Thanks for your quick answer.
The sourceAppAuditToken may be available directly on the NEFilterFlow object delivered in handleNewFlow. Yes, sourceAppAuditToken was suggested by Xcode's autocompletion feature. But, I'm unsure to extract the sourceAppIdentifier from it.
After searching through forums, I found following solution proposed by Quinn “The Eskimo!” - https://developer.apple.com/forums/profile/eskimo in this - https://developer.apple.com/forums/thread/128423 thread.
> func bundleIDForAuditToken(_ tokenData: Data) -> String? {
		/* Get a code reference. */
		var codeQ: SecCode? = nil
		var err = SecCodeCopyGuestWithAttributes(nil, [
				kSecGuestAttributeAudit: tokenData
		] as NSDictionary, [], &codeQ)
		guard err == errSecSuccess else {
				return nil
		}
		let code = codeQ!
		/* Convert that to a static code. */
		var staticCodeQ: SecStaticCode? = nil
		err = SecCodeCopyStaticCode(code, [], &staticCodeQ)
		guard err == errSecSuccess else {
				return nil
		}
		let staticCode = staticCodeQ!
		/* Get code signing information about that. */
		var infoQ: CFDictionary? = nil
		err = SecCodeCopySigningInformation(staticCode, [], &infoQ)
		guard err == errSecSuccess else {
				return nil
		}
		let info = infoQ! as! [String:Any]
		/* Extract the bundle ID from that. */
		guard
				let plist = info[kSecCodeInfoPList as String] as? [String:Any],
				let bundleID = plist[kCFBundleIdentifierKey as String] as? String
		else {
				return nil
		}
		return bundleID
}
However, when I tried, this function always returns nil.
It may also be worthwhile just taking a look at the the complete flow description to see what is all provided there when flows are delivered to your app. On your suggestion, I inspected flow.description and yes it contains valuable information. Here's an example for sake of completion:
"\n				identifier = CC71CAFA-781B-4402-970F-AB184EA5C14C\n				hostname = apidata.googleusercontent.com\n				sourceAppIdentifier = .com.apple.CalendarAgent\n				sourceAppVersion = \n				sourceAppUniqueIdentifier = 20:{length = 20, bytes = 0x618db8164f86a2db52185dd834f237c73551ca22}\n				procPID = 408\n				eprocPID = 408\n				direction = outbound\n				inBytes = 0\n				outBytes = 0\n				signature = 32:{length = 32, bytes = 0xb4f38a2e 3d2b14c3 24f807b6 06574c54 ... bbf1ebdb 08949f61 }\n				remoteEndpoint = 172.217.166.193:443\n				protocol = 6\n				family = 2\n				type = 1\n				procUUID = 1693DF56-EE62-3156-9B2D-23D06CF5A7A7\n				eprocUUID = 1693DF56-EE62-3156-9B2D-23D06CF5A7A7"
I've implemented following hacky solution to extract the sourceAppIdentifier from this string and returning early from non-browser app flows:
class FilterDataProvider: NEFilterDataProvider {
static let filteredApps: Set = [".com.apple.Safari", ".com.google.Chrome", ".org.mozilla.firefox"]
override func startFilter(completionHandler: @escaping (Error?) -> Void) {
/* Same as above */
}
func isFiltered(description: String) -> Bool {
guard let sourceAppIdentifier = description.matches(for: #"(?<=sourceAppIdentifier = ).+?(?=\s)"#).first else {
return false
}
return FilterDataProvider.filteredApps.contains(sourceAppIdentifier)
}
override func handleNewFlow(_ flow: NEFilterFlow) -> NEFilterNewFlowVerdict {
guard let url = flow.url?.absoluteURL,
isFiltered(description: flow.description) else {
return .allow()
}
/* .drop() if url found in local DB */
return .allow()
}
}
extension String {
func matches(for regex: String) -> [String] {
do {
let regex = try NSRegularExpression(pattern: regex)
let results = regex.matches(in: self, range: NSRange(self.startIndex..., in: self))
return results.map {
String(self[Range($0.range, in: self)!])
}
} catch {
return []
}
}
}
Is there an alternative to Quinn's solution or any better way to do this?
rmalviya
Users receive reputation points by contributing quality content to the forums.
Posts include post and replies published on the forums.
Post authors can mark replies as Accepted to indicate successful solutions.
Apple Developer Forums admins can mark replies as Apple Recommended to indicate an approved solution
Post
Replies
Boosts
Views
Activity
While testing, I also noticed that flow from browsers other than Safari does not provide url and hence is of no use. In handleNewFlow the flow.url is nil for Chrome and Firefox.
Documentation - https://developer.apple.com/documentation/networkextension/nefilterflow/1618935-url describes this:
This parameter is only non-nil for flows that originate from WebKit browser objects. Any possible solution for getting url on flows from non-WebKit browsers?