iOS UIActivity Sharing
UIActivity Sharing Simplified
Since iOS 6, applications can present a system activity view to share text, URLs, images, and other items with services such as AirDrop or compatible app extensions.[2]
Apple’s UIActivity.ActivityType documentation enumerates built-in activity identifiers. Developers can set excludedActivityTypes, but the security review must also inspect the actual items and any custom activities.[3]
How to Share Data
Attention should be directed towards:[1]
- The nature of the data being shared.
- The inclusion of custom activities.
- The exclusion of certain activity types.
Sharing is facilitated through the instantiation of a UIActivityViewController, to which the items intended for sharing are passed. This is achieved by calling:
$ rabin2 -zq Telegram\ X.app/Telegram\ X | grep -i activityItems
0x1000df034 45 44 initWithActivityItems:applicationActivities:Review the items and custom activities passed to UIActivityViewController, along with any configured excludedActivityTypes.
How to Receive Data
The following aspects are crucial when receiving data:[1]
- The declaration of custom document types.
- The specification of document types the app can open.
- The verification of the integrity of the received data.
Without source, inspect Info.plist for UTExportedTypeDeclarations, UTImportedTypeDeclarations, and CFBundleDocumentTypes. These legacy UTI keys still appear in deployed apps; newer source commonly uses the Uniform Type Identifiers framework and UTType APIs.[4]
Exported declarations define types owned by the app, imported declarations describe types owned elsewhere, and document types associate those identifiers with the app’s open/import behavior.[4]
Dynamic Testing Approach
To test sending activities, one could:[1]
- Hook into the
init(activityItems:applicationActivities:)method to capture the items and activities being shared. - Identify excluded activities by intercepting the
excludedActivityTypesproperty.
For receiving items, it involves:[1]
- Sharing a file with the app from another source (e.g., AirDrop, email) that prompts the “Open with…” dialogue.
- Hooking
application:openURL:options:among other methods identified during static analysis to observe the app’s response. - Employing malformed files or fuzzing techniques to evaluate the app’s robustness.