Crash When Intercepting URLSessionUploadTask

[VaslD]

We recently encountered an Atlantis-related crash at:

atlantis/Sources/NetworkInjector+URLSession.swift

Lines 294 to 298 in f6f7be1

	if let task = task as? URLSessionTask,
	let request = request as? NSURLRequest,
	let data = data as? Data {
	self?.delegate?.injectorSessionDidUpload(task: task, request: request, data: data)
	} else {

I've found the cause but since I'm too familiar with method swizzling and calling conventions, I think you might want to take a look and verify this.

The problem is that uploadTaskWithRequest:fromData:completionHandler:, and its Swift counterpart uploadTask(with:from:completionHandler:), has an optional Data? parameter. Atlantis swizzled this method with a C function @convention(c) (AnyObject, Selector, AnyObject, AnyObject, AnyObject) -> AnyObject that marks all parameters non-null.

A third-party library actually passes nil to the Data? parameter, which causes Atlantis to crash when reading data. Although the code uses if let, data is always implicitly unwrapped to non-optional first because the C function signature declares AnyObject (instead of AnyObject?).

The fix seems to work when declaring parameters for data and completionHandler as optionals, and taking non-null data out of assertions. As a precaution, you should review other swizzled URLSessionTask factory methods to avoid implicit unwraps.

[NghiaTranUIT]

@VaslD can you verify what iOS version you're using?

[VaslD]

I have confirmed crash reports from iOS 15.7.2 and 15.1, with IPAs generated from Xcode 14.2 and 14.3.1. Suspicious crashes do happen on other iOS versions during QA but I have not received crash reports to corroborate those claims.

But seeing the latest API documentation (I referenced in the original post) does declare the data parameter as nullable, it would be safe to not assume that it isn't.