Insecure Deserialization (ARCH9109)
Esta página aún no está disponible en tu idioma.
Key swift.security.insecure-deserialization · Severity critical · Category security · CWE CWE-502
Flags NSKeyedUnarchiver.unarchiveObject(with:) / unarchiveTopLevelObjectWithData and requiresSecureCoding = false.
Incorrect
Section titled “Incorrect”let obj = NSKeyedUnarchiver.unarchiveObject(with: data)Correct
Section titled “Correct”let obj = try NSKeyedUnarchiver.unarchivedObject(ofClass: Payload.self, from: data)Use the secure-coding API with an explicit class allowlist, or Codable.