Home / Companies / Snyk / Blog / Post Details
Content Deep Dive

Swift deserialization security primer

Blog post from Snyk

Post Details
Company
Date Published
Author
Sam Sanoop
Word Count
1,155
Language
English
Hacker News Points
-
Summary

swift Deserialization vulnerabilities in Swift can occur when using the popular APIs, NSCoding and NSSecureCoding. Deserialization attacks can be exploited by attackers to execute remote code execution. To prevent deserialization attacks, developers should use NSSecureCoding instead of NSCoding and verify the type of the object being deserialized. Additionally, setting supportsSecureCoding to false still conforms to NSSecureCoding but gives a false sense of security. Secure Swift deserialization involves ensuring that the type of the object being deserialized is verified when using decode functions with NSSecureCoding.