sensepost / sensepost/objection
Comparison returns kSecAccessControlBiometryCurrentSet even if kSecAccessControlBiometryAny is set
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 9.4k
- Forks
- 1k
- Avg merge
- 14d 5h
- Merged PRs (30d)
- 1
Description
https://github.com/sensepost/objection/blob/c2121af4944b44220f56a56fd283334aff9f6b16/agent/src/ios/keychain.ts#L240
While fiddling a bit with some keychain "ACL's" I found out that when I run ios keychain dump this check will return kSecAccessControlBiometryCurrentSet even if kSecAccessControlBiometryAny is in use.
On my side I was able to fix this by changing strict to loose comparison in the /lib/python3.9/site-packages/objection-1.11.0-py3.9.egg/objection/agent.js code.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at agent/src/ios/keychain.ts around line 240, where the keychain dump compares the access-control value. Run the ios keychain dump command with BiometryAny configured and compare its reported value with the expected ACL. Done means BiometryAny and BiometryCurrentSet are distinguished correctly in the output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios, typescript
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100