This is an automated email from the ASF dual-hosted git repository. NiklasMerz pushed a commit to branch ios-callback-check in repository https://gitbox.apache.org/repos/asf/cordova-plugin-inappbrowser.git
commit f034adc8e14a1a622f7f1622ddc5c6e16eeaadf6 Author: Niklas Merz <[email protected]> AuthorDate: Tue May 19 23:08:33 2026 +0200 fix(ios): check callbackId with regex --- src/ios/CDVWKInAppBrowser.m | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/ios/CDVWKInAppBrowser.m b/src/ios/CDVWKInAppBrowser.m index fea8bea..9574768 100644 --- a/src/ios/CDVWKInAppBrowser.m +++ b/src/ios/CDVWKInAppBrowser.m @@ -559,6 +559,18 @@ NSDictionary *messageContent = (NSDictionary *) message.body; NSString *scriptCallbackId = messageContent[@"id"]; + // Only allow callback ids generated by this plugin, e.g. "InAppBrowser123". + if (![scriptCallbackId isKindOfClass:[NSString class]]) { + NSLog(@"InAppBrowser callback called with missing or non-string callback id"); + return; + } + + NSRegularExpression *callbackIdRegex = [NSRegularExpression regularExpressionWithPattern:@"^InAppBrowser[0-9]{1,10}$" options:0 error:nil]; + if ([callbackIdRegex firstMatchInString:scriptCallbackId options:0 range:NSMakeRange(0, scriptCallbackId.length)] == nil) { + NSLog(@"InAppBrowser callback called with invalid callbackId: %@", scriptCallbackId); + return; + } + if ([messageContent objectForKey:@"d"]) { NSString *scriptResult = messageContent[@"d"]; NSError * __autoreleasing error = nil; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
