Use secure encoding for messaging's pending topics (#4826)

* also remove deprecate warning when archive the object

Author: charlotteliang

Firebase/Messaging/CHANGELOG.md

@@ -2,6 +2,7 @@
 - [added] Firebase Pod support for watchOS: `pod 'Firebase/Messaging'` in addition to `pod 'FirebaseMessaging'`. (#4807)
 - [fixed] Fix FIRMessagingExtensionHelper crash in unit tests when `attachment == nil`. (#4689)
 - [fixed] Fix FIRMessagingRmqManager crash when database is removed. This only happens when device has a corrupted database file. (#4771)
+- [fixed] Use secure encoding for messaging's pending topics objects. (#3686)
 
 # 2020-01 -- v 4.2.0
 - [added] Added watchOS support for Firebase Messaging. This enables FCM push notification function on watch only app or independent watch app. (#4016)

Firebase/Messaging/FIRMessagingPendingTopicsList.h

@@ -30,7 +30,7 @@ NS_ASSUME_NONNULL_BEGIN
  *  topics is unique, as it doesn't make sense to apply the same action to the same topic
  *  repeatedly; the result would be the same as the first time.
  */
-@interface FIRMessagingTopicBatch : NSObject <NSCoding>
+@interface FIRMessagingTopicBatch : NSObject <NSSecureCoding>
 
 @property(nonatomic, readonly, assign) FIRMessagingTopicAction action;
 @property(nonatomic, readonly, copy) NSMutableSet <NSString *> *topics;
@@ -101,7 +101,7 @@ NS_ASSUME_NONNULL_BEGIN
  *
  *  @see FIRMessagingPendingTopicsListDelegate
  */
-@interface FIRMessagingPendingTopicsList : NSObject <NSCoding>
+@interface FIRMessagingPendingTopicsList : NSObject <NSSecureCoding>
 
 @property(nonatomic, weak) NSObject <FIRMessagingPendingTopicsListDelegate> *delegate;
 

Firebase/Messaging/FIRMessagingPendingTopicsList.m

@@ -48,15 +48,18 @@ - (instancetype)initWithAction:(FIRMessagingTopicAction)action {
   return self;
 }
 
-#pragma mark NSCoding
+#pragma mark NSSecureCoding
+
++ (BOOL)supportsSecureCoding {
+  return YES;
+}
 
 - (void)encodeWithCoder:(NSCoder *)aCoder {
   [aCoder encodeInteger:self.action forKey:kPendingTopicBatchActionKey];
   [aCoder encodeObject:self.topics forKey:kPendingTopicBatchTopicsKey];
 }
 
 - (instancetype)initWithCoder:(NSCoder *)aDecoder {
-
   // Ensure that our integer -> enum casting is safe
   NSInteger actionRawValue = [aDecoder decodeIntegerForKey:kPendingTopicBatchActionKey];
   FIRMessagingTopicAction action = FIRMessagingTopicActionSubscribe;
@@ -65,10 +68,7 @@ - (instancetype)initWithCoder:(NSCoder *)aDecoder {
   }
 
   if (self = [self initWithAction:action]) {
-    NSSet *topics = [aDecoder decodeObjectForKey:kPendingTopicBatchTopicsKey];
-    if ([topics isKindOfClass:[NSSet class]]) {
-      _topics = [topics mutableCopy];
-    }
+    _topics = [aDecoder decodeObjectOfClass:[NSSet class] forKey:kPendingTopicBatchTopicsKey];
     _topicHandlers = [NSMutableDictionary dictionary];
   }
   return self;
@@ -109,20 +109,22 @@ + (void)pruneTopicBatches:(NSMutableArray <FIRMessagingTopicBatch *> *)topicBatc
   }
 }
 
-#pragma mark NSCoding
+#pragma mark NSSecureCoding
+
++ (BOOL)supportsSecureCoding {
+  return YES;
+}
 
 - (void)encodeWithCoder:(NSCoder *)aCoder {
   [aCoder encodeObject:[NSDate date] forKey:kPendingTopicsTimestampEncodingKey];
   [aCoder encodeObject:self.topicBatches forKey:kPendingBatchesEncodingKey];
 }
 
 - (nullable instancetype)initWithCoder:(NSCoder *)aDecoder {
-
   if (self = [self init]) {
-    _archiveDate = [aDecoder decodeObjectForKey:kPendingTopicsTimestampEncodingKey];
-    NSArray *archivedBatches = [aDecoder decodeObjectForKey:kPendingBatchesEncodingKey];
-    if (archivedBatches) {
-      _topicBatches = [archivedBatches mutableCopy];
+    _archiveDate = [aDecoder decodeObjectOfClass:[NSDate class] forKey:kPendingTopicsTimestampEncodingKey];
+    _topicBatches = [aDecoder decodeObjectOfClass:[NSMutableArray<FIRMessagingTopicBatch *> class] forKey:kPendingBatchesEncodingKey];
+    if (_topicBatches) {
       [FIRMessagingPendingTopicsList pruneTopicBatches:_topicBatches];
     }
     _topicsInFlight = [NSMutableSet set];

Firebase/Messaging/FIRMessagingPubSub.m

@@ -183,10 +183,14 @@ - (BOOL)pendingTopicsListCanRequestTopicUpdates:(FIRMessagingPendingTopicsList *
 
 - (void)archivePendingTopicsList:(FIRMessagingPendingTopicsList *)topicsList {
   GULUserDefaults *defaults = [GULUserDefaults standardUserDefaults];
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-  NSData *pendingData = [NSKeyedArchiver archivedDataWithRootObject:topicsList];
-#pragma clang diagnostic pop
+
+  NSData *pendingData;
+  if (@available(macOS 10.13, iOS 11.0, tvOS 11.0, watchOS 4.0, *)) {
+    NSError *error;
+    pendingData = [NSKeyedArchiver archivedDataWithRootObject:topicsList requiringSecureCoding:YES error:&error];
+  } else {
+    pendingData = [NSKeyedArchiver archivedDataWithRootObject:topicsList];
+  }
   [defaults setObject:pendingData forKey:kPendingSubscriptionsListKey];
   [defaults synchronize];
 }
@@ -195,16 +199,17 @@ - (void)restorePendingTopicsList {
   GULUserDefaults *defaults = [GULUserDefaults standardUserDefaults];
   NSData *pendingData = [defaults objectForKey:kPendingSubscriptionsListKey];
   FIRMessagingPendingTopicsList *subscriptions;
-  @try {
-    if (pendingData) {
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-      subscriptions = [NSKeyedUnarchiver unarchiveObjectWithData:pendingData];
-#pragma clang diagnostic pop
+  if (pendingData) {
+    if (@available(macOS 10.13, iOS 11.0, tvOS 11.0, watchOS 4.0, *)) {
+      NSError *error;
+      subscriptions = [NSKeyedUnarchiver unarchivedObjectOfClass:[NSData class] fromData:pendingData error:&error];
+    } else {
+      @try {
+        subscriptions = [NSKeyedUnarchiver unarchiveObjectWithData:pendingData];
+      } @catch (NSException *exception) {
+        // Nothing we can do, just continue as if we don't have pending subscriptions
+      }
     }
-  } @catch (NSException *exception) {
-    // Nothing we can do, just continue as if we don't have pending subscriptions
-  } @finally {
     if (subscriptions) {
       self.pendingTopicUpdates = subscriptions;
     } else {