Change unarchiveObjectWithFile in FIAM to conform to the secure codin…

…g practices (#9834) * Changed unarchiveObjectWithFile with unarchivedObjectOfClass, added supportsSecureCoding (#9816) * Addressed review feedback * Run style script * Changed unarchivedObjectOfClass to unarchivedObjectOfClasses * Added to changelog, changed NSArray to NSMutableArray
firebase · May 24, 2022 · ba4bf76 · ba4bf76
1 parent b638192
commit ba4bf76
Show file tree

Hide file tree

Showing 4 changed files with 38 additions and 5 deletions.
diff --git a/FirebaseInAppMessaging/CHANGELOG.md b/FirebaseInAppMessaging/CHANGELOG.md
@@ -1,3 +1,6 @@
+# Unreleased
+- [changed] Replaced unarchiveObjectWithFile with unarchivedObjectOfClass to conform to secure coding practices, and implemented NSSecureCoding (#9816).
+
 # 8.12.0
 - [fixed] In-App Messaging's test message does not include appData in response. This SDK fix will work once the backend is also updated (#9126).
 

diff --git a/FirebaseInAppMessaging/Sources/Analytics/FIRIAMClearcutLogStorage.m b/FirebaseInAppMessaging/Sources/Analytics/FIRIAMClearcutLogStorage.m
@@ -166,10 +166,23 @@ - (void)loadFromCachePath:(NSString *)cacheFilePath {
   NSString *filePath = cacheFilePath == nil ? [self.class determineCacheFilePath] : cacheFilePath;
 
   NSTimeInterval start = [self.timeFetcher currentTimestampInSeconds];
+  id fetchedClearcutRetryRecords;
+  NSData *data = [NSData dataWithContentsOfFile:filePath];
+  if (data) {
+    if (@available(macOS 10.13, iOS 11.0, tvOS 11.0, *)) {
+      fetchedClearcutRetryRecords = [NSKeyedUnarchiver
+          unarchivedObjectOfClasses:[NSSet setWithObjects:[FIRIAMClearcutLogRecord class],
+                                                          [NSMutableArray class], nil]
+                           fromData:data
+                              error:nil];
+    } else {
+      // Fallback on earlier versions
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
-  id fetchedClearcutRetryRecords = [NSKeyedUnarchiver unarchiveObjectWithFile:filePath];
+      fetchedClearcutRetryRecords = [NSKeyedUnarchiver unarchiveObjectWithFile:filePath];
 #pragma clang diagnostic pop
+    }
+  }
   if (fetchedClearcutRetryRecords) {
     @synchronized(self) {
       self.records = (NSMutableArray<FIRIAMClearcutLogRecord *> *)fetchedClearcutRetryRecords;

diff --git a/FirebaseInAppMessaging/Sources/Flows/FIRIAMActivityLogger.m b/FirebaseInAppMessaging/Sources/Flows/FIRIAMActivityLogger.m
@@ -30,13 +30,17 @@ @implementation FIRIAMActivityRecord
 static NSString *const kTimeStampArchiveKey = @"timestamp";
 static NSString *const kDetailArchiveKey = @"detail";
 
++ (BOOL)supportsSecureCoding {
+  return YES;
+}
+
 - (id)initWithCoder:(NSCoder *)decoder {
   self = [super init];
   if (self != nil) {
     _activityType = [decoder decodeIntegerForKey:kActiveTypeArchiveKey];
-    _timestamp = [decoder decodeObjectForKey:kTimeStampArchiveKey];
+    _timestamp = [decoder decodeObjectOfClass:[NSDate class] forKey:kTimeStampArchiveKey];
     _success = [decoder decodeBoolForKey:kIsSuccessArchiveKey];
-    _detail = [decoder decodeObjectForKey:kDetailArchiveKey];
+    _detail = [decoder decodeObjectOfClass:[NSString class] forKey:kDetailArchiveKey];
   }
   return self;
 }
@@ -150,10 +154,23 @@ + (NSString *)determineCacheFilePath {
 
 - (void)loadFromCachePath:(NSString *)cacheFilePath {
   NSString *filePath = cacheFilePath == nil ? [self.class determineCacheFilePath] : cacheFilePath;
+  id fetchedActivityRecords;
+  NSData *data = [NSData dataWithContentsOfFile:filePath];
+  if (data) {
+    if (@available(macOS 10.13, iOS 11.0, tvOS 11.0, *)) {
+      fetchedActivityRecords = [NSKeyedUnarchiver
+          unarchivedObjectOfClasses:[NSSet setWithObjects:[FIRIAMActivityRecord class],
+                                                          [NSMutableArray class], nil]
+                           fromData:data
+                              error:nil];
+    } else {
+      // Fallback on earlier versions
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
-  id fetchedActivityRecords = [NSKeyedUnarchiver unarchiveObjectWithFile:filePath];
+      fetchedActivityRecords = [NSKeyedUnarchiver unarchiveObjectWithFile:filePath];
 #pragma clang diagnostic pop
+    }
+  }
   if (fetchedActivityRecords) {
     @synchronized(self) {
       self.activityRecords = (NSMutableArray<FIRIAMActivityRecord *> *)fetchedActivityRecords;

diff --git a/FirebaseInAppMessaging/Sources/Private/Flows/FIRIAMActivityLogger.h b/FirebaseInAppMessaging/Sources/Private/Flows/FIRIAMActivityLogger.h
@@ -29,7 +29,7 @@ typedef NS_ENUM(NSInteger, FIRIAMActivityType) {
 };
 
 NS_ASSUME_NONNULL_BEGIN
-@interface FIRIAMActivityRecord : NSObject <NSCoding>
+@interface FIRIAMActivityRecord : NSObject <NSSecureCoding>
 @property(nonatomic, nonnull, readonly) NSDate *timestamp;
 @property(nonatomic, readonly) FIRIAMActivityType activityType;
 @property(nonatomic, readonly) BOOL success;