Skip to content

Use of unsafe deserialization protocol NSCoding  #733

Open
@MichaelWellsSM

Description

@MichaelWellsSM

This is a serious violation of which many enterprise companies are now aware of; and request the use of alternative libraries if not fixed...

Issue
https://cwe.mitre.org/data/definitions/502.html

Effected files:
Screenshot 2024-09-11 at 11 45 01 AM

If these can be updated to use NSSecureCoding asap

Example:
self.path = [decoder decodeObjectForKey:@"path"]; For self.path = [decoder decodeObjectOfClass:NSString.self forKey:@"path"];

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions