You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cordova.apache.org by ni...@apache.org on 2026/05/19 21:17:56 UTC
(cordova-plugin-inappbrowser) branch ios-callback-check created (now f034adc)
This is an automated email from the ASF dual-hosted git repository.
NiklasMerz pushed a change to branch ios-callback-check
in repository https://gitbox.apache.org/repos/asf/cordova-plugin-inappbrowser.git
at f034adc fix(ios): check callbackId with regex
This branch includes the following new commits:
new f034adc fix(ios): check callbackId with regex
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org
(cordova-plugin-inappbrowser) 01/01: fix(ios): check callbackId with regex
Posted by ni...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
NiklasMerz pushed a commit to branch ios-callback-check
in repository https://gitbox.apache.org/repos/asf/cordova-plugin-inappbrowser.git
commit f034adc8e14a1a622f7f1622ddc5c6e16eeaadf6
Author: Niklas Merz <ni...@merz.dev>
AuthorDate: Tue May 19 23:08:33 2026 +0200
fix(ios): check callbackId with regex
---
src/ios/CDVWKInAppBrowser.m | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/ios/CDVWKInAppBrowser.m b/src/ios/CDVWKInAppBrowser.m
index fea8bea..9574768 100644
--- a/src/ios/CDVWKInAppBrowser.m
+++ b/src/ios/CDVWKInAppBrowser.m
@@ -559,6 +559,18 @@
NSDictionary *messageContent = (NSDictionary *) message.body;
NSString *scriptCallbackId = messageContent[@"id"];
+ // Only allow callback ids generated by this plugin, e.g. "InAppBrowser123".
+ if (![scriptCallbackId isKindOfClass:[NSString class]]) {
+ NSLog(@"InAppBrowser callback called with missing or non-string callback id");
+ return;
+ }
+
+ NSRegularExpression *callbackIdRegex = [NSRegularExpression regularExpressionWithPattern:@"^InAppBrowser[0-9]{1,10}$" options:0 error:nil];
+ if ([callbackIdRegex firstMatchInString:scriptCallbackId options:0 range:NSMakeRange(0, scriptCallbackId.length)] == nil) {
+ NSLog(@"InAppBrowser callback called with invalid callbackId: %@", scriptCallbackId);
+ return;
+ }
+
if ([messageContent objectForKey:@"d"]) {
NSString *scriptResult = messageContent[@"d"];
NSError * __autoreleasing error = nil;
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org