AlamofireSoftwareFoundation

Last week, a number of publications ran a story about 1,000's of apps allegedly being vulnerable due to an SSL bug in AFNetworking. These articles contain a number of inaccurate and misleading statements on this matter.

We are publishing this response to clarify and correct these statements.

Background Information

For those not familiar with AFNetworking, here are some relevant details about the library for this story:

• AFNetworking is an open source, third-party library that provides convenience functionality on top of Apple's built-in frameworks.
• One component of AFNetworking is AFSecurityPolicy, which handles authentication challenges according to a policy configured by the application. This includes the evaluation of X.509 certificates which servers send back when connecting over HTTPS.

dhanji

-Xmx10g
m2.xlarge (4 virtual cores)

Both Jetty and Netty execute the same code--generate 8k of random bits and compute a sha1, returning it over the wire.

INTERNAL (Benchmark tool runs on same machine)
--------

Jetty:

steipete

// Xcode 6.3 defines new language features to declare nullability
#if __has_feature(nullability)
#define PSPDF_ASSUME_NONNULL_BEGIN _Pragma("clang assume_nonnull begin")
#define PSPDF_ASSUME_NONNULL_END _Pragma("clang assume_nonnull end")
#define ps_nullable nullable
#define ps_nonnull nonnull
#define ps_null_unspecified null_unspecified
#define ps_null_resettable null_resettable
#define __ps_nullable __nullable
#define __ps_nonnull __nonnull

steipete

NSString *const PSPDFApplicationDidReceiveMemoryWarningNotification = @"PSPDFApplicationDidReceiveMemoryWarningNotification";

// Test with sudo memory_pressure -l critical. Don't forget to re-set afterwards!
__attribute__((constructor)) static void PSPDFInstallLowMemoryNotificationWarningMac(void) {
    static dispatch_source_t source;
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        source = dispatch_source_create(DISPATCH_SOURCE_TYPE_MEMORYPRESSURE, 0, DISPATCH_MEMORYPRESSURE_WARN|DISPATCH_MEMORYPRESSURE_CRITICAL, dispatch_get_main_queue());
        dispatch_source_set_event_handler(source, ^{
            dispatch_source_memorypressure_flags_t pressureLevel = dispatch_source_get_data(source);

swisspol

Apple_PubSub_Socket_Render=/private/tmp/com.apple.launchd.yi2ylKg124/Render
HOME=/var/_xcsbuildd
LOGNAME=_xcsbuildd
PATH=/Applications/Xcode.app/Contents/Developer/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin
PWD=/Library/Developer/XcodeServer/Integrations/Caches/c9e0e876ef9dbb996df76e73d3ac8ad1/Source
SHELL=/bin/false
SHLVL=1
SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.CChp5yaB4Q/Listeners
TMPDIR=/var/folders/df/_sxbhzn54s34nb_bvkc68xfc000086/T/
USER=_xcsbuildd

andymatuschak

//
//  MultiDirectionAdjudicatingScrollView.swift
//  Khan Academy
//
//  Created by Andy Matuschak on 12/16/14.
//  Copyright (c) 2014 Khan Academy. All rights reserved.
//

import UIKit
import UIKit.UIGestureRecognizerSubclass

steipete

This is the code path that changed the status bar orientation on iOS 7:

* thread #1: tid = 0x698dbf, 0x00085830 WindowRotationIssue`-[AppDelegate application:willChangeStatusBarOrientation:duration:](self=0x7a041f90, _cmd=0x0137a18d, application=0x79e39cc0, newStatusBarOrientation=UIInterfaceOrientationPortraitUpsideDown, duration=0.80000000000000004) + 96 at AppDelegate.m:23, queue = 'com.apple.main-thread', stop reason = breakpoint 3.1
  * frame #0: 0x00085830 WindowRotationIssue`-[AppDelegate application:willChangeStatusBarOrientation:duration:](self=0x7a041f90, _cmd=0x0137a18d, application=0x79e39cc0, newStatusBarOrientation=UIInterfaceOrientationPortraitUpsideDown, duration=0.80000000000000004) + 96 at AppDelegate.m:23
    frame #1: 0x00bb6ab5 UIKit`-[UIApplication setStatusBarOrientation:animationParameters:notifySpringBoardAndFence:] + 242
    frame #2: 0x00bfa8e4 UIKit`-[UIWindow _setRotatableClient:toOrientation:updateStatusBar:duration:force:isRotating:] + 4761
    frame #3: 0x00bf9646 UIKit`-[UIWi

vfig

#!/usr/bin/python2.7
## Display a list of provisioning profiles with at least one valid code-signing identity.
##
## Displays the UUID and app identifier for each such provisioning profile, followed by the
## fingerprint and name of the matching code-signing identities.

import glob, os, plistlib, re, subprocess

PROVISIONING_PROFILES_DIR = os.path.expanduser('~/Library/MobileDevice/Provisioning Profiles')
OPENSSL = '/usr/bin/openssl'

steipete

    ModalController *modal = [self.storyboard instantiateViewControllerWithIdentifier:NSStringFromClass(ModalController.class)];
    NavigationController *navController = [[NavigationController alloc] initWithRootViewController:modal];

    // The root problem is that we configure the modal presenation style as a form sheet.
    // This should simply be a NOP on iPhone, but later on has other impications that lead to our bug.
    navController.modalPresentationStyle = UIModalPresentationFormSheet;


    // Later on in the code flow, we do some checks on the presentation controller.
    // Nothing is modified, but the controller is accessed.

alloy

#import <Foundation/Foundation.h>

@interface WTF : NSObject
-:x;
@end

@implementation WTF
-:x;
{
  return x;