(cordova-plugin-inappbrowser) 01/01: fix(ios): check callbackId with regex

[ni...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

NiklasMerz pushed a commit to branch ios-callback-check
in repository https://gitbox.apache.org/repos/asf/cordova-plugin-inappbrowser.git

commit f034adc8e14a1a622f7f1622ddc5c6e16eeaadf6
Author: Niklas Merz <ni...@merz.dev>
AuthorDate: Tue May 19 23:08:33 2026 +0200

    fix(ios): check callbackId with regex
---
 src/ios/CDVWKInAppBrowser.m | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/ios/CDVWKInAppBrowser.m b/src/ios/CDVWKInAppBrowser.m
index fea8bea..9574768 100644
--- a/src/ios/CDVWKInAppBrowser.m
+++ b/src/ios/CDVWKInAppBrowser.m
@@ -559,6 +559,18 @@
         NSDictionary *messageContent = (NSDictionary *) message.body;
         NSString *scriptCallbackId = messageContent[@"id"];
 
+        // Only allow callback ids generated by this plugin, e.g. "InAppBrowser123".
+        if (![scriptCallbackId isKindOfClass:[NSString class]]) {
+            NSLog(@"InAppBrowser callback called with missing or non-string callback id");
+            return;
+        }
+
+        NSRegularExpression *callbackIdRegex = [NSRegularExpression regularExpressionWithPattern:@"^InAppBrowser[0-9]{1,10}$" options:0 error:nil];
+        if ([callbackIdRegex firstMatchInString:scriptCallbackId options:0 range:NSMakeRange(0, scriptCallbackId.length)] == nil) {
+            NSLog(@"InAppBrowser callback called with invalid callbackId: %@", scriptCallbackId);
+            return;
+        }
+
         if ([messageContent objectForKey:@"d"]) {
             NSString *scriptResult = messageContent[@"d"];
             NSError * __autoreleasing error = nil;


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org