[iOS] `NSAppTransportSecurity` in Info.plist keeps getting overwritten during `pod install`

[robertying]

Description

When running pod install with RN 0.73, the existing content under the key NSAppTransportSecurity in Info.plist will always be completely overwritten with:

	<key>NSAppTransportSecurity</key>
	<dict>
		<key>NSAllowsArbitraryLoads</key>
		<false/>
		<key>NSAllowsLocalNetworking</key>
		<true/>
   </dict>

deleting existing values under the same key.

Steps to reproduce

1. Init an RN project and run pod install as required

2. Modify Info.plist in the ios directory so that the key NSAppTransportSecurity is updated with the following values:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>NSAppTransportSecurity</key>
	<dict>
		<key>NSExceptionDomains</key>
		<dict>
			<key>www.example.com</key>
			<dict>
				<key>NSExceptionAllowsInsecureHTTPLoads</key>
				<true/>
			</dict>
		</dict>
	</dict>
</dict>
</plist>

3. Run pod install again.

4. Check that NSExceptionDomains is gone under NSAppTransportSecurity.

React Native Version

0.73.0

Affected Platforms

Build - MacOS

Output of npx react-native info

System:
  OS: macOS 14.1.2
  CPU: (10) arm64 Apple M1 Pro
  Memory: 293.06 MB / 16.00 GB
  Shell:
    version: "5.9"
    path: /bin/zsh
Binaries:
  Node:
    version: 21.4.0
    path: ~/.nvm/versions/node/v21.4.0/bin/node
  Yarn:
    version: 1.22.19
    path: ~/.nvm/versions/node/v21.4.0/bin/yarn
  npm:
    version: 10.2.5
    path: ~/.nvm/versions/node/v21.4.0/bin/npm
  Watchman:
    version: 2023.12.04.00
    path: /opt/homebrew/bin/watchman
Managers:
  CocoaPods:
    version: 1.14.3
    path: /opt/homebrew/bin/pod
SDKs:
  iOS SDK:
    Platforms:
      - DriverKit 23.0
      - iOS 17.0
      - macOS 14.0
      - tvOS 17.0
      - watchOS 10.0
  Android SDK: Not Found
IDEs:
  Android Studio: 2023.1 AI-231.9392.1.2311.11076708
  Xcode:
    version: 15.0.1/15A507
    path: /usr/bin/xcodebuild
Languages:
  Java:
    version: 17.0.9
    path: /opt/homebrew/Cellar/openjdk@17/17.0.9/libexec/openjdk.jdk/Contents/Home/bin/javac
  Ruby:
    version: 2.6.10
    path: /usr/bin/ruby
npmPackages:
  "@react-native-community/cli": Not Found
  react:
    installed: 18.2.0
    wanted: 18.2.0
  react-native:
    installed: 0.73.0
    wanted: 0.73.0
  react-native-macos: Not Found
npmGlobalPackages:
  "*react-native*": Not Found
Android:
  hermesEnabled: true
  newArchEnabled: false
iOS:
  hermesEnabled: true
  newArchEnabled: false

Stacktrace or Logs

N/A

Reproducer

https://github.com/robertying/ats-overwrite-repro

Screenshots and Videos

No response

[titidutarn]

still a bug for me in 0.73.1

[BrianCodeItUp]

This bug still exist in 0.73.2, can we reopen this issue?

[robertying]

@BrianCodeItUp is your issue related to NSAppTransportSecurity? I tested on different scenarios the fix should work at least for NSAppTransportSecurity being overridden.

If you can reproduce a similar issue with 0.73.2, I would recommend opening a new issue to track it.

[BrianCodeItUp]

@robertying I created new project which running react native 0.73.2, here is the result after pod install

Currently I patch the following code to prevent NSAppTransportSecurity got overwritten

diff --git a/node_modules/react-native/scripts/cocoapods/utils.rb b/node_modules/react-native/scripts/cocoapods/utils.rb
index 54ea36c..4c8d9a2 100644
--- a/node_modules/react-native/scripts/cocoapods/utils.rb
+++ b/node_modules/react-native/scripts/cocoapods/utils.rb
@@ -548,23 +548,7 @@ class ReactNativePodsUtils
       end
 
     def self.update_ats_in_plist(plistPaths, parent)
-        plistPaths.each do |plistPath|
-            fullPlistPath = File.join(parent, plistPath.path)
-            plist = Xcodeproj::Plist.read_from_path(fullPlistPath)
-            ats_configs = {
-                "NSAllowsArbitraryLoads" => false,
-                "NSAllowsLocalNetworking" => true,
-            }
-            if plist.nil?
-                plist = {
-                    "NSAppTransportSecurity" => ats_configs
-                }
-            else
-                plist["NSAppTransportSecurity"] ||= {}
-                plist["NSAppTransportSecurity"] = plist["NSAppTransportSecurity"].merge(ats_configs)
-            end
-            Xcodeproj::Plist.write_to_path(plist, fullPlistPath)
-        end
+        # do nothing to ats config (NSAppTransportSecurity in info.plsit)
     end
 
     def self.apply_ats_config(installer)

[robertying]

@BrianCodeItUp I think this change was intended as a "feature", i.e. making sure local debugging still works while blocking unsecured connections. See #38086.

So you may want to create a separate issue to give feedback on this forced change.