Add XPC interface class allow-lists (Mac App Store)

[i2h3]

Part of: #9941

Problem

Apple's XPC security guidelines require that NSXPCInterface objects have explicit class allow-lists for any collection or object-type method arguments via setClasses:forSelector:argumentIndex:ofReply:. Without them the XPC layer accepts arbitrary Objective-C objects, which is a potential sandbox escape vector and will be flagged in security review.

Affected files

• src/gui/macOS/findersyncxpc_mac.mm
• shell_integration/MacOSX/NextcloudIntegration/FinderSyncExt/FinderSyncXPCManager.m
• shell_integration/MacOSX/NextcloudIntegration/FileProviderExt/FileProviderExtension+NSXPCListenerDelegate.swift

Required change

For every NSXPCInterface created in the above files, call setClasses:forSelector:argumentIndex:ofReply: to restrict the allowed classes to the minimal set actually required by each protocol.

[greatjourney589]

Hi, @i2h3 ,
Can I work on this issue?

[i2h3]

I just commented and noticed that I had #9934 in mind which is a different topic. 😅 If you would like to, let me know. You can.

[greatjourney589]

Thanks @i2h3 .