jpush / cordova-plugin-jcore Goto Github PK

iOS APP下用到的 jcore-ios-3.2.5.a 链接库被第三方安全公司扫描以下安全漏洞（链接库我又无法自行修改）：

• 代码中使用到了sscanf，被提示存在 格式化字符串漏洞。
  cordova-plugin-jcore/jcore-ios-3.2.5.a JCommonOperationRequest.o sscanf

• release环境下使用了NSLog打印日志，被提示存在 日志数据泄露风险。是否可以宏定义一下NSLog函数？在release环境就不打印任何运行日志数据了。
  cordova-plugin-jcore/jcore-ios-3.2.5.a JCommonOperationRequest.o NSLog

你的运行环境

• 插件版本:
  *平台 IOS:
• Cordova version (10.0.0):
• Cordova platform version (ios 6.0.0):

电脑：macbook pro (M1芯片)

复现

在M1芯片的电脑上运行xcode，在xcode中使用ios模拟器运行项目。

期望效果

能正常使用

实际效果

报错

ld: in /Users/xuzhiwen/Documents/project/xxcig/platforms/ios/新兴际华供应链/Plugins/cordova-plugin-jcore/jcore-ios-2.6.2.a(JCommonLocationController.o), building for iOS Simulator, but linking in object file built for iOS, file '/Users/xuzhiwen/Documents/project/xxcig/platforms/ios/新兴际华供应链/Plugins/cordova-plugin-jcore/jcore-ios-2.6.2.a' for architecture arm64
clang: error: linker command failed with exit code 1 (use -v to see invocation)

** BUILD FAILED **

Since the JCore library is already distributed through CocoaPods, would be good if you could use the CocoaPods dependency instead of the jcore-ios.a file.
You can use the podspec tag in the plugin.xml for that more info

jcore-ios.a prevents Capacitor apps from building, changing to the CocoaPods dependency should fix that.