[TIMOB-26849] iOS HTTPS module: Invalid argument passed to securityManager property

GitHub Issue	n/a
Type	Bug
Priority	Low
Status	Open
Resolution	Unresolved
Affected Version/s	n/a
Fix Version/s	n/a
Components	iOS
Labels	engSchedule
Reporter	Hans Knöchel
Assignee	Vijay Singh
Created	2019-02-22T10:37:31.000+0000
Updated	2019-10-28T18:30:34.000+0000

Description

When using the appcelerator.https module, the app sometimes (very rarely) spits out an error about an invalid type. Here is the code used:

// Set some default options
const httpOptions = {
    onload: event => {
        
    },
    onerror: event => {
        
    },
    timeout: 10 * 1000
};

// Use security manager for HTTP pinning
if (Alloy.CFG.api.baseURL.startsWith('https://')) {
    httpOptions.securityManager = Https.createX509CertificatePinningSecurityManager([ {
        url: 'https://*.example.com',
        serverCertificate: 'certs/example_com.der'
    } ]);
}

const httpRequest = Ti.Network.createHTTPClient(httpOptions);

The error comes from [here](https://github.com/appcelerator/titanium_mobile/blob/master/iphone/Classes/TiNetworkHTTPClientProxy.m#L40) and suggests that the securityManager does not conform to the SecurityManagerProtocol or is not properly initialized at the point of it's assignment to the http-client proxy. Unfortunately the module is closed source so we cannot fix this ourselves. See the screenshot for details.

Attachments

File	Date	Size
IMG_1120.PNG	2019-02-22T10:29:11.000+0000	537993

Comments

Vijay Singh 2019-03-15

[~hknoechel] I tried using following test case , but unable to reproduce the issue. Can you give me complete reproducible test app? And what is frequency for this issue? Thanks!

   var https = require('appcelerator.https');
   
   var win = Titanium.UI.createWindow({
     title: 'Pin Example',
     backgroundColor: 'white'
   });
   
   win.open();
   
   setInterval(function(){
     const httpOptions = {
       onload: event => {
           
       },
       onerror: event => {
           
       },
       timeout: 10 * 1000
   };
   
   httpOptions.securityManager = https.createX509CertificatePinningSecurityManager([ {
       url: 'https://www.wellsfargo.com',
       serverCertificate: 'wellsfargo.cer'
   } ]);
   
   const httpRequest = Ti.Network.createHTTPClient(httpOptions);
   Ti.API.info('http request created');
   }, 3000);

Hans Knöchel 2019-03-15

The frequency is rarely every 50th build, which makes even more critical to reproduce. I think it's some kind of race condition in the delegate assignment but I'm not sure.
Shak Hossain 2019-10-28

[~hknoechel] - since we have not updated in a while, just checking to see if you still need us to address this.
Hans Knöchel 2019-10-28

Well, we wait for you guys to fix the issue, there isn't more to update. Please fix this.

JSON Source