Code Injection During Deserialization

import Foundation

func loadUserProfile(from url: URL) async throws {
    let (data, _) = try await URLSession.shared.data(from: url)

    // VULNERABLE: Deprecated method with untrusted network data
    if let profile = NSKeyedUnarchiver.unarchiveObject(with: data) {
        // Attacker can craft archive to instantiate malicious objects
        // and execute arbitrary code during deserialization
        processProfile(profile)
    }
}

import Foundation

func parseConfig(from url: URL) async throws {
    let (data, _) = try await URLSession.shared.data(from: url)

    // VULNERABLE: Returns Any type, weak type control
    if let json = try? JSONSerialization.jsonObject(with: data) {
        // Attacker controls the structure and types in the JSON
        // Can cause type confusion or unexpected behavior
        applyConfiguration(json)
    }
}

import Foundation

func decodeWithDynamicType(data: Data, typeName: String) throws {
    // VULNERABLE: Type determined from user input
    guard let decodableType = NSClassFromString(typeName) as? Decodable.Type else {
        throw DeserializationError.invalidType
    }

    let decoder = JSONDecoder()
    // Type confusion: attacker controls which type is instantiated
    let obj = try decoder.decode(decodableType, from: data)
}

import Foundation

func loadSettings(from file: URL) throws {
    let data = try Data(contentsOf: file)

    // VULNERABLE: Returns Any, attacker controls plist structure
    var format = PropertyListSerialization.PropertyListFormat.xml
    let plist = try PropertyListSerialization.propertyList(
        from: data,
        options: [],
        format: &format
    )

    applySettings(plist)
}

import Foundation

func loadArchiveSafe(data: Data) throws -> [String: Any]? {
    // FIXED: Strict whitelist of allowed classes
    let allowedClasses: [AnyClass] = [
        NSDictionary.self,
        NSString.self,
        NSNumber.self,
        NSArray.self
    ]

    // Use modern API with class whitelist
    return try NSKeyedUnarchiver.unarchivedObject(
        ofClasses: allowedClasses,
        from: data
    ) as? [String: Any]
}

import Foundation

struct UserProfile: Codable {
    let id: String
    let name: String
    let email: String
    // Only these specific fields will be decoded
}

func loadUserProfileSafe(from url: URL) async throws -> UserProfile {
    let (data, _) = try await URLSession.shared.data(from: url)

    // FIXED: Use JSONDecoder with fixed, compile-time type
    return try JSONDecoder().decode(UserProfile.self, from: data)
}

import Foundation

struct APIResponse: Codable {
    let status: String
    let data: ResponseData
}

struct ResponseData: Codable {
    let userId: Int
    let items: [Item]
}

struct Item: Codable {
    let id: Int
    let name: String
}

func fetchAndDecodeSafe(from url: URL) async throws -> APIResponse {
    let (data, _) = try await URLSession.shared.data(from: url)

    // Validate data size
    guard data.count < 10_000_000 else {
        throw ValidationError.dataTooLarge
    }

    // Use schema validation if available
    let decoder = JSONDecoder()

    do {
        return try decoder.decode(APIResponse.self, from: data)
    } catch {
        // Log decoding failures for security monitoring
        logger.error("Failed to decode response: \(error)")
        throw ValidationError.invalidSchema
    }
}

import Foundation

struct SecureConfig: Codable {
    let endpoint: URL
    let timeout: TimeInterval
    let maxRetries: Int

    // Custom initializer with validation
    init(from decoder: Decoder) throws {
        let container = try decoder.container(keyedBy: CodingKeys.self)

        // Decode and validate each field
        let endpointString = try container.decode(String.self, forKey: .endpoint)
        guard let url = URL(string: endpointString),
              url.scheme == "https" else {
            throw DecodingError.dataCorrupted(
                DecodingError.Context(
                    codingPath: [CodingKeys.endpoint],
                    debugDescription: "Invalid or insecure URL"
                )
            )
        }
        self.endpoint = url

        let timeout = try container.decode(TimeInterval.self, forKey: .timeout)
        guard timeout > 0 && timeout <= 300 else {
            throw DecodingError.dataCorrupted(
                DecodingError.Context(
                    codingPath: [CodingKeys.timeout],
                    debugDescription: "Timeout out of valid range"
                )
            )
        }
        self.timeout = timeout

        let retries = try container.decode(Int.self, forKey: .maxRetries)
        guard retries >= 0 && retries <= 5 else {
            throw DecodingError.dataCorrupted(
                DecodingError.Context(
                    codingPath: [CodingKeys.maxRetries],
                    debugDescription: "Retries out of valid range"
                )
            )
        }
        self.maxRetries = retries
    }
}