AppsFlyerSDK / AppsFlyerFramework

AppsFlyer Apple SDK
https://support.appsflyer.com/hc/en-us/articles/207032066-AppsFlyer-SDK-Integration-iOS
Other
173 stars 92 forks source link

Use of Unsafe Serialization API #273

Open asegurola opened 7 months ago

asegurola commented 7 months ago

Report

SDK Version

6.12.2

Please provide any other relevant information.

One static code analysis tool we use for our iOS app is throwing a warning related to the AppsFlyer SDK features. The title of the warning is "Use of Unsafe Serialization API Exposes App to Remote Code Execution"

The evidence provided by the tool that points to appsflyer is:

{
  "type": "data",
  "method": "+[NSKeyedUnarchiver unarchiveObjectWithData:]",
  "object": "{     \"af_message\" = \"organic install\";     \"af_status\" = Organic;     \"install_time\" = \"2024-03-25 12:10:39.520\";     \"is_first_launch\" = 0; }",
  "filename": "",
  ":hashcode": "qdk8Af4vg+pcIaNWhuiZjw==",
  "metadata": {
    "evidenceKey": [
      "qdk8Af4vg+pcIaNWhuiZjw=="
    ]
  }
}

It basically says to avoid using the deprecated unarchiveObjectWithData and unarchiveObjectWithFile methods and to refer to https://developer.apple.com/documentation/foundation/nssecurecoding?language=objc for details on the proper way to do it.

jinaiyuanbaojie commented 5 months ago

same issue here. kindly support us