datatheorem / datatheorem/TrustKit
Remove usage of strlen, memcpy and malloc
Nobody has claimed this yet.
- Dominant language
- Objective-C
- Stars
- 2.1k
- Forks
- 381
- PR merge metrics
- No merged PRs in 30d
Description
Environment
Xcode version: 12.5
TrustKit Pod version: 1.7.0
Language: Swift
Issue:
We are using the trustKit for SSL Pinning in our application.
Our penetration testing team have found out that some insecure source code functions are being used in the application(strlen, memcpy and malloc) which is from the Trustkit library's below functions:
registry_search
RSSwizzle
trie_search
Could you remove these from the Trustkit library in your upcoming release or if it is required, could you let us know why it is required?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names registry_search, RSSwizzle, and trie_search as the relevant entry points; inspect those implementations for strlen, memcpy, and malloc usage and check how TrustKit builds on Xcode 12.5. Done means each use is removed or its necessity is documented with the security rationale.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- objective-c, swift
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100