ios FirebaseMessaging library using unsecure NSCoding protocol

[papaonlegs]

General

Purpose of this discussion is to enhance this library to be more secure

Issue

Latest version of this library (at time of writing v18.3.0) uses a version of FirebaseMessaging that uses NSCoding protocol. NSCoding has a newer more secure version called NSSecureCoding that provides more secure serialisation and deserialisation.

Location

iOS Pods library: FirebaseMessaging
Files:

1. FIRMessagingAPNSInfo.h
2. FIRMessagingAPNSInfo.m
3. FIRMessagingTokenInfo.h
4. FIRMessagingTokenInfo.m

Proposed change

Usage of NSCoding has been removed completely from here, according to the latest discussion around this in their repository. Updating to the latest version should address the concern here

[mikehardy]

I do not see NSCoding references anywhere in our library. The underlying firebase-ios-sdk has been updated as of version 7.11.0 to use NSSecureCoding. We are currently integrating with firebase-ios-sdk 10.17.0 so I do not believe this is a current issue if you are using current versions.

If I'm wrong, please post links to the lines of code in the repo (you can get them via github repo search on the web then grabbing the permalink from the line number).