Skip to content

Commit a7f1786

Browse files
fix: replace deprecated NSKeyedArchiver/NSKeyedUnarchiver APIs with modern equivalents
The deprecated `+[NSKeyedUnarchiver unarchiveObjectWithData:]` and `+[NSKeyedArchiver archivedDataWithRootObject:]` methods are flagged as unsafe by security scanners (CWE-676). Replace them with instance-based `NSKeyedUnarchiver` and `archivedDataWithRootObject:requiringSecureCoding:error:` which are available since iOS 11.0 (the SDK minimum deployment target). Resolves #919
1 parent 28f7907 commit a7f1786

1 file changed

Lines changed: 11 additions & 4 deletions

File tree

iOS_SDK/OneSignalSDK/OneSignalCore/Source/OneSignalUserDefaults.m

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -152,14 +152,21 @@ - (void)saveObjectForKey:(NSString * _Nonnull)key withValue:(id _Nullable)object
152152
}
153153

154154
- (id _Nullable)getSavedCodeableDataForKey:(NSString * _Nonnull)key defaultValue:(id _Nullable)value {
155-
if ([self keyExists:key])
156-
return [NSKeyedUnarchiver unarchiveObjectWithData:[self.userDefaults objectForKey:key]];
157-
155+
if ([self keyExists:key]) {
156+
NSData *data = [self.userDefaults objectForKey:key];
157+
NSKeyedUnarchiver *unarchiver = [[NSKeyedUnarchiver alloc] initForReadingFromData:data error:nil];
158+
unarchiver.requiresSecureCoding = NO;
159+
id result = [unarchiver decodeTopLevelObjectAndReturnError:nil];
160+
[unarchiver finishDecoding];
161+
return result;
162+
}
163+
158164
return value;
159165
}
160166

161167
- (void)saveCodeableDataForKey:(NSString * _Nonnull)key withValue:(id _Nullable)value {
162-
[self.userDefaults setObject:[NSKeyedArchiver archivedDataWithRootObject:value] forKey:key];
168+
NSData *data = [NSKeyedArchiver archivedDataWithRootObject:value requiringSecureCoding:NO error:nil];
169+
[self.userDefaults setObject:data forKey:key];
163170
[self.userDefaults synchronize];
164171
}
165172

0 commit comments

Comments
 (0)