[GH-ISSUE #132] Crash When Intercepting URLSessionUploadTask #82

New issue

Closed

opened 2026-03-03 19:11:37 +03:00 by kerem · 2 comments

kerem commented

2026-03-03 19:11:37 +03:00

Owner

Originally created by @VaslD on GitHub (Jul 20, 2023).
Original GitHub issue: https://github.com/ProxymanApp/atlantis/issues/132

We recently encountered an Atlantis-related crash at:

github.com/ProxymanApp/atlantis@f6f7be1330/Sources/NetworkInjector+URLSession.swift (L294-L298)

I've found the cause but since I'm too familiar with method swizzling and calling conventions, I think you might want to take a look and verify this.

The problem is that uploadTaskWithRequest:fromData:completionHandler:, and its Swift counterpart uploadTask(with:from:completionHandler:), has an optional Data? parameter. Atlantis swizzled this method with a C function @convention(c) (AnyObject, Selector, AnyObject, AnyObject, AnyObject) -> AnyObject that marks all parameters non-null.

A third-party library actually passes nil to the Data? parameter, which causes Atlantis to crash when reading data. Although the code uses if let, data is always implicitly unwrapped to non-optional first because the C function signature declares AnyObject (instead of AnyObject?).

The fix seems to work when declaring parameters for data and completionHandler as optionals, and taking non-null data out of assertions. As a precaution, you should review other swizzled URLSessionTask factory methods to avoid implicit unwraps.

Originally created by @VaslD on GitHub (Jul 20, 2023). Original GitHub issue: https://github.com/ProxymanApp/atlantis/issues/132 We recently encountered an Atlantis-related crash at: https://github.com/ProxymanApp/atlantis/blob/f6f7be1330bd4f847b6d52278acd88516eaac471/Sources/NetworkInjector%2BURLSession.swift#L294-L298 <img width="1440" alt="Screenshot 07-20 15 17 02@2x" src="https://github.com/ProxymanApp/atlantis/assets/3415065/1abbff36-3ffb-4934-b10b-548cf3f1d558"> I've found the cause but since I'm too familiar with method swizzling and calling conventions, I think you might want to take a look and verify this. The problem is that [`uploadTaskWithRequest:fromData:completionHandler:`](https://developer.apple.com/documentation/foundation/nsurlsession/1411518-uploadtaskwithrequest?language=objc), and its Swift counterpart [`uploadTask(with:from:completionHandler:)`](https://developer.apple.com/documentation/foundation/urlsession/1411518-uploadtask), has an optional `Data?` parameter. Atlantis swizzled this method with a C function `@convention(c) (AnyObject, Selector, AnyObject, AnyObject, AnyObject) -> AnyObject` that marks all parameters non-null. A third-party library actually passes `nil` to the `Data?` parameter, which causes Atlantis to crash when reading `data`. Although the code uses `if let`, `data` is always implicitly unwrapped to non-optional first because the C function signature declares `AnyObject` (instead of `AnyObject?`). <img width="1426" alt="Screenshot 07-20 15 35 06@2x" src="https://github.com/ProxymanApp/atlantis/assets/3415065/901f486e-aaca-41be-b5d0-8405b0ba4bf0"> The fix seems to work when declaring parameters for `data` and `completionHandler` as optionals, and taking non-null `data` out of assertions. **As a precaution, you should review other swizzled `URLSessionTask` factory methods to avoid implicit unwraps.**

kerem closed this issue

2026-03-03 19:11:37 +03:00

kerem commented

2026-03-03 19:11:38 +03:00

Author

Owner

@NghiaTranUIT commented on GitHub (Jul 20, 2023):

@VaslD can you verify what iOS version you're using?

@NghiaTranUIT commented on GitHub (Jul 20, 2023): @VaslD can you verify what iOS version you're using?

kerem commented

2026-03-03 19:11:38 +03:00

Author

Owner

@VaslD commented on GitHub (Jul 20, 2023):

I have confirmed crash reports from iOS 15.7.2 and 15.1, with IPAs generated from Xcode 14.2 and 14.3.1. Suspicious crashes do happen on other iOS versions during QA but I have not received crash reports to corroborate those claims.

But seeing the latest API documentation (I referenced in the original post) does declare the data parameter as nullable, it would be safe to not assume that it isn't.

@VaslD commented on GitHub (Jul 20, 2023): I have confirmed crash reports from iOS 15.7.2 and 15.1, with IPAs generated from Xcode 14.2 and 14.3.1. Suspicious crashes do happen on other iOS versions during QA but I have not received crash reports to corroborate those claims. But seeing the latest API documentation (I referenced in the original post) does declare the `data` parameter as nullable, it would be safe to not assume that it isn't.

kerem referenced this issue

2026-03-03 19:12:02 +03:00

[PR #83] [CLOSED] [WIP] Fix loop in Runtime GetAllClasses #135