Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Completing NSSecureCoding Support #12343

Closed
k4ety opened this issue Feb 1, 2024 · 1 comment
Closed

Completing NSSecureCoding Support #12343

k4ety opened this issue Feb 1, 2024 · 1 comment
Assignees

Comments

@k4ety
Copy link

k4ety commented Feb 1, 2024

Description

This PR addressed most of the requirements to support NSSecureCoding. In order to take advantage of this, all instances of [ decodeObjectForKey:] should be replaced with [ decodeObjectOfClass: forKey:] or its cohorts, and
- requiresSecureCoding should be implemented and respond with YES (Apple documentation).

FIRMessagingAPNSInfo.m and FIRMessagingTokenInfo.m both are currently using [ decodeObjectForKey:] with subsequent checks to make sure they got what they were expecting. While this is a start at preventing object substitution attacks, potentially bad objects are still decoded, and any security code scan still spots the insecure
[ decodeObjectForKey:] statements.

Firebase SDK Version

10.21

Xcode Version

15.1

Installation Method

CocoaPods

Firebase Product(s)

Messaging

Targeted Platforms

iOS

@google-oss-bot
Copy link

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

@paulb777 paulb777 added this to the Firebase 11 milestone Jun 5, 2024
@paulb777 paulb777 self-assigned this Jun 5, 2024
@paulb777 paulb777 closed this as completed Jun 5, 2024
@firebase firebase locked and limited conversation to collaborators Jul 9, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

3 participants