Merge pull request #153 from square/dfed--enforce-password-on-migration

Enforce that migration specifies kSecClassGenericPassword to avoid data loss

README.md

@@ -159,7 +159,7 @@ This instance also stores and retrieves data in the Secure Enclave, but does not
 
 ### Migrating Existing Keychain Values into Valet
 
-Already using the Keychain and no longer want to maintain your own Keychain code? We feel you. That’s why we wrote `migrateObjects(matching query: [String : AnyHashable], removeOnCompletion: Bool)`. This method allows you to migrate all your existing Keychain entries to a Valet instance in one line. Just pass in an NSDictionary with the `kSecClass`, `kSecAttrService`, and any other `kSecAttr*` attributes you use – we’ll migrate the data for you.
+Already using the Keychain and no longer want to maintain your own Keychain code? We feel you. That’s why we wrote `migrateObjects(matching query: [String : AnyHashable], removeOnCompletion: Bool)`. This method allows you to migrate all your existing Keychain entries to a Valet instance in one line. Just pass in a Dictionary with the `kSecClass`, `kSecAttrService`, and any other `kSecAttr*` attributes you use – we’ll migrate the data for you.
 
 ### Debugging
 

Sources/Internal/Keychain.swift

@@ -250,8 +250,8 @@ internal final class Keychain {
             return .invalidQuery
         }
 
-        guard let _ = query[kSecClass as String] as? String else {
-            ErrorHandler.assertionFailure("Migration requires a kSecClass to be set to a valid kSecClass string.")
+        guard query[kSecClass as String] as? String as CFString? == kSecClassGenericPassword else {
+            ErrorHandler.assertionFailure("Migration requires kSecClass to be set to kSecClassGenericPassword to avoid data loss.")
             return .invalidQuery
         }
 

Tests/ValetTests.swift

@@ -566,6 +566,10 @@ class ValetTests: XCTestCase
 
         // Without a kSecClass, the migration should fail.
         XCTAssertEqual(.invalidQuery, anotherFlavor.migrateObjects(matching: mutableQuery, removeOnCompletion: false))
+
+        mutableQuery[kSecClass as String] = kSecClassInternetPassword
+        // Without a kSecClass set to something other than kSecClassGenericPassword, the migration should fail.
+        XCTAssertEqual(.invalidQuery, anotherFlavor.migrateObjects(matching: mutableQuery, removeOnCompletion: false))
     }
 
     func test_migrateObjectsMatching_failsForBadQueries()

Valet.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name     = 'Valet'
-  s.version  = '3.2.0'
+  s.version  = '3.2.1'
   s.license  = 'Apache License, Version 2.0'
   s.summary  = 'Securely store data on iOS, tvOS, watchOS, or macOS without knowing a thing about how the Keychain works. It\'s easy. We promise.'
   s.homepage = 'https://github.com/square/Valet'