Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix/1079 #1120

Merged
merged 5 commits into from Jul 26, 2021
Merged

Fix/1079 #1120

merged 5 commits into from Jul 26, 2021

Conversation

maratal
Copy link
Collaborator

@maratal maratal commented May 20, 2021

When working on this issue please ensure to check other use of NSURLSession APIs as, for example, the sharedSession singleton is also problematic for the same reasons.

I did't find any other use of NSURLSession, except of the single one in ARTURLSessionServerTrust.m. Which is very good.

@maratal maratal linked an issue May 20, 2021 that may be closed by this pull request
Potentially insecure usage of the NSURLSession API #1079
Closed
@jamienewcomb
Copy link
Member

@maratal just seen this, is this ready for review ?

@maratal
Copy link
Collaborator Author

maratal commented Jun 6, 2021

@maratal just seen this, is this ready for review ?

Yep, but it should be reviewed together with ably-forks/SocketRocket#7
The fix itself is ready, but I've got no write access to SocketRocket fork (mentioned this on slack).

lukasz-szyszkowski
lukasz-szyszkowski reviewed Jun 7, 2021
View reviewed changes
Copy link
Contributor

@lukasz-szyszkowski lukasz-szyszkowski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one suggestion with conditions

@maratal maratal mentioned this pull request Jun 7, 2021
Merged
@lukasz-szyszkowski lukasz-szyszkowski merged commit 2556ab5 into main Jul 26, 2021
@lukasz-szyszkowski lukasz-szyszkowski deleted the fix/1079 branch July 26, 2021 05:59
@QuintinWillison QuintinWillison mentioned this pull request Feb 7, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lukasz-szyszkowski lukasz-szyszkowski lukasz-szyszkowski left review comments

@QuintinWillison QuintinWillison QuintinWillison approved these changes

@ricardopereira ricardopereira Awaiting requested review from ricardopereira

@ben-xD ben-xD Awaiting requested review from ben-xD

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Potentially insecure usage of the NSURLSession API
4 participants
@maratal @jamienewcomb @QuintinWillison @lukasz-szyszkowski