NSCoding cyber security issue founding #308

thanks for the contribution on your git. we are currently using it ; WebImage(url
However, we found that there is some cyber security issue(NSCodin) on your git repository and I just wonder if your organization have a plan to convert NSCoding to NSKeyedArchiver in a near future; if you have don't have any capacity to fix soon, it would be appreciated if you could response saying that you don't have plan on it now. Then, we could keep using your repository; otherwise, we have to drop it off unfortunately. Looking forward to hearing from your organization.

Thanks for your time and your contribution to our development community is crucial.
Best Regards,
Peace Cho.

Here is the founding

The NSKeyedArchiver or NSKeyedUnarchiver methods used by the App are insecure because they are incompatible with the NSSecureCoding protocol. An attacker-controlled payload that is deserialized via these APIs may result in attacker-controlled code being executed.

NSCoding is an Objective-C protocol that interoperates with NSKeyedArchiver and NSKeyedUnarchiver. Together, these APIs allow serialization and deserialization of code objects. However, the NSKeyedUnarchiver methods used by the app, and the NSCoding protocol itself, do not verify the type of object upon deserialization. Thus, an attacker may craft a malicious payload that results in unexpected code being executed.

To mitigate this vulnerability, Apple introduced the NSSecureCoding protocol along with the following secure methods of NSKeyedArchiver and NSKeyedUnarchiver, which are robust against this type of attack:

// Secure NSKeyedUnarchiver methods
- (instancetype)initForReadingFromData:(NSData *)data error:(NSError **)error;
+ (id)unarchivedObjectOfClass:(Class)cls fromData:(NSData *)data error:(NSError **)error;
+ (id)unarchivedObjectOfClasses:(NSSet<Class> *)classes fromData:(NSData *)data error:(NSError **)error;

// Secure NSKeyedArchiver methods
- (instancetype)initRequiringSecureCoding:(BOOL)requiresSecureCoding;
+ (NSData *)archivedDataWithRootObject:(id)object requiringSecureCoding:(BOOL)requiresSecureCoding error:(NSError **)error;

These APIs protect against object substitution attacks by requiring the programmer to declare the expected type of object before deserialization completes. Thus, if an invalid object is deserialized, the error can be handled safely.

Apple provides more information in the WWDC20 session, 'Securing Your App'.

here is the

Remediation Guidance