Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Issue #294 NSAllowsArbitraryLoads flag set to false #362

Merged
merged 1 commit into from May 14, 2021

Conversation

idhruvs
Copy link
Contributor

@idhruvs idhruvs commented Jan 28, 2021

Based on the comments of the author of terminal-notifier, this flag was initially set to true to allow using icons with http link, however, given the security issues raised by code-analysers, it is a good practice to disable usage of http.

…void security issues raised by code-analysers
@mikaelbr
Copy link
Owner

mikaelbr commented Feb 1, 2021

Hi! So this looks like it would be a new breaking change, right? No longer supporting HTTP images as icons

@idhruvs
Copy link
Contributor Author

idhruvs commented Feb 3, 2021

Yes. This would be a breaking change.
However, even the Apple Developer Documentation cautions in using a "true" for this flag.


Important

You must supply a justification during App Store review if you set the key’s value to YES, as described in Provide Justification for Exceptions. Use this key with caution because it significantly reduces the security of your app. In most cases, it’s better to upgrade your servers to meet the requirements imposed by ATS, or at least to use a narrower exception.

@Ctharp11
Copy link

Ctharp11 commented Apr 7, 2021

Can this be merged? This package is failing a security scan and Apple recommends setting this flag to false. Security is more important than icons. Icons can also be sent over https.

@mikaelbr mikaelbr merged commit 14af678 into mikaelbr:master May 14, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants