datatheorem / TrustKit

Easy SSL pinning validation and reporting for iOS, macOS, tvOS and watchOS.
MIT License
2k stars 360 forks source link

Fix for crash reported on iOS 17 #309

Closed darsang closed 11 months ago

darsang commented 12 months ago

In iOS 17 beta, the following crash was reported, this PR contains fix for the crash

Thread 13 name:   Dispatch queue: NSOperationQueue 0x1063289a0 (QOS: UNSPECIFIED)
Thread 13 Crashed:
0   ???                                         0x0 ???
1   privacy_Example                     0x100911bac verifyPublicKeyPin + 1168
2   privacy_Example                     0x100919250 -[TSKPinningValidator evaluateTrust:forHostname:] + 924
3   privacy_Example                     0x100919808 -[TSKPinningValidator handleChallenge:completionHandler:] + 348
darsang commented 11 months ago

ping @aj-dt, @nabla-c0d3 , @ericcastro

aj-dt commented 11 months ago

@darsang thank you for the submission. For baclwards compatibility, may I ask you to update the PR to make it conditional on the first path failing? E.g.

    void *_Security = dlopen("Security.framework/Security", RTLD_NOW);
    if (_Security == NULL) {
        _Security = dlopen("/System/Library/Frameworks/Security.framework/Security", RTLD_NOW);
    }

Thank you

darsang commented 11 months ago

@darsang thank you for the submission. For baclwards compatibility, may I ask you to update the PR to make it conditional on the first path failing? E.g.

    void *_Security = dlopen("Security.framework/Security", RTLD_NOW);
    if (_Security == NULL) {
        _Security = dlopen("/System/Library/Frameworks/Security.framework/Security", RTLD_NOW);
    }

Thank you

@aj-dt done

darsang commented 11 months ago

@aj-dt When can I expect a patch release for this?

aj-dt commented 11 months ago

Hi @darsang 3.0.3 contains your original fix: https://github.com/datatheorem/TrustKit/releases/tag/3.0.3 Thanks!

darsang commented 11 months ago

Hi @darsang 3.0.3 contains your original fix: https://github.com/datatheorem/TrustKit/releases/tag/3.0.3 Thanks!

Thanks