Use of Unsafe Serialization API

[asegurola]

Report

SDK Version

6.12.2

Please provide any other relevant information.

One static code analysis tool we use for our iOS app is throwing a warning related to the AppsFlyer SDK features. The title of the warning is "Use of Unsafe Serialization API Exposes App to Remote Code Execution"

The evidence provided by the tool that points to appsflyer is:

{
  "type": "data",
  "method": "+[NSKeyedUnarchiver unarchiveObjectWithData:]",
  "object": "{     \"af_message\" = \"organic install\";     \"af_status\" = Organic;     \"install_time\" = \"2024-03-25 12:10:39.520\";     \"is_first_launch\" = 0; }",
  "filename": "",
  ":hashcode": "qdk8Af4vg+pcIaNWhuiZjw==",
  "metadata": {
    "evidenceKey": [
      "qdk8Af4vg+pcIaNWhuiZjw=="
    ]
  }
}

It basically says to avoid using the deprecated unarchiveObjectWithData and unarchiveObjectWithFile methods and to refer to https://developer.apple.com/documentation/foundation/nssecurecoding?language=objc for details on the proper way to do it.

[jinaiyuanbaojie]

same issue here. kindly support us