Skip to content

docs(ios): fix Swift network-privacy regex leaving leading & in place - #48

Merged
krassx merged 2 commits into
bugsee:mainfrom
fishmanalex:fix/ios-swift-network-privacy-regex
Sep 5, 2026
Merged

docs(ios): fix Swift network-privacy regex leaving leading & in place#48
krassx merged 2 commits into
bugsee:mainfrom
fishmanalex:fix/ios-swift-network-privacy-regex

Conversation

@fishmanalex

Copy link
Copy Markdown
Contributor

Summary

  • docs/sdk/ios/privacy/network.mdx: the Objective-C sample's redaction regex is access_token=[0-9a-z\-]*; the Swift sample's is &access_token=[0-9a-z\-]* — an extra leading & that requires a preceding query parameter to match.
  • If access_token is the first parameter in the URL (e.g. ?access_token=SECRET), the Swift version silently leaves it in the recorded network event.
  • This is sample code for a privacy/PII-redaction feature, so the bug directly undermines what the page is teaching.

Changes

  • Dropped the leading & from the Swift regex so it matches the Objective-C sample's (correct) behavior.

Test plan

  • npx cspell on the changed file — 0 issues

🤖 Generated with Claude Code

https://claude.ai/code/session_01QnXDhVitCVmMNafPRvKUat

fishmanalex and others added 2 commits September 4, 2026 17:46
The Swift sample's regex was "&access_token=[0-9a-z\-]*" — an extra
leading & that requires a preceding query parameter to match. When
access_token is the first parameter in the URL (e.g.
?access_token=SECRET), the Swift version silently leaves it in the
recorded network event, while the equivalent Objective-C sample
(without the leading &) correctly strips it either way. This is
sample code for a privacy/PII-redaction feature, so the bug directly
undermines what the page is teaching. Dropped the leading & to match
the Objective-C sample.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The sample force-unwrapped event.url to build the NSRange on the line
*above* the `if (event.url != nil)` guard, so the guard never protected
anything — a nil URL crashes the delegate.

Rewrite as `if let url = event.url`, which covers both uses, and size
the NSRange with url.utf16.count rather than url.count: NSRange indexes
UTF-16 code units (matching the Objective-C sample's -length), so a URL
with non-ASCII characters was under-covered and could skip matches.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Change-Id: I81be03aad11d0e3c370ebf1cf0f976f250338c93
@krassx

krassx commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

Confirmed, and it's a real leak rather than a cosmetic mismatch. In network.mdx the Objective-C sample (line 59) uses access_token=… while Swift (line 81) had &access_token=…, so with access_token as the first query parameter (?access_token=SECRET) the Swift filter never matched and the token stayed in the recorded event. Aligning to the Objective-C pattern is the right call.

I pushed one follow-up commit (a57a06c) for a second bug in the same block:

let range = NSMakeRange(0 , (event.url!.count))
if (event.url != nil) {

The force-unwrap is on the line above the nil guard, so the guard never protected anything — a nil URL crashes the delegate. Rewrote as if let url = event.url, which covers both uses.

While there I also switched the range to url.utf16.count. NSRange indexes UTF-16 code units (which is what the Objective-C sample's -length returns); String.count counts grapheme clusters, so a URL with non-ASCII characters produced a short range that could skip matches. Shout if you'd rather I split that into its own PR — it's a one-token change on a line I was already rewriting.

cspell clean (288 files, 0 issues). LGTM.

🤖 Generated with Claude Code

@krassx krassx left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Validated against source (see review comment above). Approving.

@krassx
krassx merged commit 661eeac into bugsee:main Sep 5, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants