talsec / Free-RASP-ReactNative

React Native plugin for improving app security and threat monitoring on Android and iOS mobile devices.

Home Page:https://github.com/talsec/Free-RASP-Community

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

app crash on first start on FreeraspReactNative.onInvalidCallback()

nikhilborana opened this issue · comments

Screenshot 2024-02-15 at 7 43 19 PM

getting the crash on first time open only. Install this build from testflight.

Working fine on development.

Hello @nikhilborana ,
thank you for reporting this! We will look at it soon.

Kind regards,
Talsec team

it crashed on both debug and release schema. only for the first time.

"react-native": "0.73.4",
"freerasp-react-native": "^3.6.0",

Hi, yes seeing a few of these crashes on our production app on iOS only (so far).

"react-native": "0.72.6",
"freerasp-react-native": "^3.6.0",

Using very simple implementation of useFreeRasp() as in docs

I wasn't sure if this was related to this code in FreeraspReactNative.swift, which deliberately kills the app

 /**
     * We never send an invalid callback over our channel.
     * Therefore, if this happens, we want to kill the app.
     */
    @objc(onInvalidCallback)
    private func onInvalidCallback() -> Void {
        abort()
    }

Many thanks

Hi,

we found a bug that kills the app when deviceID check is fired on iOS, instead of launching your reaction. Fix will be ready later today.

Thanks for bringing this up.

You're welcome!!
Thanks for your swift action and dedication to improving the functionality of the library are truly commendable.

Just released v3.6.1 which should fix the problem.

sorry to bother you guys, but now its giving Device Id not ok for the first time open and if I kill the app and reopen it is working fine.

Hi @nikhilborana,

The deviceID can be triggered after app reinstallation if none other app from the same vendor is installed on the device.
First run compares the old DeviceID with current DeviceID and updates the DeviceID. When the app is opened for the second time, the current DeviceID is compared to the DeviceID from the first run, so callback is not triggered anymore. You can learn more in the wiki here.

So if you are reinstalling the only app installed from you, it is expected that deviceID is triggered.

If you don't mind whether app was reinstalled, then it is usually fine to ignore this callback.