How to solve this NSKeyedArchiver warning

Hey Claude, always the most interesting questions. But in all honesty, I don’t know how are you getting to that. I need more context and the full scroll of warnings as right now it looks like warnings relate to security improvements in regarding unarchiving objects. Is that a TestFlight build? Can you provide here more information about the build and code causing this?

Is it an array where you use NSKeyedUnarchiver validateAllowedClass:forKey:?

Would be great to see the sydiagnose for these warnings aim to inform you about potential security risks when unarchiving data from untrusted sources? If your array contains objects and you've only added to the allowed classes list

To resolve this warning, you should include all specific types contained within the archived data that are expected to be decoded. If your array indeed contains objects, update your allowed classes. Any chance you can produce a focused sample so we can take a look of the those warnings?

Looking forward to see the focused simple project reproducing the issue!

Albert Pascual
  Worldwide Developer Relations.

Thanks Albert for replying.

Is it an array where you use NSKeyedUnarchiver validateAllowedClass:forKey:?

I have a lot of classes with SecureCoding, and I cannot find from the warning in the log where it comes from.

What is surprising is that I have commented out all the NSNumber.self in any list of decoder.decodeObject(of:, key:) like

        if let format = decoder.decodeObject(of: [NSArray.self/*, NSNumber.self*/], forKey: formatKey) as? [[Int]] { 

And still get the log.

*** -[NSKeyedUnarchiver validateAllowedClass:forKey:] allowed unarchiving safe plist type ''NSNumber' (0x204cdbeb8) [/System/Library/Frameworks/Foundation.framework]' for key 'NS.objects', even though it was not explicitly included in the client allowed classes set: '{(
    "'NSArray' (0x204cd5598) [/System/Library/Frameworks/CoreFoundation.framework]"
)}'. This will be disallowed in the future.
*** -[NSKeyedUnarchiver validateAllowedClass:forKey:] allowed unarchiving safe plist type ''NSNumber' (0x204cdbeb8) [/System/Library/Frameworks/Foundation.framework]' for key 'NS.objects', even though it was not explicitly included in the client allowed classes set: '{(
    "'NSArray' (0x204cd5598) [/System/Library/Frameworks/CoreFoundation.framework]"
)}'. This will be disallowed in the future.

So the questions:

• does the alert ask to include NSNumber.self in some decoder.decodeObject(of:) ?
• How can I find where the message triggers ?

I will try to locate by setting breakpoints at decoder.decodeObject(of:, key:) calls, but there maybe a simpler way ?

PS: this new API for secure coding makes it really difficult. It would be great if Xcode could propose the list of Types to include in decoder.decodeObject(of:, key:).

SOLVED.

I did log a message before each call of decoder.decodeObject(of: key:)

That let me find the issue, and replace:

self.aVar = decoder.decodeObject(of: NSArray.self, forKey: someKey) as? someClass

by

self.aVar = decoder.decodeObject(of: [NSArray.self, NSSet.self, NSNumber.self], forKey: someKey) as? someClass

Effectively, someClass has properties that have NSSet properties as well as Int.

That was my error, but I still think that Xcode should be able to guess this and provide clearer messages or propose autocompletion. Not yet the case in Xcode 16.4 nor 26.2. I'll file a bug report for enhancement.

@Claude31 This is good news and thanks for posting the solution.

Albert Pascual
  Worldwide Developer Relations.