Skip to content

Validate Obj-C class when reading objects from user defaults / plists #2782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: 2.x
Choose a base branch
from
Open

Validate Obj-C class when reading objects from user defaults / plists #2782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fa65d2a
Validate Obj-C class when reading objects from user defaults / plists
zorgiepoo Oct 11, 2025
76ee7ee
Handle converting NSString -> NSNumber for info/default keys
zorgiepoo Oct 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Autoupdate/SUPlainInstaller.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,7 +328,7 @@ - (BOOL)performInitialInstallation:(NSError * __autoreleasing *)error

NSBundle *bundle = [NSBundle bundleWithPath:_bundlePath];
SUHost *updateHost = [[SUHost alloc] initWithBundle:bundle];
NSString *updateVersion = [updateHost objectForInfoDictionaryKey:(__bridge NSString *)kCFBundleVersionKey];
NSString *updateVersion = [updateHost objectForInfoDictionaryKey:(__bridge NSString *)kCFBundleVersionKey ofClass:NSString.class];

id<SUVersionComparison> comparator = [[SUStandardVersionComparator alloc] init];
if (!updateVersion || [comparator compareVersion:hostVersion toVersion:updateVersion] == NSOrderedDescending) {
Expand Down
6 changes: 3 additions & 3 deletions Sparkle/SPUSkippedUpdate.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@ - (instancetype)initWithMinorVersion:(nullable NSString *)minorVersion majorVers

+ (nullable SPUSkippedUpdate *)skippedUpdateForHost:(SUHost *)host
{
NSString *minorVersion = [host objectForUserDefaultsKey:SUSkippedMinorVersionKey];
NSString *majorVersion = [host objectForUserDefaultsKey:SUSkippedMajorVersionKey];
NSString *majorSubreleaseVersion = [host objectForUserDefaultsKey:SUSkippedMajorSubreleaseVersionKey];
NSString *minorVersion = [host objectForUserDefaultsKey:SUSkippedMinorVersionKey ofClass:NSString.class];
NSString *majorVersion = [host objectForUserDefaultsKey:SUSkippedMajorVersionKey ofClass:NSString.class];
NSString *majorSubreleaseVersion = [host objectForUserDefaultsKey:SUSkippedMajorSubreleaseVersionKey ofClass:NSString.class];

if (minorVersion != nil || majorVersion != nil) {
return [[SPUSkippedUpdate alloc] initWithMinorVersion:minorVersion majorVersion:majorVersion majorSubreleaseVersion:majorSubreleaseVersion];
Expand Down
18 changes: 9 additions & 9 deletions Sparkle/SPUUpdater.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ - (BOOL)startUpdater:(NSError * __autoreleasing *)error
// We perform this check one runloop cycle after starting the updater to give the developer
// a chance to call -clearFeedURLFromUserDefaults before this warning can show up
if (self->_updatingMainBundle) {
NSString *appcastUserDefaultsString = [self->_host objectForUserDefaultsKey:SUFeedURLKey];
NSString *appcastUserDefaultsString = [self->_host objectForUserDefaultsKey:SUFeedURLKey ofClass:NSString.class];
if (appcastUserDefaultsString != nil) {
SULog(SULogLevelError, @"Warning: A feed URL was found stored in user defaults for %@. This was likely set using -[SPUUpdater setFeedURL:] which is deprecated. Please migrate away from using this API and call -[SPUUpdater clearFeedURLFromUserDefaults] to remove any stored defaults, otherwise Sparkle may continue to use the feed stored from the defaults. If the feed url was set via a defaults write command for testing purposes, then please ignore this warning.", self->_host.name);
}
Expand Down Expand Up @@ -307,7 +307,7 @@ - (BOOL)checkIfConfiguredProperlyAndRequireFeedURL:(BOOL)requireFeedURL validate

BOOL foundATSMainBundleIssue = NO;
if (!foundATSPersistentIssue && !foundXPCDownloaderService) {
BOOL foundATSIssue = ([mainBundleHost objectForInfoDictionaryKey:@"NSAppTransportSecurity"] == nil);
BOOL foundATSIssue = ([mainBundleHost objectForInfoDictionaryKey:@"NSAppTransportSecurity" ofClass:NSDictionary.class] == nil);

if (_updatingMainBundle) {
// The only way we'll know for sure if there is an issue is if the main bundle is the same as the one we're updating
Expand Down Expand Up @@ -400,7 +400,7 @@ - (void)startUpdateCycle SPU_OBJC_DIRECT

// If the user has been asked about automatic checks or the developer has overridden the setting, don't bother prompting
// When the user answers to the permission prompt, this will be set to either @YES or @NO instead of nil
if ([_host objectForKey:SUEnableAutomaticChecksKey] != nil) {
if ([_host boolNumberForKey:SUEnableAutomaticChecksKey] != nil) {
shouldPrompt = NO;
}
// Does the delegate want to take care of the logic for when we should ask permission to update?
Expand Down Expand Up @@ -480,7 +480,7 @@ - (NSDate *)lastUpdateCheckDate

if (_updateLastCheckedDate == nil)
{
_updateLastCheckedDate = [_host objectForUserDefaultsKey:SULastCheckTimeKey];
_updateLastCheckedDate = [_host objectForUserDefaultsKey:SULastCheckTimeKey ofClass:NSDate.class];
}

return _updateLastCheckedDate;
Expand Down Expand Up @@ -659,7 +659,7 @@ - (void)checkForUpdatesInBackground

if (_updatingMainBundle) {
// Check if Sparkle is configured to ask the user's permission to enable automatic update checks
NSNumber *automaticChecksInInfoPlist = [_host objectForInfoDictionaryKey:SUEnableAutomaticChecksKey];
NSNumber *automaticChecksInInfoPlist = [_host boolNumberForInfoDictionaryKey:SUEnableAutomaticChecksKey];
if (automaticChecksInInfoPlist == nil) {
// Check if automatic update checking is disabled or if the user hasn't given permission for Sparkle to check
BOOL automaticChecksInDefaults = [self automaticallyChecksForUpdates];
Expand Down Expand Up @@ -1080,7 +1080,7 @@ - (nullable NSURL *)clearFeedURLFromUserDefaults
SULog(SULogLevelError, @"Error: -[SPUUpdater clearFeedURLFromUserDefaults] must be called on the main thread.");
}

NSString *appcastString = [_host objectForUserDefaultsKey:SUFeedURLKey];
NSString *appcastString = [_host objectForUserDefaultsKey:SUFeedURLKey ofClass:NSString.class];

[_host setObject:nil forUserDefaultsKey:SUFeedURLKey];

Expand Down Expand Up @@ -1124,7 +1124,7 @@ - (NSURL * _Nullable)retrieveFeedURL:(NSError * __autoreleasing *)error SPU_OBJC
}

// Delegate gets first priority for determining the feed URL
NSString *appcastString = [_host objectForKey:SUFeedURLKey];
NSString *appcastString = [_host objectForKey:SUFeedURLKey ofClass:NSString.class];
id<SPUUpdaterDelegate> delegate = _delegate;
if ([delegate respondsToSelector:@selector((feedURLStringForUpdater:))]) {
NSString *delegateAppcastString = [delegate feedURLStringForUpdater:self];
Expand All @@ -1136,7 +1136,7 @@ - (NSURL * _Nullable)retrieveFeedURL:(NSError * __autoreleasing *)error SPU_OBJC
// A value in the user defaults overrides one in the Info.plist
// (as this used to be used for setting alternative feed URLs but is now deprecated)
if (appcastString == nil) {
appcastString = [_host objectForKey:SUFeedURLKey];
appcastString = [_host objectForKey:SUFeedURLKey ofClass:NSString.class];
}

if (appcastString == nil) { // Can't find an appcast string!
Expand Down Expand Up @@ -1222,7 +1222,7 @@ - (NSURL * _Nullable)parameterizedFeedURL SPU_OBJC_DIRECT

// Let's only send the system profiling information once per week at most, so we normalize daily-checkers vs. biweekly-checkers and the such.
if (sendingSystemProfile) {
NSDate *lastSubmitDate = [_host objectForUserDefaultsKey:SULastProfileSubmitDateKey];
NSDate *lastSubmitDate = [_host objectForUserDefaultsKey:SULastProfileSubmitDateKey ofClass:NSDate.class];
if (!lastSubmitDate) {
lastSubmitDate = [NSDate distantPast];
}
Expand Down
10 changes: 5 additions & 5 deletions Sparkle/SPUUpdaterSettings.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,12 +175,12 @@ + (BOOL)automaticallyNotifiesObserversOfAutomaticallyChecksForUpdates
- (NSTimeInterval)currentUpdateCheckInterval SPU_OBJC_DIRECT
{
// Find the stored check interval. User defaults override Info.plist.
id intervalValue = [_host objectForKey:SUScheduledCheckIntervalKey];
if (intervalValue == nil || ![(NSObject *)intervalValue isKindOfClass:[NSNumber class]]) {
NSNumber *intervalValue = [_host doubleNumberForKey:SUScheduledCheckIntervalKey];
if (intervalValue == nil) {
return SUDefaultUpdateCheckInterval;
}

return [(NSNumber *)intervalValue doubleValue];
return intervalValue.doubleValue;
}

- (void)setUpdateCheckInterval:(NSTimeInterval)updateCheckInterval
Expand All @@ -207,8 +207,8 @@ + (BOOL)automaticallyNotifiesObserversOfUpdateCheckInterval
// For allowing automatic downloaded updates to be turned on or off
- (NSNumber * _Nullable)allowsAutomaticUpdatesOption
{
NSNumber *developerAllowsAutomaticUpdates = [_host objectForInfoDictionaryKey:SUAllowsAutomaticUpdatesKey];
return [developerAllowsAutomaticUpdates isKindOfClass:[NSNumber class]] ? developerAllowsAutomaticUpdates : nil;
NSNumber *developerAllowsAutomaticUpdates = [_host boolNumberForInfoDictionaryKey:SUAllowsAutomaticUpdatesKey];
return developerAllowsAutomaticUpdates;
}

- (BOOL)allowsAutomaticUpdates
Expand Down
14 changes: 11 additions & 3 deletions Sparkle/SUHost.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,14 +39,22 @@ SUHostDefinitionAttribute

@property (nonatomic, readonly) BOOL hasUpdateSecurityPolicy;

- (nullable id)objectForInfoDictionaryKey:(NSString *)key;
- (nullable id)objectForInfoDictionaryKey:(NSString *)key ofClass:(Class)aClass;
- (nullable NSNumber *)boolNumberForInfoDictionaryKey:(NSString *)key;
- (BOOL)boolForInfoDictionaryKey:(NSString *)key;
- (nullable id)objectForUserDefaultsKey:(NSString *)defaultName;
- (nullable NSNumber *)doubleNumberForInfoDictionaryKey:(NSString *)key;

- (nullable id)objectForUserDefaultsKey:(NSString *)defaultName ofClass:(Class)aClass;
- (void)setObject:(nullable id)value forUserDefaultsKey:(NSString *)defaultName;
- (nullable NSNumber *)boolNumberForUserDefaultsKey:(NSString *)key;
- (BOOL)boolForUserDefaultsKey:(NSString *)defaultName;
- (void)setBool:(BOOL)value forUserDefaultsKey:(NSString *)defaultName;
- (nullable id)objectForKey:(NSString *)key;
- (nullable NSNumber *)doubleNumberForUserDefaultsKey:(NSString *)key;

- (nullable id)objectForKey:(NSString *)key ofClass:(Class)aClass;
- (nullable NSNumber *)boolNumberForKey:(NSString *)key;
- (BOOL)boolForKey:(NSString *)key;
- (nullable NSNumber *)doubleNumberForKey:(NSString *)key;

- (void)observeChangesFromUserDefaultKeys:(NSSet<NSString *> *)keyPaths changeHandler:(void (^)(NSString *))changeHandler;

Expand Down
Loading