Description

The detector identifies unsafe usage of NSKeyedUnarchiver in Swift applications. NSKeyedUnarchiver can lead to remote code execution vulnerabilities when deserializing untrusted data, as it allows arbitrary class instantiation during the deserialization process.

Detection Strategy

• Scan Swift source files for usage of NSKeyedUnarchiver deserialization functions

• Flag instances where NSKeyedUnarchiver is used without proper class validation checks

• Report vulnerability if unarchiveObject or unarchiveTopLevelObjectWithData methods are called without secure class validation

Vulnerable code example

import Foundation

class Config: NSObject, NSSecureCoding {
    static var supportsSecureCoding: Bool = true
    var version: String
    
    init(version: String) { 
        self.version = version ...

✅ Secure code example

import Foundation

class Config: NSObject, NSSecureCoding {
    static var supportsSecureCoding: Bool = true
    var version: String
    
    init(version: String) { 
        self.version = version ...