3 ms·
There was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction
by gjsman-1000 5y ago
There was a developer who discovered a bug with the XML parser, and wrote a whole blog post about how he was able to cause iOS's security system to malfunction using a specially-crafted XML permissions file and allow his app to do anything he wanted, even escape the sandbox. He kept it secret for years for his private experimentation until Apple patched it by accident, by adding a 5th XML parser to the other 4 for some reason and using that one instead for the permissions.
- saagarjha 5y agohttps://siguza.github.io/psychicpaper/ https://siguza.github.io/psychicpaper/
- deleted 5y ago[deleted]
- hypothesis 5y agoAre there seriously 5 XML parsers available in iOS? Are they all written in C? Do they validate all of them whenever a bug is found in one? I can’t tell if this is some sort of defense in depth or just swiss cheese copy-paste…
- saagarjha 5y agoYes, no (some are C++), lol no, no to both: it’s more that people just kept adding more for each domain