search

Giphy / giphy-ios-sdk

Home of the GIPHY SDK iOS example app, along with iOS SDK documentation, issue tracking, & release notes.
https://developers.giphy.com/
Mozilla Public License 2.0
116 stars 52 forks source link

Switch from Unsafe Serialization API to NSSecureCoding #236

Open tmrff opened 1 year ago

tmrff commented 1 year ago

We use the GIPHY iOS xcframework within an iOS app. We recently performed a security scan using Datatherom. The scan results reported that the GIPHY framework contains code that leverages NSCoding, which is known to be vulnerable to object substitution attacks.

The scan revealed that the _TtC10GiphyUISDK11GPHCategory class in the binary conforms to NSCoding.

The NSCoding protocol is not a recommended approach for secure coding. Apple itself suggests using NSSecureCoding instead, which helps to ensure that the serialized and deserialized instances are of the same class.

Please consider migrating to NSSecureCoding if it's feasible.

cgmaier commented 1 year ago

hey @ThomasR39 sorry for the late reply here. Thanks for getting this on our radar!