Fix sync crypto error handling to protect against DoS (#2223)

Task/Issue URL: https://app.asana.com/0/0/1206634174761721/f Description: During a security audit, it was discovered that a lack of error handling in the ddgSyncCrypto library can cause unexpected crashes leading to remote DoS on iOS and macOS. This is a rare occurrence and requires some work to test, but the crux is: an unexpected exception due to invalid cipher text lengths returned by the Sync API.
duckduckgo · Feb 26, 2024 · 19c2656 · 19c2656
1 parent 335e033
commit 19c2656
Show file tree

Hide file tree

Showing 11 changed files with 13 additions and 13 deletions.
diff --git a/DuckDuckGo.xcodeproj/project.pbxproj b/DuckDuckGo.xcodeproj/project.pbxproj
@@ -13538,7 +13538,7 @@
 			repositoryURL = "https://github.com/duckduckgo/BrowserServicesKit";
 			requirement = {
 				kind = exactVersion;
-				version = 111.0.0;
+				version = 111.0.2;
 			};
 		};
 		AA06B6B52672AF8100F541C5 /* XCRemoteSwiftPackageReference "Sparkle" */ = {

diff --git a/DuckDuckGo.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved b/DuckDuckGo.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
@@ -14,8 +14,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/duckduckgo/BrowserServicesKit",
       "state" : {
-        "revision" : "418b186e3e015d56f73435e7f6c035e10e106aa6",
-        "version" : "111.0.0"
+        "revision" : "04c35220aa94bd005171086acccadd677400e7d5",
+        "version" : "111.0.2"
       }
     },
     {
@@ -147,7 +147,7 @@
     {
       "identity" : "trackerradarkit",
       "kind" : "remoteSourceControl",
-      "location" : "https://github.com/duckduckgo/TrackerRadarKit",
+      "location" : "https://github.com/duckduckgo/TrackerRadarKit.git",
       "state" : {
         "revision" : "a6b7ba151d9dc6684484f3785293875ec01cc1ff",
         "version" : "1.2.2"

diff --git a/LocalPackages/DataBrokerProtection/Package.swift b/LocalPackages/DataBrokerProtection/Package.swift
@@ -29,7 +29,7 @@ let package = Package(
             targets: ["DataBrokerProtection"])
     ],
     dependencies: [
-        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.0"),
+        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.2"),
         .package(path: "../PixelKit"),
         .package(path: "../SwiftUIExtensions"),
         .package(path: "../XPCHelper")

diff --git a/LocalPackages/LoginItems/Package.swift b/LocalPackages/LoginItems/Package.swift
@@ -13,7 +13,7 @@ let package = Package(
         ),
     ],
     dependencies: [
-        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.0"),
+        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.2"),
     ],
     targets: [
         .target(

diff --git a/LocalPackages/NetworkProtectionMac/Package.swift b/LocalPackages/NetworkProtectionMac/Package.swift
@@ -31,7 +31,7 @@ let package = Package(
         .library(name: "NetworkProtectionUI", targets: ["NetworkProtectionUI"])
     ],
     dependencies: [
-        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.0"),
+        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.2"),
         .package(path: "../XPCHelper"),
         .package(path: "../SwiftUIExtensions"),
         .package(path: "../LoginItems")

diff --git a/LocalPackages/PixelKit/Package.swift b/LocalPackages/PixelKit/Package.swift
@@ -20,7 +20,7 @@ let package = Package(
         )
     ],
     dependencies: [
-        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.0"),
+        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.2"),
     ],
     targets: [
         .target(

diff --git a/LocalPackages/SubscriptionUI/Package.swift b/LocalPackages/SubscriptionUI/Package.swift
@@ -12,7 +12,7 @@ let package = Package(
             targets: ["SubscriptionUI"]),
     ],
     dependencies: [
-        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.0"),
+        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.2"),
         .package(path: "../SwiftUIExtensions")
     ],
     targets: [

diff --git a/LocalPackages/SwiftUIExtensions/Package.swift b/LocalPackages/SwiftUIExtensions/Package.swift
@@ -11,7 +11,7 @@ let package = Package(
         .library(name: "PreferencesViews", targets: ["PreferencesViews"]),
     ],
     dependencies: [
-        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.0"),
+        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.2"),
     ],
     targets: [
         .target(

diff --git a/LocalPackages/SyncUI/Package.swift b/LocalPackages/SyncUI/Package.swift
@@ -14,7 +14,7 @@ let package = Package(
     ],
     dependencies: [
         .package(path: "../SwiftUIExtensions"),
-        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.0"),
+        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.2"),
     ],
     targets: [
         .target(

diff --git a/LocalPackages/SystemExtensionManager/Package.swift b/LocalPackages/SystemExtensionManager/Package.swift
@@ -16,7 +16,7 @@ let package = Package(
         ),
     ],
     dependencies: [
-        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.0"),
+        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.2"),
     ],
     targets: [
         // Targets are the basic building blocks of a package, defining a module or a test suite.

diff --git a/LocalPackages/XPCHelper/Package.swift b/LocalPackages/XPCHelper/Package.swift
@@ -30,7 +30,7 @@ let package = Package(
         .library(name: "XPCHelper", targets: ["XPCHelper"]),
     ],
     dependencies: [
-        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.0"),
+        .package(url: "https://github.com/duckduckgo/BrowserServicesKit", exact: "111.0.2"),
     ],
     targets: [
         .target(