URL Schemes and the openURL Method

[Cyberizm]

Vulnerable Code:

- (BOOL)application:(UIApplication *)application openURL:(NSURL *)url sourceApplication:(NSString *)sourceApplication annotation:(id)annotation {
if ([sourceApplication isEqualToString:@"com.apple.mobilesafari"]) {
NSLog(@"Loading app from Safari");
return NO; // We don't want to be called by web pages
}
else {
NSString *theQuery = [[url query] stringByReplacingPercentEscapesUsingEncoding:NSUTF8StringEncoding];
NSArray *chunks = [theQuery componentsSeparatedByString:@"&"];
for (NSString* chunk in chunks) {
NSArray *keyval = [chunk componentsSeparatedByString:@"="];
NSString *key = [keyval objectAtIndex:0];
NSString *value = [keyval objectAtIndex:1];
// Do something with your key and value
// --snip--
}
return YES;
}
}

Description: This vulnerable Objective-C code lacks proper validation of the source application when handling incoming URLs. It only checks if the source application is Mobile Safari and rejects it if true. However, it does not verify if the URL is coming from a trusted source, leaving the app vulnerable to URL scheme hijacking.

Patched Code:

- (BOOL)application:(UIApplication *)application openURL:(NSURL *)url sourceApplication:(NSString *)sourceApplication annotation:(id)annotation {
if ([sourceApplication isEqualToString:@"com.mytrustedapp"]) {
NSLog(@"Loading app from trusted source");
NSString *theQuery = [[url query] stringByReplacingPercentEscapesUsingEncoding:NSUTF8StringEncoding];
NSArray *chunks = [theQuery componentsSeparatedByString:@"&"];
for (NSString* chunk in chunks) {
NSArray *keyval = [chunk componentsSeparatedByString:@"="];
NSString *key = [keyval objectAtIndex:0];
NSString *value = [keyval objectAtIndex:1];
// Do something with your key and value
// --snip--
}
return YES;
} else {
NSLog(@"URL received from untrusted source: %@", sourceApplication);
return NO;
}
}

Description: The patched Objective-C code validates the source application by checking if it matches the bundle ID of a trusted app (com.mytrustedapp). If the source application is trusted, the URL parameters are processed. Otherwise, it logs the untrusted source and rejects the URL. This prevents URL scheme hijacking and ensures that the app only accepts URLs from verified sources.

Swift:

Vulnerable Code:

func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
let sourceApplication = options[.sourceApplication] as? String ?? "Unknown"
if sourceApplication == "com.apple.mobilesafari" {
print("Loading app from Safari")
return false // We don't want to be called by web pages
} else {
let theQuery = url.query?.removingPercentEncoding ?? ""
let chunks = theQuery.components(separatedBy: "&")
for chunk in chunks {
let keyval = chunk.components(separatedBy: "=")
let key = keyval[0]
let value = keyval[1]
// Do something with your key and value
// --snip--
}
return true
}
}

Description: This vulnerable Swift code suffers from the same issue as the vulnerable Objective-C code. It lacks proper validation of the source application when handling incoming URLs, making it susceptible to URL scheme hijacking.

Patched Code:

func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
let sourceApplication = options[.sourceApplication] as? String ?? "Unknown"
if sourceApplication == "com.mytrustedapp" {
print("Loading app from trusted source")
let theQuery = url.query?.removingPercentEncoding ?? ""
let chunks = theQuery.components(separatedBy: "&")
for chunk in chunks {
let keyval = chunk.components(separatedBy: "=")
let key = keyval[0]
let value = keyval[1]
// Do something with your key and value
// --snip--
}
return true
} else {
print("URL received from untrusted source: \(sourceApplication)")
return false
}
}

Description: The patched Swift code validates the source application by checking if it matches the bundle ID of a trusted app (com.mytrustedapp). If the source application is trusted, the URL parameters are processed. Otherwise, it logs the untrusted source and rejects the URL. This prevents URL scheme hijacking and ensures that the app only accepts URLs from verified sources.

Professional Hacking Services Available
We offer ethical security assessments and penetration testing for iOS and Android mobile devices, websites, web apps, data servers, cryptography, operational security (OPSEC) posture reviews, digital footprint decontamination, account takeover (ATO) resistance audits, and adversarial reputation risk mitigation.

For inquiries:
E-mail: cyberizm@proton.me / cyberizm@dnmx.cc
Telegram: @cyb3rizm
Signal: cyberizm.88

Contact us for discreet, professional consultation and assistance.