods
- (instancetype)initRequiringSecureCoding:(BOOL)requiresSecureCoding;
+ (NSData *)archivedDataWithRootObject:(id)object requiringSecureCoding:(BOOL)requiresSecureCoding error:(NSError **)error;

Apple provides more information in the WWDC20 session, 'Securing Your App'.

The places where unsecure NSKeyedArchiver and NSKeyedUnarchiver is called :

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant