Usage of NSClassFromString in IMA iOS SDK

[Weili Liu]

Hi,

Our security scan flagged the Google IMA iOS SDK (version 3.23.0) due to the presence of NSClassFromString calls in the binary.

Since NSClassFromString is inherently insecure, can you reimplement the functionality in a safe manner? In the meantime, can you explain how is this method being currently used and if you have additional mitigations in place to alleviate security risks

We need this information to address concerns raised during our security review.

Thanks

[IMA SDK]

Hi,

We are checking your issue and will get back to you shortly. Meanwhile, your patience is important.

Thanks,
 

IMA SDK Team

Feedback
How was our support today?

               
[2025-08-14 19:57:30Z GMT] This message is in relation to case "ref:!00D1U01174p.!500Ht01sz6Ch:ref" (ADR-00329953)

[IMA SDK]

Hi,

Thank you for contacting the IMA SDK Support team.

It is always recommended to use the latest version of the SDK. As of today the latest version of the SDK is 3.26.1. Could you please verify if the aforementioned issue can be replicated in our most recent version?

Could you please provide screenshots of the error encountered while scanning the application and specify which tool is being used for further investigation?

Thanks,
 

IMA SDK Team

Feedback
How was our support today?

               

[2025-08-18 19:24:17Z GMT] This message is in relation to case "ref:!00D1U01174p.!500Ht01sz6Ch:ref" (ADR-00329953)

[Weili Liu]

Hi, I've inspected the 3.26.1 SDK version and it exhibited the same behavior. I'll get back to you on the screenshots.

[Weili Liu]

Hi IMA Team,

I've attached the screenshot of the security scan. Please let us know what the next steps are. 

Thanks

[IMA SDK]

Hi,

I will check with the team and get back to you shortly.

Thanks,
 

IMA SDK Team

Feedback
How was our support today?

               

[2025-08-26 13:45:43Z GMT] This message is in relation to case "ref:!00D1U01174p.!500Ht01sz6Ch:ref" (ADR-00329953)

[Weili Liu]

Hi, is there an update to this?

[IMA SDK]

Hi,

Kindly apologies for the delay.

I've raised this concern to the wider team and will get back to you once I receive any updates on it. Meanwhile, your patience is highly appreciated.

Thanks,
 

IMA SDK Team

Feedback
How was our support today?

               

[2025-10-29 11:25:57Z GMT] This message is in relation to case "ref:!00D1U01174p.!500Ht01sz6Ch:ref" (ADR-00329953)