[Closed] Security validation NullReferenceException

Unity Services
1

Greetings,

Just wanted to post this to let the Unity IAP devs know about it.

We wanted to try and use the obfucation/validation stuff provided by Unity Purchasing. I did all the steps to set it up, got the Google Play Id, generated the Google/Apple Tangle data classes, as well as the implementation in ProcessPurchase callback. Here’s the try and catch portion:

try
{
    #if (UNITY_ANDROID || UNITY_IOS) && !UNITY_EDITOR
    {
        var GoogleData = GooglePlayTangle.Data();
        var AppleData = AppleTangle.Data();
        var validator = new CrossPlatformValidator(GoogleData, AppleData, Application.bundleIdentifier);
        var result = validator.Validate(args.purchasedProduct.receipt);

        Log("Reciept Is Valid");
        foreach (IPurchaseReceipt reciept in result)
        {
            Log("ProductId: " + reciept.productID);
        }
        PurchaseSucceededCallback(ToGameProduct(args.purchasedProduct)); // NOTE ("Justin"): At This Point No Security Exceptions were thrown from the validator
    }
    #else
    {
        PurchaseSucceededCallback(ToGameProduct(args.purchasedProduct));
    }
    #endif
}
catch (Exception e)
{
    var SecurityException = e as IAPSecurityException;
    if (SecurityException != null)
    {
        if (SecurityBreachCallback != null)
        {
            SecurityBreachCallback(SecurityException, args.purchasedProduct);
        }
        else
        {
            Log("Security exception: " + SecurityException.ToString());
        }
    }
    else
    {
        Log("PurchaseProcessingResult Caught generic exception: " + e.ToString());
    }
}

Running that on Android, I get:

PurchaseProcessingResult Caught generic exception: System.NullReferenceException: Object reference not set  to an instance of an object
01-19 14:00:16.249 25580 25614 I Unity  :  at Mono.Security.Cryptography.PKCS1
.Encode_v15 (System.Security.Cryptography.HashAlgorithm hash, System.Byte[] hash
Value, Int32 emLength) [0x00000] in <filename unknown>:0
01-19 14:00:16.249 25580 25614 I Unity  :  at Mono.Security.Cryptography.PKCS1
.Verify_v15 (System.Security.Cryptography.RSA rsa, System.Security.Cryptography.
HashAlgorithm hash, System.Byte[] hashValue, System.Byte[] signature, Boolean tr
yNonStandardEncoding) [0x00000] in <filename unknown>:0
01-19 14:00:16.249 25580 25614 I Unity  :  at Mono.Security.Cryptography.PKCS1
.Verify_v15 (System.Security.Cryptography.RSA rsa, System.Security.Cryptography.
HashAlgorithm hash, System.Byte[] hashValue, System.Byte[] signature) [0x00000]
in <filename unknown>:0
01-19 14:00:16.249 25580 25614 I Unity  :  at System.Security.Cryptography.RSA
CryptoServiceProvider.VerifyHash (System.Byte[] rgbHash, System.String str, Syst
em.Byte[] rgbSignature) [0x00000] in <filename unknown>:0
01-19 14:00:16.249 25580 25614 I Unity  :  at UnityEngine.Purchasing.Security.
RSAKey.Verify
01-19 14:00:19.089  3449  3522 D ActivityManager: mDVFSHelper.release()
01-19 14:00:39.899  3449  3518 I ActivityManager: Start proc 27126:com.google.an
droid.gm/u0a108 for service com.google.android.gm/.provider.GmailPop3SyncAdapter

Note that we’re updated to the latest Unity IAP version.

The demo script catches only IAPSecurityException while there’s many other types of exceptions that could be thrown just from those two validation lines, that’s why I catch Exception e and cast it. IMO the Demo script should be updated to reflect that, it’s just way too shaky to just catch one type of exception.

2 Likes
2

Thanks for the report and for your patience @vexe - yeah for certain configurations (tangled certificate data) we have seen other exceptions too. I am thinking the code ought to only throw IAPSecurityException too.

I’ll look into making that happen now, updating the security code and the Demo script.