Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Auth] Forward secure coding calls for TOTPMultiFactorInfo #13592

Merged
merged 7 commits into from
Sep 7, 2024
Merged

Conversation

ncooke3
Copy link
Member

@ncooke3 ncooke3 commented Sep 5, 2024

Fix #13591


nickcooke@nickcooke-mac firebase-3 % git grep "\.totpInfo" -- FirebaseAuth/Sources/Swift
FirebaseAuth/Sources/Swift/Backend/AuthBackend.swift:          } else if let _ = enrollment.totpInfo {
FirebaseAuth/Sources/Swift/MultiFactor/MultiFactor.swift:        } else if enrollment.totpInfo != nil {

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Despite being marked unavailable, this class's init?(coder:) is actually called when totp is registered:

coder.encode(enrolledFactors, forKey: kEnrolledFactorsCodingKey)

Copy link
Member

@paulb777 paulb777 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

Will need to be cherry-picked to 11.2 branch as well.

@ncooke3
Copy link
Member Author

ncooke3 commented Sep 6, 2024

I'm not sure now is the time to address it, but TOTPMultiFactorInfo is not public but PhoneMultiFactorInfo is. This also applies to 10.29.0.

Comment on lines -25 to -26
/// This is the totp info for the second factor.
let totpInfo: NSObject?
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typing this with a more specific type (dictionary) added a more code to cast it during encoding and decoding. I stepped back and see that this property is never read from (it's only read from from the AuthProtoMFAEnrollment.swift class). I think it's better to just remove it as it's addition is more confusing.

@ncooke3
Copy link
Member Author

ncooke3 commented Sep 6, 2024

I was able to successfully enroll via TOTP in the sample app using these changes.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Critical bug FirebaseAuth.TOTPMultiFactorInfo in v11.0.0 - v11.1.0
3 participants