firebase / quickstart-ios

Firebase Quickstart Samples for iOS
https://firebase.google.com
Apache License 2.0
2.8k stars 1.47k forks source link

Insecure IPC: URL Scheme Hijacking #1593

Open Sneha0523 opened 6 months ago

Sneha0523 commented 6 months ago

Summary The application uses custom URL schemes for Inter-Procedure Communication (IPC) which is subject to "URL Scheme Hijacking".

Explanation Applications may register custom URL schemes for third party applications to communicate with them. Although this is a simple IPC channel, it may expose your application to "URL Scheme Hijacking". Since any application can register a URL scheme as long as it is not reserved by Apple, a malicious application may register the same scheme used by your application which results in an undefined behavior. According to Apple's documentation: "If more than one third party app registers to handle the same URL scheme, there is currently no process for determining which app will be given that scheme". If the malicious application is installed before your application, it may register the scheme and prevent your application from installing successfully. Alternatively, if the malicious application is installed after your application and it succeeds in the scheme registration, it may hijack it from your application.

Path usr/local/share/agentWork/app/App_iOS-2/Pods/GoogleUtilities/GoogleUtilities/AppDelegateSwizzler/Public/GoogleUtilities/GULAppDelegateSwizzler.h : 26

Screenshot 2024-05-28 at 5 32 16 PM Screenshot 2024-05-28 at 2 55 17 PM