The importance of `final` for security

Dave Poirier

I love technology and everything related, from gadgets to new professional techniques. I like thinking, researching, optimizing, inventing and developing. I have a strong background in software research and development, operating systems, Voice-over-IP, network security, wired and wireless network engineering, complemented with electronic engineering background.

My career goal is to always keep learning, to be challenged, and to work remotely so I can be present for my family.

Bug hacker and master troubleshooter, my strength is understanding a problem and getting to the root of it. I'm mostly a self-taught individual and a constant learner. I push my technical boundaries daily and search for ways to improve my skills every day. With over 20 years of experience writing software in various languages, creating or optimizing algorithms, the digital development world is my turf.

Sample challenges which I particularly enjoyed:

Created a GLSL based magnification tool for a client who was turned down by three other companies as "impossible to do on macOS".
Optimized several SQL queries to reduce load time of a particular web page from several seconds to sub 50ms.
Identified the root cause of stuttering animations in iOS mobile app and implemented mitigation strategy

Specialties: Swift, Objective-C and PHP Software Development; TCP/IP and Wireless Network Engineering

I'm a passionate senior iOS & macOS developer with over 13 years in the Apple ecosystem and 25 years in the software industry. I have a special interest for data security and privacy compliance!

When creating a Swift class or actor, if you don't intend to override any of the functions in that class you should use the final keyword. Here's an example of why this is important:

Notice that the attacker did not even need to match the function name. Swift uses a dynamic lookup table for non-final classes to identify where the implementation of a function is located.

Since world() is the first function of the Hello class, and notSoFast() is the first function of the Hack class, when the hello instance type is changed to Hack and we call the world() function on it, underneath Swift will retrieve the first function implementation of the dynamic lookup table of the Hack class, and end up executing notSoFast() instead of world().

When you use final(), Swift will directly refer to the implementation of world() and skip the dynamic lookup table. Making your code safer from attackers.

Edit: As pointed out by several in the community, this "trick" is mostly prevented by Swift Whole Module optimization (-wmo or -whole-module-optimization). Provided your libraries and your application have the right build settings, the role of final keyword is mostly to prevent other developers from extending your classes.

I greatly appreciate the interest this generated in the community. And hopefully this allowed many of you to learn more about Swift dynamic lookup and class handling.

You can read more about Whole Module Optimization at https://www.swift.org/blog/whole-module-optimizations/

The importance of `final` for security

Comments

Mobile Security

Your Swift app is full of symbols, even if stripped.

More from this blog

A case for API-level cryptography

Claude Code, better in pair

Strategies for dealing with Swift actor data races

Massive View Controllers and SwiftUI

Safely distributing API keys in your mobile app

Command Palette

Comments

Mobile Security

Your Swift app is full of symbols, even if stripped.

More from this blog