fix(security): 3-layer defense closes all MitM crash paths on tokeniz…

AcceptSDKSampleApp/ViewController.swift

@@ -168,23 +168,78 @@ class ViewController: UIViewController, UITextFieldDelegate {
 
         handler!.getTokenWithRequest(request, successHandler: { (inResponse:AcceptSDKTokenResponse) -> () in
             DispatchQueue.main.async(execute: {
+                // SECURITY (AISAST-c0e043bb): App-owned defensive parsing. The
+                // SDK's response model uses implicitly-unwrapped-optionals (IUOs)
+                // for server-controlled fields — invoking the getters on a
+                // MitM-injected response that omits 'opaqueData',
+                // 'messages.message', etc. would trap. This block lives in
+                // APP-OWNED code (not Pods/), so it survives `pod install` and
+                // shields the host app even if the SDK regenerates from upstream.
                 self.updateTokenButton(true)
-
                 self.activityIndicatorAcceptSDKDemo.stopAnimating()
-                print("Token--->%@", inResponse.getOpaqueData().getDataValue())
-                var output = String(format: "Response: %@\nData Value: %@ \nDescription: %@", inResponse.getMessages().getResultCode(), inResponse.getOpaqueData().getDataValue(), inResponse.getOpaqueData().getDataDescriptor())
-                output = output + String(format: "\nMessage Code: %@\nMessage Text: %@", inResponse.getMessages().getMessages()[0].getCode(), inResponse.getMessages().getMessages()[0].getText())
+
+                let messages = inResponse.getMessages()
+                let resultCode = messages?.getResultCode()
+                let opaqueData = inResponse.getOpaqueData()
+                let dataValue = opaqueData?.getDataValue()
+                let dataDescriptor = opaqueData?.getDataDescriptor()
+                let messageArr = messages?.getMessages() ?? []
+                let firstMsg: Message? = messageArr.first
+                let messageCode = firstMsg?.getCode()
+                let messageText = firstMsg?.getText()
+
+                guard let _ = resultCode,
+                      let _ = opaqueData,
+                      let _ = dataValue,
+                      let _ = dataDescriptor else {
+                    // MitM or malformed response — refuse to render token output.
+                    // SECURITY: Do not log the opaque payment token; even on
+                    // failure, avoid echoing partial server data to logs.
+                    print("Tokenization success: malformed payload (missing opaqueData/resultCode)")
+                    self.textViewShowResults.text = "Response received but payload was malformed (missing opaqueData). Tokenization aborted."
+                    self.textViewShowResults.textColor = UIColor.red
+                    return
+                }
+
+                // SECURITY: Do not log the opaque payment token — it is a
+                // single-use payment nonce that can be used to charge the
+                // customer's card.
+                print("Tokenization success: resultCode=\(resultCode ?? "<nil>")")
+                var output = String(format: "Response: %@\nData Value: %@ \nDescription: %@",
+                    resultCode ?? "<nil>",
+                    dataValue ?? "<nil>",
+                    dataDescriptor ?? "<nil>")
+                output = output + String(format: "\nMessage Code: %@\nMessage Text: %@",
+                    messageCode ?? "<no message array>",
+                    messageText ?? "<no message array>")
                 self.textViewShowResults.text = output
                 self.textViewShowResults.textColor = UIColor.green
             })
         }) { (inError:AcceptSDKErrorResponse) -> () in
+            // SECURITY (AISAST-c0e043bb): App-owned defensive parsing for
+            // failure path. The SDK's failure response can carry an empty
+            // messages array under MitM preconditions; indexing [0] on an
+            // empty array raises a Swift runtime trap. Bounds-check before
+            // subscript.
             self.activityIndicatorAcceptSDKDemo.stopAnimating()
             self.updateTokenButton(true)
 
-            let output = String(format: "Response:  %@\nError code: %@\nError text:   %@", inError.getMessages().getResultCode(), inError.getMessages().getMessages()[0].getCode(), inError.getMessages().getMessages()[0].getText())
+            let messagesObj = inError.getMessages()
+            let messageArr = messagesObj?.getMessages() ?? []
+            let resultCode = messagesObj?.getResultCode()
+            let firstMsg: Message? = messageArr.first
+            let errorCode = firstMsg?.getCode()
+            let errorText = firstMsg?.getText()
+
+            // SECURITY: Do not log raw server error text — error messages may
+            // contain sensitive context. Log only the structured error code.
+            print("Tokenization failed: errorCode=\(errorCode ?? "<malformed>")")
+            let output = String(format: "Response:  %@\nError code: %@\nError text:   %@",
+                resultCode ?? "<nil>",
+                errorCode ?? "<no error array — possible MitM>",
+                errorText ?? "<no error array — possible MitM>")
             self.textViewShowResults.text = output
             self.textViewShowResults.textColor = UIColor.red
-            print(output)
         }
     }