Switch from Unsafe Serialization API to NSSecureCoding

[tmrff]

We use the GIPHY iOS xcframework within an iOS app. We recently performed a security scan using Datatherom. The scan results reported that the GIPHY framework contains code that leverages NSCoding, which is known to be vulnerable to object substitution attacks.

The scan revealed that the _TtC10GiphyUISDK11GPHCategory class in the binary conforms to NSCoding.

The NSCoding protocol is not a recommended approach for secure coding. Apple itself suggests using NSSecureCoding instead, which helps to ensure that the serialized and deserialized instances are of the same class.

Please consider migrating to NSSecureCoding if it's feasible.

[cgmaier]

hey @ThomasR39 sorry for the late reply here. Thanks for getting this on our radar!