Pinning failure better error #3425

0xced · 2016-04-04T22:21:53Z

Here’s another take at fixing #3165 which, unlike #3191, should not introduce a security flaw!

I will explain what I did and why in greater details later but I’m already submitting this pull request to see if all tests pass on Travis.

I’ll also create a better error with a full userInfo dictionary, so please don’t merge this yet.

cnoon · 2016-04-05T19:20:31Z

AFNetworking/AFURLSessionManager.m

@@ -253,6 +270,7 @@ - (void)URLSession:(__unused NSURLSession *)session
 {
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wgnu"
+    error = objc_getAssociatedObject(task, ServerTrustErrorKey) ?: error;


This is really slick @0xced! 🙌🏼

kcharwood · 2016-04-08T13:07:15Z

AFNetworking/AFURLSessionManager.m

-            }
+    }
+
+    if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust] && disposition == NSURLSessionAuthChallengePerformDefaultHandling) {


This is great @0xced!

My only question here is do we want to set an error if the user returns cancel with the taskDidReceiveAuthenticationChallenge block? Should we deprecate the existing block and add a parameter for setting an error, that we can then set if they return cancel?

I found a way without breaking compatibility at all. 😀 See ab8e777.

kcharwood · 2016-04-11T18:27:40Z

AFNetworking/AFURLSessionManager.m

@@ -888,7 +906,7 @@ - (void)setTaskWillPerformHTTPRedirectionBlock:(NSURLRequest * (^)(NSURLSession
    self.taskWillPerformHTTPRedirection = block;
 }

- (void)setTaskDidReceiveAuthenticationChallengeBlock:(NSURLSessionAuthChallengeDisposition (^)(NSURLSession *session, NSURLSessionTask *task, NSURLAuthenticationChallenge *challenge, NSURLCredential * __autoreleasing *credential))block {
+- (void)setTaskDidReceiveAuthenticationChallengeBlock:(NSURLSessionAuthChallengeDisposition (^)(NSURLSession *session, NSURLSessionTask *task, NSURLAuthenticationChallenge *challenge, id __autoreleasing *result))block {


Hmmmm.

I'm torn over this. I feel like this makes the API less readable now. My inclination is to create a new handler and deprecate the current one.

Thoughts?

Yep, that’s less readable, you're right. And if we're taking the deprecation route, we should probably take care of fixing #2520 at the same time. That would probably mean changing from

NSURLSessionAuthChallengeDisposition (^)(NSURLSession *session, NSURLSessionTask *task, NSURLAuthenticationChallenge *challenge, NSURLCredential __autoreleasing *credential);

to

BOOL (^)(NSURLSession *session, NSURLSessionTask *task, NSURLAuthenticationChallenge *challenge, void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *credential));

Where the user would return YES from the block to indicates that the challenge was handled: responsibility to call completionHandler(disposition, credential) is upon the user. User would return NO to indicate that the challenge was not handled and AFNetworking's implementation (i.e. server trust evaluation) should be executed (responsibility to call completionHandler(disposition, credential) is upon AFNetworking)

Now the hardest part may be to find a new name for that new taskDidReceiveAuthenticationChallenge block.

Currently, if the user provides taskDidReceiveAuthenticationChallenge, they DO not also get the default pinning behavior. For backwards compatibility purposes, I would think we need to keep that behavior.

That means if they define the block, they are fully responsible for it. If we were to modify that behavior, existing users who return a success would potentially still be susceptible to the call failing since pinning rules could then fail afterwards.

Essentially, I think if the block is defined, no other AF code should run to keep the current compatibility as close as possible to the existing behavior.

This may also mean we need the developer to potentially return the error they want to see reported?

BOOL (^)(NSURLSession *session, NSURLSessionTask *task, NSURLAuthenticationChallenge *challenge, void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential *credential, NSError *error));

We take the error, then set it, and forward the call to the handler.

Currently, if the user provides taskDidReceiveAuthenticationChallenge, they DO not also get the default pinning behavior.

Exactly and I think this was a mistake, especially since it was not documented. I think it’s fair to fix that mistake and properly document it in the release notes.

existing users who return a success would potentially still be susceptible to the call failing since pinning rules could then fail afterwards

I think that’s the right thing to do. Server trust failing when you pinned certificates is what you would expect IMO, regardless of if you set a taskDidReceiveAuthenticationChallenge or not. Again, the current documentation (3.1.0) does not state that having a taskDidReceiveAuthenticationChallenge bypasses the security policy.

0xced · 2016-04-12T22:15:35Z

I tried something with b467638. The documentation is lacking for now.

kcharwood · 2016-10-05T18:20:55Z

Can you rebase this with master to get Xcode 8 coverage?

0xced · 2016-10-05T18:28:44Z

I rebased, but this is stil missing documentation, so I wouldn’t merge yet. Also, I think there might be some overlap with #3616.

kcharwood · 2016-10-10T14:31:00Z

Should I punt this from the 3.2.0 release train? Would like to release it this week sometime.

codecov-io · 2016-10-10T16:20:05Z

Current coverage is 87.59% (diff: 85.07%)

Merging #3425 into master will increase coverage by 0.15%

@@             master      #3425   diff @@
==========================================
  Files            45         45          
  Lines          6227       6271    +44   
  Methods        1104       1111     +7   
  Messages          0          0          
  Branches        416        414     -2   
==========================================
+ Hits           5445       5493    +48   
+ Misses          779        775     -4   
  Partials          3          3

Powered by Codecov. Last update 4f3c694...cda68cd

0xced · 2016-10-17T11:29:50Z

I'm almost done writing the documentation. But it's not covered by tests at all for now. 😕

`NSURLErrorServerCertificateUntrusted` instead of `NSURLErrorCancelled`

Handle session-level authentication requests exclusively through user-provided `sessionDidReceiveAuthenticationChallenge` block. When `sessionDidReceiveAuthenticationChallenge` is not set, go through the `URLSession:task:didReceiveChallenge:completionHandler:` delegate method instead.

Fixes #3165

Let the possibility to the `taskDidReceiveAuthenticationChallenge` block to fallback to security policy evaluation by returning `NSURLSessionAuthChallengePerformDefaultHandling`.

Deprecate `setTaskDidReceiveAuthenticationChallengeBlock:` in favor of the new `setAuthenticationChallengeHandler:` method. The new challenge handler allows * The user to handle the completion handler themself (fixes #2520) * The security policy to be evaluated * Aborting the connection with a proper error (see also #3165)

0xced · 2016-10-18T15:48:15Z

I added documentation in 9310feb and I’m happy with it. It still needs some more tests though. I'd like to implement a custom authentication challenge handler that demonstrate how to use it for client certificates, but I think it’s going to be tough!

dmiluski · 2018-01-13T18:03:23Z

Any update on this pr? I’m a bit lost on how to integrate if I’m unable to differentiate cancel from pinning failure

n8gray · 2020-03-25T21:26:51Z

Any chance this will get fixed? That "cancelled" error is a real pain.

jshier · 2020-03-27T04:47:51Z

Unfortunately this PR is too complex to be merged with the amount of work it would take to validate the behavior.

0xced · 2020-03-27T07:53:18Z

That's a shame, I invested so much time in it to have proper error handling. 🙁

jshier · 2020-03-27T14:39:03Z

If you want you can reengineer the patch on top of current master and feel free to drop the backward compatibility concerns for the major release. If you do want to do this, you can build off of the afnetworking4 branch that's up right now.

jshier

👍 Looking at this in the light of day I think we're okay to merge. I'll clean up the deprecations in my branch.

commit eabbf6c Author: Elf Sundae <elf.sundae@gmail.com> Date: Wed Apr 1 07:29:42 2020 +0800 Update CHANGELOG.md (AFNetworking#4537) commit 9e9732d Author: Elf Sundae <elf.sundae@gmail.com> Date: Wed Apr 1 01:53:05 2020 +0800 Fix UIKit+AFNetworking.h (AFNetworking#4536) commit 7ae82a2 Author: Elf Sundae <elf.sundae@gmail.com> Date: Wed Apr 1 00:50:45 2020 +0800 Remove unused UIImage+AFNetworking.h (AFNetworking#4535) commit 8052913 Author: Elf Sundae <elf.sundae@gmail.com> Date: Tue Mar 31 04:05:59 2020 +0800 Separate bundle identifier for watchOS target (AFNetworking#4533) commit 71951aa Author: Elf Sundae <elf.sundae@gmail.com> Date: Tue Mar 31 03:22:06 2020 +0800 Fix MobileCoreServices renamed warning, close #4520 (AFNetworking#4532) commit c80dd79 Author: Elf Sundae <elf.sundae@gmail.com> Date: Tue Mar 31 02:04:25 2020 +0800 Add FOUNDATION_EXPORT for AFJSONObjectByRemovingKeysWithNullValues (AFNetworking#4529) commit 16f9a8c Author: Jakub Kašpar <kaspikk@gmail.com> Date: Mon Mar 30 19:58:53 2020 +0200 (Infra) Make infra changes to cleanup project and simplify its maintenance (AFNetworking#4531) * Update readme, add stale bot, add issue template, add pull request template * Update copy from Alamofire commit 03a9156 Author: Elf Sundae <elf.sundae@gmail.com> Date: Mon Mar 30 11:38:32 2020 +0800 Improve podspec (AFNetworking#4528) * Remove submodules, requires_arc * Removed redundant public_header_files * Fixed bundle identifier for CocoaPods generated framework * Remove prefix_header_contents attribute commit 6ec99c9 Author: Jon Shier <jon@jonshier.com> Date: Sun Mar 29 16:48:58 2020 -0400 Prepare 4.0.0. (AFNetworking#4527) commit c9d0684 Author: Jon Shier <jon@jonshier.com> Date: Sun Mar 29 15:37:57 2020 -0400 AFNetworking 4 (AFNetworking#4523) * Work towards 4.0.0 release. * Drop macOS deployment to 10.10. * Reduce pod requirement to 10.10. * Remove iOS 7 & 8 workaround. * Fix misspelling. * Remove now unnecessary version check. * Fixes after master merge. * Remove unnecessary services import. * Updates for travis config. * Year 2020 (AFNetworking#4524) * Add Swift package. * Try to fix Travis configs. * Explicitly set Xcode versions. * Try to fix Xcode selection. * Directly call xcversion. * Revert to Xcode 11.3. * Remove defaults. * Manually set schemes? * Don’t build examples. * Use updated Fastfile. * Properly load from macos * Ignore SecTrustEvaluate deprecations to fix test failures. * Use deprecated API for tests. * Add Catalyst testing. * Scheme updates; can’t test Catalyst until Travis has Catalina. * Remove deprecated APIs. * remove useless api for upload task (AFNetworking#4525) * remove unnecessary __block (AFNetworking#4526) * Add GitHub actions, remove Travis. * Update action name. * Remove matrixes. * Move build action to GitHub actions. Co-authored-by: Elf Sundae <elf.sundae@gmail.com> Co-authored-by: Kinarobin <kinarobin@outlook.com> commit e24d494 Author: Will Han <xingheng907@hotmail.com> Date: Sat Mar 28 01:12:14 2020 +0800 Post a notification when finishing moving the downloaded file successfully. (AFNetworking#4393) * Post a notification when finishing moving the downloaded file successfully. * Add test cases for move notifications. commit c4d8f62 Author: Cédric Luthi <cedric.luthi@gmail.com> Date: Fri Mar 27 16:39:01 2020 +0100 Pinning failure better error (AFNetworking#3425) * Error code on pinning failure must be meaningful `NSURLErrorServerCertificateUntrusted` instead of `NSURLErrorCancelled` * Remove unneeded __block qualifier * Add warnings about implementing an authentication challenge block * Simpler session-level authentication request handling Handle session-level authentication requests exclusively through user-provided `sessionDidReceiveAuthenticationChallenge` block. When `sessionDidReceiveAuthenticationChallenge` is not set, go through the `URLSession:task:didReceiveChallenge:completionHandler:` delegate method instead. * Precise error when the server trust is invalid Fixes #3165 * Better server trust error with userInfo dictionary * Simplify code flow * Better setSessionDidReceiveAuthenticationChallengeBlock: documentation * Do not completely bypass the security policy Let the possibility to the `taskDidReceiveAuthenticationChallenge` block to fallback to security policy evaluation by returning `NSURLSessionAuthChallengePerformDefaultHandling`. * Better expectation descriptions for invalid server trust tests * Rename ServerTrustErrorKey into AuthenticationChallengeErrorKey * New authentication challenge hander block Deprecate `setTaskDidReceiveAuthenticationChallengeBlock:` in favor of the new `setAuthenticationChallengeHandler:` method. The new challenge handler allows * The user to handle the completion handler themself (fixes #2520) * The security policy to be evaluated * Aborting the connection with a proper error (see also #3165) * Fix nullability annotation * Throw if the authentication challenge handler returns an invalid value * Document -[AFURLSessionManager setAuthenticationChallengeHandler:] commit a1f208b Author: Kinarobin <kinarobin@outlook.com> Date: Fri Mar 27 12:45:58 2020 +0800 Optimizing cancel image download and let task to be canceled really. (AFNetworking#4407) * optimizing cancel image download task * update test case commit a5a9436 Author: Sergio Martins Pereira <s@x42.io> Date: Fri Mar 27 05:22:59 2020 +0100 Change dataTaskWithHTTPMethod visibility to public (AFNetworking#4007) Change -dataTaskWithHTTPMethod visibility from private to public. Co-authored-by: Sergio M. Pereira <martins-p-sergio@users.noreply.github.com> commit 67f558f Author: Kinarobin <kinarobin@outlook.com> Date: Fri Mar 27 12:08:49 2020 +0800 Delete unused `af_url_session_manager_creation_queue ` when don’t support below iOS 8 (AFNetworking#4401) * Delete unused queue when iOS deployment had changed * Remove unrelated test code when iOS8+ commit 3f2e551 Author: Kinarobin <kinarobin@outlook.com> Date: Fri Mar 27 09:20:47 2020 +0800 Fix `NetworkActivityIndicator` kvo call back will trigger twice bug. (AFNetworking#4406) * remove manual KVO in `AFNetworkActivityIndicatorManager` * unified code style * add a test case for KVO commit f484fdc Author: Tiago Janela <tjanela@blissapplications.com> Date: Thu Mar 26 21:10:21 2020 -0400 Feature/wk web view (AFNetworking#4439) * Removed UIWebView in favor of WKWebView Since UIWebView is deprecated and will be rejected soon by Apple i've removed all references to UIWebView and implemented the WKWebView extension * Fixed one last reference * Added WKNavigation to LoadRequest calls - WKNavigation is needed to call didFinishNavigation and didStartProvisionalNavigation - Fixed testcases (not sure if this is the right way?) * Added correct Copyright stuffs * Updated podsubspec UIKit iOS deployment target to 9.0 * Updated test progressIsSet by using a large download URL request. * XCTFailing and fulfilling in error cases of AFWKWebViewTests * Adopted WKNavigationDelegate protocol on AFWKWebViewTetsts * Revert "Updated podsubspec UIKit iOS deployment target to 9.0" This reverts commit 4a4013a. Co-authored-by: Sebastiaan <s.seegers@sping.nl> commit 92bb7dd Author: Raphael Cohen <raphael.cohen@gmail.com> Date: Fri Mar 27 03:45:08 2020 +0300 use cocoapods cdn instead of github as source (AFNetworking#4515) see here for more info: https://blog.cocoapods.org/CocoaPods-1.7.2/ commit 9c07ac0 Author: Elf Sundae <elf.sundae@gmail.com> Date: Fri Mar 27 08:43:45 2020 +0800 Fix API availability warnings for NSURLSessionTaskMetrics (AFNetworking#4516) * Fix API availability warnings for NSURLSessionTaskMetrics * Fix API availability warnings for NSURLSessionTaskMetrics commit 555385d Author: WELCommand <shilong@ai-t.com.cn> Date: Sun Jan 5 08:34:04 2020 +0800 Fix associated object bug in UIKit extensions (AFNetworking#3872) commit 2da270b Author: Cédric Luthi <cedric.luthi@gmail.com> Date: Sun Jan 5 01:26:41 2020 +0100 Search for default pinned certificates in the main bundle (AFNetworking#3752) Using `[NSBundle bundleForClass:[self class]]` is dangerous because the code will behave differently depending on how AFNetworking is integrated. * If it is integrated as a static library (for example using CocoaPods), certificates will be searched in the main bundle. * If it is integrated as a framework (for example using Carthage), certificates will be searched in the AFNetworking framework. Even though this behavior is documented, this is dangerous. Using the main bundle makes the behavior deterministic. Fixes #3575 commit 0fba527 Author: svoit <1726513+svoit@users.noreply.github.com> Date: Sun Jan 5 01:19:31 2020 +0100 Fix reference cycle in example, remove unnecessary weak / strong (AFNetworking#4196) * Fixed memory leak issues * Fixed memory leak issues * Fixed crash commit 4743faa Author: Bofei Zhu <bofei.zhu@healthtap.com> Date: Sat Jan 4 15:26:32 2020 -0800 Fix travis CI build (AFNetworking#4472) * Update .travis.yml * Update .travis.yml * Update .travis.yml * Update .travis.yml * Update .travis.yml * update fastlane settings * nit * fix tvos * Update AFTestCase.m * revert timeout * Update AFUIWebViewTests.m * Update .env.ios12_xcode10 commit eb9ce0e Author: Chris Streeter <streeter@users.noreply.github.com> Date: Sat Jan 4 15:24:33 2020 -0800 Use dispatch_barrier_sync (AFNetworking#4474) This should hopefully avoid any problems where we attempt to write an HTTP header to a deallocated header dictionary. See AFNetworking#3891 See https://github.com/AFNetworking/AFNetworking/issues/3636 Modified from tmm1@32760e7 Fixes AFNetworking#1391 commit 5cf601c Author: Tiago Janela <tjanela@gmail.com> Date: Sat Oct 26 18:34:47 2019 -0400 Updated SSL Pinning Test Assets (AFNetworking#4463) commit 006e896 Author: yehuanwen <yehuanwen@126.com> Date: Mon Oct 21 11:23:30 2019 +0800 Fix typeof (AFNetworking#3912) commit 9dcc6ef Author: Gavin King <ghking13@gmail.com> Date: Sun Oct 20 23:02:35 2019 -0400 adding tvOS user agent information (AFNetworking#4014) commit 2c2d2c3 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Sun Oct 20 22:39:56 2019 -0400 Update code coverage settings (AFNetworking#4201) * Ignore coverage of test code. * Add a second code coverage lane. * Increase testing for code coverage. * Fix the name of the Apple TV simulator. * Delete .env.osx_10.10_xcode6 * Delete .env.osx_10.9_xcode6 commit 7383ffc Author: Mars Lan <mars.th.lan@gmail.com> Date: Sun Oct 20 19:00:32 2019 -0700 Fix CHANGELOG Styling (AFNetworking#4460) commit 023cec7 Author: Elf Sundae <elf.sundae@gmail.com> Date: Mon Oct 21 09:53:18 2019 +0800 Fix NSSecureCoding (AFNetworking#4409) * Fix type for decoding object * Fix encoding numeric commit 685e31a Merge: ee95094 b3c4a78 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Fri Mar 1 14:00:35 2019 -0500 Merge pull request AFNetworking#4365 from classdojo/cd-master Fix podspec #trivial #important commit b3c4a78 Author: Jakub Kaspar <kaspikk@gmail.com> Date: Fri Mar 1 16:23:33 2019 +0100 Fix podspec as pod version supports iOS 8+ but podspec says iOS 7+ commit ee95094 Merge: 9cc7829 d6db830 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Sat Feb 9 13:18:38 2019 -0500 Merge pull request AFNetworking#4200 from svoit/code_cleaning Code cleaning commit 9cc7829 Merge: 5890adc 3517a1d Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Sat Feb 9 13:11:50 2019 -0500 Merge pull request AFNetworking#4357 from AFNetworking/update-httpbin-certificates-april-2019 Update HTTPBin certificates in tests commit 3517a1d Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Sat Feb 9 11:38:10 2019 -0500 Update HTTPBin certificates commit 5890adc Merge: 27608c9 ba42389 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Sun Oct 14 10:20:46 2018 -0400 Merge pull request AFNetworking#4298 from AFNetworking/update-httpbin-certificates-december-2018 Update HTTPBin certificates, good through December 2018. commit ba42389 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Wed Oct 10 23:02:34 2018 -0400 Update HTTPBin certificates, good through December 2018. commit d6db830 Merge: e6c674e 27608c9 Author: svoit <1726513+svoit@users.noreply.github.com> Date: Mon Oct 8 23:28:53 2018 +0200 Merge branch 'master' into code_cleaning * master: (61 commits) Update Travis config for Xcode 10. Add test for object posting notification update README.md, the old "Foundation URL Loading System" link is 404 Change test name to correct one Change default teardown methods to tests Update tests to use new API Update PR feedback, add more tests Add test remove temporary method that could be doing nothing Update HTTPBin certificates. Chinese CONTRIBUTING.md translate Delete CONTRIBUTING_CH.md Chinese Contributing.md translate rollback method 'AFPostReachabilityStatusChange' Use AFNetworkReachabilityManager to compare consistency of notification posts and gets, instead of SCNetworkReachabilityRef. And test case reference. Remove test that is nilling session manually as it's not possible anymore to not have valid session (correctly) Add tests for verifing reachability manager consistence for notification posting and getting Specify Xcode 9.4 in Travis file. Update AFImageDownloader.m Add an ability that notification-observer know which reachability its belong ... commit 27608c9 Merge: 1bd73c7 7b48feb Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Tue Oct 2 12:10:55 2018 -0400 Merge pull request AFNetworking#4081 from MapaX/master Fixed CLANG_ENABLE_CODE_COVERAGE flag so release can be made commit 1bd73c7 Merge: 59e92b1 9bb8ea7 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Mon Sep 24 14:00:21 2018 -0400 Merge pull request AFNetworking#4256 from classdojo/cd-master Fix crashes and memory leaks commit 59e92b1 Merge: 99cda82 fdbec01 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Mon Sep 24 13:24:04 2018 -0400 Merge pull request AFNetworking#4293 from AFNetworking/xcode-10 Update Travis config for Xcode 10. commit fdbec01 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Mon Sep 24 12:35:04 2018 -0400 Update Travis config for Xcode 10. commit 99cda82 Merge: e46e64c 23a6f44 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Mon Sep 24 12:27:48 2018 -0400 Merge pull request AFNetworking#4286 from rob2468/master update README.md, the old "Foundation URL Loading System" link is 404 commit e46e64c Merge: 390e8fa dea4316 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Fri Sep 21 16:16:33 2018 -0400 Merge pull request AFNetworking#4248 from LMsgSendNilSelf/#4247 Add an ability that notification-observer know which reachability it belongs commit 390e8fa Merge: b892e56 5b92ed3 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Fri Sep 21 15:41:04 2018 -0400 Merge pull request AFNetworking#4262 from jin940/master Chinese version for CONTRIBUTING.md commit dea4316 Author: wangpeng <wangpeng@kuaishou.com> Date: Thu Sep 20 16:15:30 2018 +0800 Add test for object posting notification commit 23a6f44 Author: jam.chenjun <jam.chenjun@gmail.com> Date: Tue Sep 18 15:00:32 2018 +0800 update README.md, the old "Foundation URL Loading System" link is 404 commit 9bb8ea7 Author: Jakub Kaspar <kaspikk@gmail.com> Date: Thu Sep 13 10:56:00 2018 -0700 Change test name to correct one commit af23240 Author: Jakub Kaspar <kaspikk@gmail.com> Date: Tue Sep 11 12:58:25 2018 -0700 Change default teardown methods to tests commit 0579f71 Author: Jakub Kaspar <kaspikk@gmail.com> Date: Tue Sep 11 12:20:21 2018 -0700 Update tests to use new API commit 864c8d6 Author: Jakub Kaspar <kaspikk@gmail.com> Date: Tue Sep 11 12:15:01 2018 -0700 Update PR feedback, add more tests commit 7b48feb Merge: d8f45e7 b892e56 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Sat Sep 8 11:54:27 2018 -0400 Merge branch 'master' into master commit 3c54e1f Author: Jakub Kaspar <kaspikk@gmail.com> Date: Tue Aug 14 08:52:28 2018 +0200 Add test commit a8758d2 Merge: 86c8cc2 6479536 Author: Jakub Kaspar <kaspikk@gmail.com> Date: Mon Aug 13 22:44:03 2018 +0200 Merge branch 'master' into cd-master # Conflicts: # Tests/Tests/AFURLSessionManagerTests.m commit 6479536 Merge: c976cf3 b892e56 Author: Jakub Kaspar <kaspikk@gmail.com> Date: Mon Aug 13 22:42:56 2018 +0200 Merge remote-tracking branch 'as_origin/master' # Conflicts: # AFNetworking/AFNetworkReachabilityManager.h # AFNetworking/AFURLSessionManager.m commit 86c8cc2 Author: Jakub Kaspar <kaspikk@gmail.com> Date: Mon Aug 13 22:34:41 2018 +0200 remove temporary method that could be doing nothing commit b892e56 Merge: a24b489 12088d6 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Wed Aug 8 16:46:47 2018 -0400 Merge pull request AFNetworking#4269 from AFNetworking/update-httpbin-certificates-october-2018 Update HTTPBin certificates, valid through October 2018. commit 12088d6 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Wed Aug 8 14:23:40 2018 -0400 Update HTTPBin certificates. commit a24b489 Merge: a101152 5e19a4d Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Tue Jul 31 00:05:58 2018 -0400 Merge pull request AFNetworking#4113 from stnslw/headers-per-request Support for setting headers per request when using AFHTTPSessionManager. commit a101152 Merge: 7642bcf 1d1c024 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Mon Jul 30 23:47:01 2018 -0400 Merge pull request AFNetworking#4237 from Caelink/master Implement two ways to collect NSURLSessionTaskMetrics commit 5b92ed3 Author: jin940 <chanwenghong48@hotmail.com> Date: Sun Jul 29 01:07:45 2018 +0800 Chinese CONTRIBUTING.md translate Chinese CONTRIBUTING.md translate commit 17edb81 Author: jin940 <chanwenghong48@hotmail.com> Date: Sun Jul 29 01:06:01 2018 +0800 Delete CONTRIBUTING_CH.md commit 7ff008b Author: jin940 <chanwenghong48@hotmail.com> Date: Sun Jul 29 01:00:38 2018 +0800 Chinese Contributing.md translate Chinese Contributing.md translate commit 619a65b Author: wangpeng <wangpeng@kuaishou.com> Date: Wed Jul 25 22:00:31 2018 +0800 rollback method 'AFPostReachabilityStatusChange' commit 91cc666 Author: wangpeng <wangpeng@kuaishou.com> Date: Wed Jul 25 21:48:31 2018 +0800 Use AFNetworkReachabilityManager to compare consistency of notification posts and gets, instead of SCNetworkReachabilityRef. And test case reference. commit 926d4db Author: Jakub Kaspar <kaspikk@gmail.com> Date: Mon Jul 23 12:20:10 2018 +0200 Remove test that is nilling session manually as it's not possible anymore to not have valid session (correctly) commit 5544ef0 Merge: c976cf3 7642bcf Author: Jakub Kaspar <kaspikk@gmail.com> Date: Mon Jul 23 11:15:48 2018 +0200 Merge branch 'master' into cd-master * master: (71 commits) Specify Xcode 9.4 in Travis file. Update AFImageDownloader.m Safely get mergedTasks On responseQueue Update HTTPBin certificates. Update block usage requirements. Fixed tests. Update AFAutoPurgingImageCache.m Preparing for the 3.2.1 release Fix issues with AFCompatibilityMacros.h Add AFCompatibilityMacros.h to podspec. Add new .env files for iOS 11.x Update SDK settings in Travis config. Use old SDKs to test earlier versions of iOS 11. Update default SDK for iOS and tvOS Update umbrella header. Update HTTPBin certificates for April 2018. Remove beta from 9.3 image Update asset catalog JSON. Tweak tests to send expressions directly. Add tests and also prohibit +new from working. ... # Conflicts: # AFNetworking/AFNetworkReachabilityManager.h # AFNetworking/AFURLSessionManager.m commit ffbcabe Author: wangpeng <wangpeng@kuaishou.com> Date: Sun Jul 15 15:51:03 2018 +0800 Add tests for verifing reachability manager consistence for notification posting and getting commit 7642bcf Merge: d135b74 9c2742c Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Fri Jul 13 18:04:45 2018 -0400 Merge pull request AFNetworking#4249 from AFNetworking/xcode-9.4 Update Travis settings for Xcode 9.4 commit 9c2742c Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Fri Jul 13 17:19:50 2018 -0400 Specify Xcode 9.4 in Travis file. commit 5fe5ea3 Merge: 849dff7 d135b74 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Fri Jul 13 17:09:18 2018 -0400 Merge branch 'master' into pr/4051 commit d135b74 Merge: 009e3bb 342653f Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Fri Jul 13 15:16:47 2018 -0400 Merge pull request AFNetworking#4246 from bbeversdorf/master Safely get mergedTasks On responseQueue commit 342653f Author: bbeversdorf <bbeversdorf@users.noreply.github.com> Date: Fri Jul 13 10:15:08 2018 -0500 Update AFImageDownloader.m commit 06079ad Author: wangpeng <wangpeng@kuaishou.com> Date: Fri Jul 13 18:33:01 2018 +0800 Add an ability that notification-observer know which reachability its belong commit 1c52c76 Author: Brian Beversdorf <bbeversdorf@gowithfloat.com> Date: Thu Jul 12 16:09:29 2018 -0500 Safely get mergedTasks On responseQueue There is a race condition in -[AFImageDownloader downloadImageForURLRequest:withReceiptID:success:failure:] that can cause a crash. #3876 #3984 commit 1d1c024 Author: Caelin Jackson-King <caelin@yelp.com> Date: Mon Jul 2 17:00:18 2018 -0700 Replace the version numbers with raw values commit ca380fd Author: Caelin Jackson-King <caelin@yelp.com> Date: Fri Jun 29 16:50:35 2018 -0700 Inverted preprocessor logic to check iff version exists in target commit 54f1135 Author: Caelin Jackson-King <caelin@yelp.com> Date: Fri Jun 29 15:25:26 2018 -0700 Replaced preprocessor variable to make sure all valid targets allow NSURLSessionTaskMetrics commit 6622b05 Author: Caelin Jackson-King <caelin@yelp.com> Date: Fri Jun 29 13:18:36 2018 -0700 Missed one use of related type commit 63410f3 Author: Caelin Jackson-King <caelin@yelp.com> Date: Fri Jun 29 11:49:55 2018 -0700 Xcode 7.x compatibility commit d0448a8 Merge: 009e3bb c4caddc Author: Caelin <Caelink@users.noreply.github.com> Date: Fri Jun 29 10:56:08 2018 -0700 Merge pull request #1 from Caelink/didFinishCollectingMetrics Implemented methods for collecting NSURLSessionTaskMetrics commit c4caddc Author: Caelin Jackson-King <caelin@yelp.com> Date: Fri Jun 29 10:50:58 2018 -0700 Tests for notification and block use commit aed00d3 Author: Caelin Jackson-King <caelin@yelp.com> Date: Thu Jun 28 16:38:16 2018 -0700 Test for notification publishing the metrics commit fba4f36 Author: Caelin Jackson-King <caelin@yelp.com> Date: Thu Jun 28 16:15:18 2018 -0700 Added kvo use of sessionTaskMetrics commit ad7b31f Author: Caelin Jackson-King <caelin@yelp.com> Date: Thu Jun 28 13:10:43 2018 -0700 First stab at adding a block to be called and implementing didFinishCollectingMetrics on the SessionManager commit 009e3bb Merge: 684dfe0 d768f1c Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Sat Jun 9 13:44:52 2018 -0700 Merge pull request AFNetworking#4225 from AFNetworking/update-httpbin-certificates-august-2018 Update HTTPBin certificates, valid through August 2018. commit d768f1c Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Fri Jun 8 10:02:15 2018 -0700 Update HTTPBin certificates. commit 684dfe0 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Thu Jun 7 23:09:14 2018 -0700 Update block usage requirements. commit 41782ab Merge: 850974c f8159fe Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Thu Jun 7 23:06:00 2018 -0700 Merge branch 'pr/3962' commit 850974c Merge: 61e15f4 b158887 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Thu Jun 7 23:03:26 2018 -0700 Merge remote-tracking branch 'origin/master' commit 61e15f4 Merge: 48b63fa 7576300 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Thu Jun 7 22:59:25 2018 -0700 Merge branch 'pr/4052' commit b158887 Merge: 48b63fa 27c8195 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Thu Jun 7 22:56:28 2018 -0700 Merge pull request AFNetworking#4002 from LeeHongHwa/fix_coding_convention fix space used in Objective-C method (coding style) commit 48b63fa Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Thu Jun 7 22:50:31 2018 -0700 Fixed tests. commit 447d7f3 Merge: 207a707 2d19dc8 Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Thu Jun 7 22:38:08 2018 -0700 Merge branch 'pr/4088' commit 207a707 Merge: 746f6c3 357466d Author: Jeff Kelley <SlaunchaMan@gmail.com> Date: Thu Jun 7 22:33:40 2018 -0700 Merge pull request AFNetworking#4206 from Huang-Libo/patch-1 Update AFAutoPurgingImageCache.m commit 357466d Author: Huang-Libo <LiboHwang+IM@gmail.com> Date: Mon May 7 00:51:45 2018 +0800 Update AFAutoPurgingImageCache.m NSString property should use `copy`. commit e6c674e Author: svoit <1726513+svoit@users.noreply.github.com> Date: Wed Apr 11 23:22:18 2018 +0200 Removed redundant switch case commit 1f70ba8 Author: svoit <1726513+svoit@users.noreply.github.com> Date: Tue Apr 10 23:23:46 2018 +0200 Code cleaning commit 2d19dc8 Author: Dan Loewenherz <dan@lionheartsw.com> Date: Thu Oct 26 21:39:27 2017 -0500 use Objective-C 2.0 subscripting commit 5e19a4d Author: Stanisław Brzeski <stanislaw@onegini.com> Date: Fri Dec 15 16:31:03 2017 +0100 Minor codestyle fix commit ded6a76 Author: Stanisław Brzeski <stanislaw@onegini.com> Date: Fri Dec 15 15:54:23 2017 +0100 Added support for setting headers per HTTP request commit c976cf3 Author: Jakub Kaspar <kaspikk@gmail.com> Date: Sun Nov 12 12:20:24 2017 -0800 fix crashes commit d8f45e7 Author: Matti Mustonen <matti.mustonen@nordea.com> Date: Fri Oct 13 10:28:52 2017 +0300 Fixed init method nullability to default value commit 1e03fb1 Author: Matti Mustonen <matti.mustonen@nordea.com> Date: Thu Oct 12 13:49:40 2017 +0300 Fixed CLANG_ENABLE_CODE_COVERAGE flag so release can be made commit 7576300 Author: Ash Furrow <ash@ashfurrow.com> Date: Mon Sep 18 11:11:02 2017 -0400 Modifies AFJSONObjectByRemovingKeysWithNullValues to remove NSArray null objects. commit 849dff7 Author: Ash Furrow <ash@ashfurrow.com> Date: Mon Sep 18 10:45:40 2017 -0400 Exposes C function prototype. commit 27c8195 Author: leehonghwa <lyhonghwa@gmail.com> Date: Wed Jul 19 15:08:26 2017 +0900 Fix asterisk location in method declaration commit c18c09a Author: leehonghwa <lyhonghwa@gmail.com> Date: Wed Jul 19 14:29:27 2017 +0900 fix space used in Objective-C method (coding style) commit f8159fe Author: BKKim <BK@iMac.local> Date: Tue May 30 21:35:54 2017 +0900 Fix AFURLSessionManager security weakness crashes when calling to a released block pointer

Kaspik · 2020-04-03T08:01:28Z

AFNetworking/AFURLSessionManager.m

+    NSDictionary *userInfo = @{
+        NSURLErrorFailingURLErrorKey: url,
+        NSURLErrorFailingURLStringErrorKey: url.absoluteString,
+        NSURLErrorFailingURLPeerTrustErrorKey: (__bridge id)serverTrust,


This line is causing problems on new AFNetworking 4.0.0.

https://github.com/AFNetworking/AFNetworking/issues/4541

cnoon reviewed Apr 5, 2016
View reviewed changes

cnoon mentioned this pull request Apr 7, 2016

-999 instead of 401 Alamofire/Alamofire#1159

Closed

kcharwood added the security label Apr 8, 2016

kcharwood added this to the 3.2.0 milestone Apr 8, 2016

kcharwood reviewed Apr 8, 2016
View reviewed changes

0xced force-pushed the pinning-failure-better-error branch from fbcd40e to ab8e777 Compare April 8, 2016 16:09

kcharwood reviewed Apr 11, 2016
View reviewed changes

0xced force-pushed the pinning-failure-better-error branch from ab8e777 to 3e01f58 Compare April 12, 2016 22:14

0xced force-pushed the pinning-failure-better-error branch from 3e01f58 to b467638 Compare April 12, 2016 22:17

kcharwood added the needs backmerge/rebase label Oct 5, 2016

0xced force-pushed the pinning-failure-better-error branch from 6a7f286 to 4501acb Compare October 5, 2016 18:28

0xced force-pushed the pinning-failure-better-error branch from 4501acb to 8008b83 Compare October 10, 2016 16:20

0xced force-pushed the pinning-failure-better-error branch from 8008b83 to cda68cd Compare October 12, 2016 18:44

0xced added 11 commits October 18, 2016 17:44

Error code on pinning failure must be meaningful

ca9bd75

`NSURLErrorServerCertificateUntrusted` instead of `NSURLErrorCancelled`

Remove unneeded __block qualifier

ec67349

Add warnings about implementing an authentication challenge block

14e04ae

Precise error when the server trust is invalid

66dd379

Fixes #3165

Better server trust error with userInfo dictionary

6e35263

Simplify code flow

ab40dfa

Better setSessionDidReceiveAuthenticationChallengeBlock: documentation

b5ee618

Do not completely bypass the security policy

28000a8

Let the possibility to the `taskDidReceiveAuthenticationChallenge` block to fallback to security policy evaluation by returning `NSURLSessionAuthChallengePerformDefaultHandling`.

Better expectation descriptions for invalid server trust tests

a7a7c3a

Rename ServerTrustErrorKey into AuthenticationChallengeErrorKey

bccbcfe

0xced added 4 commits October 18, 2016 17:44

Fix nullability annotation

fc63fea

Throw if the authentication challenge handler returns an invalid value

ff61eae

Document -[AFURLSessionManager setAuthenticationChallengeHandler:]

9310feb

0xced force-pushed the pinning-failure-better-error branch from c40c43f to 9310feb Compare October 18, 2016 15:44

0xced removed the needs backmerge/rebase label Oct 18, 2016

SlaunchaMan modified the milestones: 3.2.0, 3.3.0 Dec 15, 2017

SlaunchaMan modified the milestones: 3.3.0, 3.4.0 Jul 13, 2018

jshier added the needs review label Oct 21, 2019

jshier closed this Mar 27, 2020

jshier reopened this Mar 27, 2020

jshier changed the base branch from master to afnetworking4 March 27, 2020 15:12

jshier changed the base branch from afnetworking4 to master March 27, 2020 15:12

jshier approved these changes Mar 27, 2020

View reviewed changes

jshier merged commit c4d8f62 into AFNetworking:master Mar 27, 2020

jshier modified the milestones: 3.4.0, 4.0.0 Mar 29, 2020

0xced deleted the pinning-failure-better-error branch March 30, 2020 20:02

Kaspik reviewed Apr 3, 2020

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pinning failure better error #3425

Pinning failure better error #3425

0xced commented Apr 4, 2016

cnoon Apr 5, 2016

kcharwood Apr 8, 2016

0xced Apr 8, 2016

kcharwood Apr 11, 2016

0xced Apr 11, 2016

kcharwood Apr 11, 2016

kcharwood Apr 11, 2016

0xced Apr 11, 2016

0xced commented Apr 12, 2016

kcharwood commented Oct 5, 2016

0xced commented Oct 5, 2016

kcharwood commented Oct 10, 2016

codecov-io commented Oct 10, 2016 •

edited

Loading

0xced commented Oct 17, 2016

0xced commented Oct 18, 2016

dmiluski commented Jan 13, 2018

n8gray commented Mar 25, 2020

jshier commented Mar 27, 2020

0xced commented Mar 27, 2020

jshier commented Mar 27, 2020

jshier left a comment

Kaspik Apr 3, 2020

Pinning failure better error #3425

Pinning failure better error #3425

Conversation

0xced commented Apr 4, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

0xced commented Apr 12, 2016

kcharwood commented Oct 5, 2016

0xced commented Oct 5, 2016

kcharwood commented Oct 10, 2016

codecov-io commented Oct 10, 2016 • edited Loading

Current coverage is 87.59% (diff: 85.07%)

0xced commented Oct 17, 2016

0xced commented Oct 18, 2016

dmiluski commented Jan 13, 2018

n8gray commented Mar 25, 2020

jshier commented Mar 27, 2020

0xced commented Mar 27, 2020

jshier commented Mar 27, 2020

jshier left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-io commented Oct 10, 2016 •

edited

Loading