Switch to Secure Object Archiving APIs

[guraghav]

Hello,

Created this issue to address the vulnerability with using NSCoding. The NSCoding does not verify the type of object upon deserialization and therefore is vulnerable to object substitution attacks.

To mitigate this vulnerability, Apple introduced the NSSecureCoding protocol along with the following secure methods of NSKeyedArchiver and NSKeyedUnarchiver, which are robust against this type of attack:

// Secure NSKeyedUnarchiver methods
- (instancetype)initForReadingFromData:(NSData *)data error:(NSError **)error;
+ (id)unarchivedObjectOfClass:(Class)cls fromData:(NSData *)data error:(NSError **)error;
+ (id)unarchivedObjectOfClasses:(NSSet<Class> *)classes fromData:(NSData *)data error:(NSError **)error;

// Secure NSKeyedArchiver methods
- (instancetype)initRequiringSecureCoding:(BOOL)requiresSecureCoding;
+ (NSData *)archivedDataWithRootObject:(id)object requiringSecureCoding:(BOOL)requiresSecureCoding error:(NSError **)error;

Apple provides more information in the WWDC20 session, 'Securing Your App'.

The places where unsecure NSKeyedArchiver and NSKeyedUnarchiver is called :

• DTCoreText/Core/Source/NSAttributedString+HTML.m

  Line 147 in c4cb9c9

  data = [NSKeyedArchiver archivedDataWithRootObject:appendString];

• DTCoreText/Core/Source/NSAttributedString+HTML.m

  Line 162 in c4cb9c9

  appendString = (NSMutableAttributedString *)[NSKeyedUnarchiver unarchiveObjectWithData:data];