How do we prevent calling the method programmatically? - ios

Question

We need to prevent a method call programmatically. We just want to call method with user interaction from UI.
Actually, We're developing a SDK. We have some custom UI object classes. We want to avoid the user access to target methods without using our custom UI objects.
UIButton is just an example. It can be UISwitch or another UI element. Or maybe SwiftUI elements.
This is required as a security measure. It is a precaution we want to put so that malicious people do not call it as if it is an operation from the interface.
We want the operation to be performed only from the interface. So we check the information in Thread.callStackSymbols. But this code doesn't work in Testflight or release. It only works in debug mode.
You will see a UIButton below example. When clicked it’ll call clickedButton. But there is a method that call maliciousMethod. It can call clickedButton programmatically. We want to prevent it.
import UIKit
class ViewController: UIViewController {
override func viewDidLoad() {
super.viewDidLoad()
let button = UIButton(frame: CGRect(x: 100, y: 100, width: 200, height: 50))
button.backgroundColor = .red
button.setTitle("Click Me", for: .normal)
self.view.addSubview(button)
button.addTarget(self, action: #selector(buttonClicked(_:)), for: .touchUpInside)
}
#objc func buttonClicked(_ sender : UIButton) {
/// We need to check action called from UI or another method here.
let symbols = Thread.callStackSymbols
let str: String = symbols[3]
if str.contains("sendAction") == false && str.contains("SwiftUI7Binding") == false {
print("It's called from programmatically. Abort")
return
}
}
/// We want to prevent this kind of call
func maliciousMethod() {
buttonClicked(UIButton())
}
}

Answer 1

There's not much you can do if someone has access to your code base, so I assume your ViewController is part of a binary framework to be distributed, that you want to secure against malicious programmers. In that case, you could store the button you want to allow as a private or fileprivate property in your ViewController. Then check for it in buttonClicked().
So something like this:
class ViewController: UIViewController {
fileprivate var secureButton: UIButton! // <-- Added this
override func viewDidLoad() {
super.viewDidLoad()
// Using/saving the secureButton here
secureButton = UIButton(frame: CGRect(x: 100, y: 100, width: 200, height: 50))
...
}
#objc func buttonClicked(_ sender : UIButton) {
/*
Check for the expected sender here. You probably don't want to
actually fatalError, but rather do something more sensible for
you app/framework
*/
guard sender === secureButton else {
fatalError("Strange things are afoot at the Circle-K")
}
...
}
/// This method will now trigger the guard in buttonClicked
func maliciousMethod() {
buttonClicked(UIButton())
}
}