I am using checkmarx for security vulnerabilities in code. (react-native). I enabled deep linking in react-native using this guide from the official documentation for ios https://reactnative.dev/docs/linking. From the documentation i added this code to AppDelegate.m
- (BOOL)application:(UIApplication *)application
openURL:(NSURL *)url
options:(NSDictionary<UIApplicationOpenURLOptionsKey,id> *)options
{
return [RCTLinkingManager application:application openURL:url options:options];
}
However checkmarx reports that i need to sanitize or validate the url to prevent XSS attacks, any idea on how to achieve this?
To mitigate the XSS vulnerability in the code, you must URL encode the url argument by using the stringByAddingPercentEncodingWithAllowedCharacters method:
- (BOOL)application:(UIApplication *)application
openURL:(NSURL *)url
options:(NSDictionary<UIApplicationOpenURLOptionsKey,id> *)options
{
NSString *urlEncoded = [url stringByAddingPercentEncodingWithAllowedCharacters:[NSCharacterSet URLHostAllowedCharacterSet]];
return [RCTLinkingManager application:application openURL:urlEncoded options:options];
}
Related
I'm implementing Facebook SDK, it tells me to replace in AppDelegate.m with
- (BOOL)application:(UIApplication *)application
openURL:(NSURL *)url
options:(nonnull NSDictionary<UIApplicationOpenURLOptionsKey, id> *)options
{
But i see i already have the following:
- (BOOL)application:(UIApplication *)app
openURL:(NSURL *)url
options:(NSDictionary<UIApplicationOpenURLOptionsKey,id> *)options
{
which looks the exact same except for the application vs app. What is the difference? Can I safely change "app" to "application"?
I will accept a yes or no answer, but I would also appreciate any explanations.
The keyword labels are part of the selector (application:openURL:Options:), but the parameter names (to the right of the colon) are not. They're just the names internal to the method's implementation.
I've recently updated my build system to macOS 10.15 and Xcode 11.3.1 but when I try to compile one of my programs I get an "Expected a platform name, e.g., 'macos'" error and the build stops.
I've identified that this issue occurs only if I build with WebKit - if I comment out that code then the software builds and runs correctly (with the exception of the ability to display HTML, of course).
I wondered if the issue might be in my use of WebViews - which are deprecated - so I updated the code to WKWebView instead, and the problem still occurs. Of course, since I am getting this error, I don't know whether I've updated to WKWebView correctly or not - it won't run, and it doesn't show any other fault with this part of my code.
HTMLViewController.h:
#import <Cocoa/Cocoa.h>
#import <WebKit/WebKit.h>
#import "ReadEML.h"
#interface HTMLViewController : NSViewController //<WebPolicyDelegate>
{
NSSize dpi;
}
#property (assign) IBOutlet WKWebView *mailContentView;
- (WKWebView*)contentView;
- (void)displayContentFromReader:(id)emlReader;
- (void)setFormattingOn:(bool)formatting;
- (void)webView:(WKWebView *)webView
decidePolicyForNavigationAction:(WKNavigationAction *)navigationAction
decisionHandler:(void (^)(WKNavigationActionPolicy))decisionHandler;
#end
HTMLViewController.m
#import "HTMLViewController.h"
#import "Webtools.h"
#import "Stringtools.h"
#interface HTMLViewController ()
#end
#implementation HTMLViewController
- (void)awakeFromNib {
CGDirectDisplayID displayID = [_mailContentView.window.screen.deviceDescription[#"NSScreenNumber"] unsignedIntValue];
CGSize size = CGDisplayScreenSize(displayID);
CGDisplayModeRef mode = CGDisplayCopyDisplayMode(displayID);
dpi.width = CGDisplayModeGetWidth(mode) * 25.4 / size.width;
dpi.height = CGDisplayModeGetHeight(mode) * 25.4 / size.height;
CGDisplayModeRelease(mode);
float scaling = [AppDelegate.sharedAppdelegate getPreferenceForKey:#"DefaultZoom"]?[[AppDelegate.sharedAppdelegate getPreferenceForKey:#"DefaultZoom"] intValue]:100;
[_mailContentView.webFrame.frameView.documentView scaleUnitSquareToSize:NSMakeSize(dpi.width / (dpi.width / (scaling / 100.0)), dpi.height / (dpi.height / (scaling / 100.0)))];
}
- (id)initWithNibName:(NSString *)nibNameOrNil bundle:(NSBundle *)nibBundleOrNil {
self = [super initWithNibName:nibNameOrNil bundle:nibBundleOrNil];
return self;
}
- (WKWebView*)contentView {
return _mailContentView;
}
- (void)webView:(WKWebView *)webView
decidePolicyForNavigationAction:(WKNavigationAction *)navigationAction
decisionHandler:(void (^)(WKNavigationActionPolicy))decisionHandler {
if (navigationAction.request.URL) {
decisionHandler(WKNavigationActionPolicyCancel);
[NSWorkspace.sharedWorkspace openURL:navigationAction.request.URL];
} else {
decisionHandler(WKNavigationActionPolicyAllow);
}
}
- (void)displayContentFromReader:(id)dataCollector {
#autoreleasepool {
NSString* pathStem = getTempCacheDirectory();
NSURL* rootURL = [NSURL URLWithString:[pathStem stringByAddingPercentEscapesUsingEncoding:NSUTF8StringEncoding]];
NSURL* ReadRootURL = [NSURL fileURLWithPath:[pathStem stringByAddingPercentEscapesUsingEncoding:NSUTF8StringEncoding]];
[_mailContentView.webFrame loadHTMLString:[dataCollector getContent:#"RawHTML"] baseURL:ReadRootURL];
}
}
#end
My gut instinct tells me that this particular issue isn't in my code - can anyone suggest what else might be going on? As I say, if I don't import the .h file and I remove all references to its usage in the code then the code compiles without a problem.
It also compiles without a problem on macOS 10.14.
I'm perplexed!
This may help some people with this specific issue - I've found a solution that works for me, but I'm not happy with it because it feels hacky.
Simply add the following define to your header and your code should compile without difficulty. I'd still be interested to understand why Apple changed this, whether it is intentional or a bug, and what the 'correct' solution should be.
#define TARGET_OS_MACCATALYST 1
How can I receive Messages in voip? I can get the Voip Token!
I'm writing in Objective C:
I have searched around the internet but can't find any solutions! All I found is Swift, but can't get the token in Swift. In Objective C I can get token but not get Messages from a line.
apn push "<Token>" -c backgroundfetch.pem -m "Hello"
How can I popup a Messages in Objective C? Here is my code:
#import "AppDelegate.h"
#import <UIKit/UIKit.h>
#import <Foundation/Foundation.h>
#import PushKit;
#import UserNotifications;
#interface AppDelegate ()
#end
#implementation AppDelegate
NSString *fcmToken = #"";
// Trigger VoIP registration on launch
- (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions {
[self voipRegistration];
return YES;
}
// Register for VoIP notifications
- (void) voipRegistration {
dispatch_queue_t mainQueue = dispatch_get_main_queue();
// Create a push registry object
PKPushRegistry * voipRegistry = [[PKPushRegistry alloc] initWithQueue: mainQueue];
// Set the registry's delegate to self
voipRegistry.delegate = self;
// Set the push type to VoIP
voipRegistry.desiredPushTypes = [NSSet setWithObject:PKPushTypeVoIP];
}
- (void)pushRegistry:(PKPushRegistry *)registry didUpdatePushCredentials:(PKPushCredentials *)credentials forType:(NSString *)type{
if([credentials.token length] == 0) {
NSLog(#"voip token NULL");
return;
}
NSLog(#"PushCredentials: %#", credentials.token);
}
// Handle incoming pushes
- (void)pushRegistry:(PKPushRegistry *)registry didReceiveIncomingPushWithPayload:(PKPushPayload *)payload forType:(NSString *)type {
// Process the received push
NSLog(#"Get");
}
#end
My info.plist:
<key>UIBackgroundModes</key>
<array>
<string>voip</string>
<string>audio</string>
<string>fetch</string>
<string>remote-notification</string>
</array>
In your case the solution is to send a silent push notification. Once the silent push notification arrives, execute your code with background task.
Here is the good explanations for sending a silent push notification.
https://stackoverflow.com/a/36327058/9106403
OS X Mavericks implemented a new API for more convenient displaying of NSAlert:
- (void)beginSheetModalForWindow:(NSWindow *)sheetWindow completionHandler:(void (^)(NSModalResponse returnCode))handler
Is there an easy way to create a similar method in a category that does the same thing but supported on OS X 10.8 and earlier?
Yes, you can simulate a similar API using the delegate based API. The only tricky part is getting all the casts right so it works with ARC. Here's a category on NSAlert that provides a backward compatible block-based API:
NSAlert+BlockMethods.h
#import <Cocoa/Cocoa.h>
#interface NSAlert (BlockMethods)
-(void)compatibleBeginSheetModalForWindow: (NSWindow *)sheetWindow
completionHandler: (void (^)(NSInteger returnCode))handler;
#end
NSAlert+BlockMethods.m
#import "NSAlert+BlockMethods.h"
#implementation NSAlert (BlockMethods)
-(void)compatibleBeginSheetModalForWindow: (NSWindow *)sheetWindow
completionHandler: (void (^)(NSInteger returnCode))handler
{
[self beginSheetModalForWindow: sheetWindow
modalDelegate: self
didEndSelector: #selector(blockBasedAlertDidEnd:returnCode:contextInfo:)
contextInfo: (__bridge_retained void*)[handler copy] ];
}
-(void)blockBasedAlertDidEnd: (NSAlert *)alert
returnCode: (NSInteger)returnCode
contextInfo: (void *)contextInfo
{
void(^handler)(NSInteger) = (__bridge_transfer void(^)(NSInteger)) contextInfo;
if (handler) handler(returnCode);
}
#end
For more info, see my NSAlertBlockMethods Github repo.
I've created a very simple Mac program to load a web page. It works and loads it well but I can't run events! Nothing is logged!
#import "BenotaAppDelegate.h"
#implementation BenotaAppDelegate
#synthesize webViewIns;
#synthesize window;
- (void)applicationDidFinishLaunching:(NSNotification *)aNotification {
NSURL *url = [NSURL URLWithString:#"http://example.com"];
NSURLRequest *req = [NSURLRequest requestWithURL:url];
[[webViewIns mainFrame] loadRequest:req];
}
- (void)webView:(WebView *)sender didFinishLoadForFrame:(WebFrame *)frame {
NSLog(#"didFinishLoadForFrame");
}
#end
I can not use delegate right....
You need to set outlet frameLoadDelegatefrom your webView object to a class, that contains a method webView:didFinishLoadForFrame:
Just a note that my (iOS) app was rejected due:
non-public API/s in your app:
webView:didFinishLoadForFrame
You might want to reconsider your app, I definitely must find the 3rd party lib, which called that, and get rid of it. "It wasn't me!" is not a valid excuse :)