Skip to content

fix: Issue #294 NSAllowsArbitraryLoads flag set to false #362

Merged
mikaelbr merged 1 commit intomikaelbr:masterfrom
idhruvs:master
May 14, 2021
Merged

fix: Issue #294 NSAllowsArbitraryLoads flag set to false #362
mikaelbr merged 1 commit intomikaelbr:masterfrom
idhruvs:master

Conversation

@idhruvs
Copy link
Copy Markdown
Contributor

@idhruvs idhruvs commented Jan 28, 2021

Based on the comments of the author of terminal-notifier, this flag was initially set to true to allow using icons with http link, however, given the security issues raised by code-analysers, it is a good practice to disable usage of http.

…void security issues raised by code-analysers
@mikaelbr
Copy link
Copy Markdown
Owner

mikaelbr commented Feb 1, 2021

Hi! So this looks like it would be a new breaking change, right? No longer supporting HTTP images as icons

@idhruvs
Copy link
Copy Markdown
Contributor Author

idhruvs commented Feb 3, 2021

Yes. This would be a breaking change.
However, even the Apple Developer Documentation cautions in using a "true" for this flag.


Important

You must supply a justification during App Store review if you set the key’s value to YES, as described in Provide Justification for Exceptions. Use this key with caution because it significantly reduces the security of your app. In most cases, it’s better to upgrade your servers to meet the requirements imposed by ATS, or at least to use a narrower exception.

@Ctharp11
Copy link
Copy Markdown

Ctharp11 commented Apr 7, 2021

Can this be merged? This package is failing a security scan and Apple recommends setting this flag to false. Security is more important than icons. Icons can also be sent over https.

@mikaelbr mikaelbr merged commit 14af678 into mikaelbr:master May 14, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants