search

microsoftconnect / intune-app-wrapping-tool-ios

This is the software for the Intune App Wrapping Tool for iOS.
55 stars 12 forks source link

Wrapped IPA files lose NSAppTransportSecurity settings #76

Closed ryanliljestrom closed 2 years ago

ryanliljestrom commented 2 years ago

Describe the bug: Wrapped .ipa files always have their Info.plist modified to allow arbitrary HTTP requests

To Reproduce Steps to reproduce the behavior:

  1. Build an .ipa where the Info.plist file either:
    1. Does not have any NSAppTransportSecurity set or
    2. Has NSAppTransportSecurity set to something other than just NSAllowsArbitraryLoads = YES
  2. Wrap the .ipa file
  3. Unzip the wrapped .ipa file and examine the embedded Info.plist file

Expected behavior: The NSAppTransportSecurity section of the wrapped .ipa will match the NSAppTransportSecurity section of the unwrapped .ipa

Intune app wrapping tool (please complete the following information):

Additional context: I haven't found anything in the documentation to suggest why the wrapping tool modifies the Info.plist file to allow arbitrary loads. We are also looking into adding Identity Pinning to our app, but the entirety of the NSAppTransportSecurity section of our Info.plist file is wiped out by the wrapping tool.

Kyle-Reis commented 2 years ago

Hi @ryanliljestrom - The app wrapping tool enables NSAllowsArbitraryLoads because of some old requirements of the ADAL authentication library which are no longer applicable. The app wrapper will still need to enable a different setting (NSAllowsArbitraryLoadsInWebContent) to ensure any applications which use SFSafariViewController work properly, however doing so should not clear the pre-defined settings under NSAppTransportSecurity. We'll address these issues in the next minor release.

Kyle-Reis commented 2 years ago

Hi @ryanliljestrom - This issue should be addressed in our latest release (16.0.0)