fix: [SDK-5335] validate public API inputs to prevent native crashes

com.onesignal.unity.android/Runtime/AndroidDebugManager.cs

@@ -48,6 +48,8 @@ public LogLevel LogLevel
             get => _logLevel;
             set
             {
+                if (InputGuard.IsInvalidLogLevel(value, "setLogLevel"))
+                    return;
                 _logLevel = value;
                 _debug.Call("setLogLevel", ToLogLevel(value));
             }
@@ -58,6 +60,8 @@ public LogLevel AlertLevel
             get => _alertLevel;
             set
             {
+                if (InputGuard.IsInvalidLogLevel(value, "setAlertLevel"))
+                    return;
                 _alertLevel = value;
                 _debug.Call("setAlertLevel", ToLogLevel(value));
             }

com.onesignal.unity.android/Runtime/AndroidInAppMessagesManager.cs

@@ -27,6 +27,7 @@
 
 using System;
 using System.Collections.Generic;
+using OneSignalSDK;
 using OneSignalSDK.Android.Utilities;
 using OneSignalSDK.InAppMessages;
 using OneSignalSDK.InAppMessages.Internal;
@@ -56,16 +57,36 @@ public bool Paused
             set => _inAppMessages.Call("setPaused", value);
         }
 
-        public void AddTrigger(string key, string value) =>
+        public void AddTrigger(string key, string value)
+        {
+            if (
+                InputGuard.IsMissing(key, "addTrigger: key")
+                || InputGuard.IsNull(value, "addTrigger: value")
+            )
+                return;
             _inAppMessages.Call("addTrigger", key, value);
+        }
 
-        public void AddTriggers(Dictionary<string, string> triggers) =>
+        public void AddTriggers(Dictionary<string, string> triggers)
+        {
+            if (InputGuard.HasMissingEntries(triggers, "addTriggers", true))
+                return;
             _inAppMessages.Call("addTriggers", triggers.ToMap());
+        }
 
-        public void RemoveTrigger(string key) => _inAppMessages.Call("removeTrigger", key);
+        public void RemoveTrigger(string key)
+        {
+            if (InputGuard.IsMissing(key, "removeTrigger: key"))
+                return;
+            _inAppMessages.Call("removeTrigger", key);
+        }
 
-        public void RemoveTriggers(params string[] keys) =>
+        public void RemoveTriggers(params string[] keys)
+        {
+            if (InputGuard.IsMissingAny(keys, "removeTriggers: key"))
+                return;
             _inAppMessages.Call("removeTriggers", keys.ToArrayList());
+        }
 
         public void ClearTriggers() => _inAppMessages.Call("clearTriggers");
 

com.onesignal.unity.android/Runtime/AndroidSessionManager.cs

@@ -39,11 +39,28 @@ public AndroidSessionManager(AndroidJavaClass sdkClass)
             _session = sdkClass.CallStatic<AndroidJavaObject>("getSession");
         }
 
-        public void AddOutcome(string name) => _session.Call("addOutcome", name);
+        public void AddOutcome(string name)
+        {
+            if (InputGuard.IsMissing(name, "addOutcome: name"))
+                return;
+            _session.Call("addOutcome", name);
+        }
 
-        public void AddUniqueOutcome(string name) => _session.Call("addUniqueOutcome", name);
+        public void AddUniqueOutcome(string name)
+        {
+            if (InputGuard.IsMissing(name, "addUniqueOutcome: name"))
+                return;
+            _session.Call("addUniqueOutcome", name);
+        }
 
-        public void AddOutcomeWithValue(string name, float value) =>
+        public void AddOutcomeWithValue(string name, float value)
+        {
+            if (
+                InputGuard.IsMissing(name, "addOutcomeWithValue: name")
+                || InputGuard.IsNotFinite(value, "addOutcomeWithValue: value")
+            )
+                return;
             _session.Call("addOutcomeWithValue", name, value);
+        }
     }
 }

com.onesignal.unity.android/Runtime/AndroidUserManager.cs

@@ -27,6 +27,7 @@
 
 using System;
 using System.Collections.Generic;
+using OneSignalSDK;
 using OneSignalSDK.Android.User.Models;
 using OneSignalSDK.Android.Utilities;
 using OneSignalSDK.User;
@@ -73,7 +74,13 @@ public IPushSubscription PushSubscription
 
         public string Language
         {
-            set => _user.Call("setLanguage", value);
+            set
+            {
+                // Empty string is the reset to the device language. Null is not.
+                if (InputGuard.IsNull(value, "setLanguage: language"))
+                    return;
+                _user.Call("setLanguage", value);
+            }
         }
 
         public Dictionary<string, string> GetTags()
@@ -82,35 +89,102 @@ public Dictionary<string, string> GetTags()
             return obj.MapToDictionary();
         }
 
-        public void AddTag(string key, string value) => _user.Call("addTag", key, value);
+        public void AddTag(string key, string value)
+        {
+            if (
+                InputGuard.IsMissing(key, "addTag: key")
+                || InputGuard.IsNull(value, "addTag: value")
+            )
+                return;
+            _user.Call("addTag", key, value);
+        }
 
-        public void AddTags(Dictionary<string, string> tags) => _user.Call("addTags", tags.ToMap());
+        public void AddTags(Dictionary<string, string> tags)
+        {
+            if (InputGuard.HasMissingEntries(tags, "addTags", true))
+                return;
+            _user.Call("addTags", tags.ToMap());
+        }
 
-        public void RemoveTag(string key) => _user.Call("removeTag", key);
+        public void RemoveTag(string key)
+        {
+            if (InputGuard.IsMissing(key, "removeTag: key"))
+                return;
+            _user.Call("removeTag", key);
+        }
 
-        public void RemoveTags(params string[] keys) =>
+        public void RemoveTags(params string[] keys)
+        {
+            if (InputGuard.IsMissingAny(keys, "removeTags: key"))
+                return;
             _user.Call("removeTags", keys.ToArrayList());
+        }
 
-        public void AddAlias(string label, string id) => _user.Call("addAlias", label, id);
+        public void AddAlias(string label, string id)
+        {
+            if (
+                InputGuard.IsMissing(label, "addAlias: label")
+                || InputGuard.IsMissing(id, "addAlias: id")
+            )
+                return;
+            _user.Call("addAlias", label, id);
+        }
 
-        public void AddAliases(Dictionary<string, string> aliases) =>
+        public void AddAliases(Dictionary<string, string> aliases)
+        {
+            if (InputGuard.HasMissingEntries(aliases, "addAliases", false))
+                return;
             _user.Call("addAliases", aliases.ToMap());
+        }
 
-        public void RemoveAlias(string label) => _user.Call("removeAlias", label);
+        public void RemoveAlias(string label)
+        {
+            if (InputGuard.IsMissing(label, "removeAlias: label"))
+                return;
+            _user.Call("removeAlias", label);
+        }
 
-        public void RemoveAliases(params string[] labels) =>
+        public void RemoveAliases(params string[] labels)
+        {
+            if (InputGuard.IsMissingAny(labels, "removeAliases: label"))
+                return;
             _user.Call("removeAliases", labels.ToArrayList());
+        }
 
-        public void AddEmail(string email) => _user.Call("addEmail", email);
+        public void AddEmail(string email)
+        {
+            if (InputGuard.IsMissing(email, "addEmail: email"))
+                return;
+            _user.Call("addEmail", email);
+        }
 
-        public void RemoveEmail(string email) => _user.Call("removeEmail", email);
+        public void RemoveEmail(string email)
+        {
+            if (InputGuard.IsMissing(email, "removeEmail: email"))
+                return;
+            _user.Call("removeEmail", email);
+        }
 
-        public void AddSms(string sms) => _user.Call("addSms", sms);
+        public void AddSms(string sms)
+        {
+            if (InputGuard.IsMissing(sms, "addSms: sms"))
+                return;
+            _user.Call("addSms", sms);
+        }
 
-        public void RemoveSms(string sms) => _user.Call("removeSms", sms);
+        public void RemoveSms(string sms)
+        {
+            if (InputGuard.IsMissing(sms, "removeSms: sms"))
+                return;
+            _user.Call("removeSms", sms);
+        }
 
-        public void TrackEvent(string name, Dictionary<string, object> properties = null) =>
-            _user.Call("trackEvent", name, properties?.ToMap());
+        public void TrackEvent(string name, Dictionary<string, object> properties = null)
+        {
+            if (InputGuard.IsMissing(name, "trackEvent: name"))
+                return;
+            _user.Call("trackEvent", name, InputGuard.ReplaceNonFiniteNumbers(properties)?.ToMap());
+        }
 
         public void Initialize()
         {

com.onesignal.unity.android/Runtime/OneSignalAndroid.cs

@@ -130,6 +130,8 @@ public override bool ConsentRequired
 
         public override void Initialize(string appId)
         {
+            if (InputGuard.IsMissing(appId, "initialize: appId"))
+                return;
             var unityPlayer = new AndroidJavaClass("com.unity3d.player.UnityPlayer");
             var activity = unityPlayer.GetStatic<AndroidJavaObject>("currentActivity");
 
@@ -199,6 +201,8 @@ private static void _enableHardwareAcceleration(AndroidJavaObject activity)
 
         public override void Login(string externalId, string jwtBearerToken = null)
         {
+            if (InputGuard.IsMissing(externalId, "login: externalId"))
+                return;
             _sdkClass.CallStatic("login", externalId, jwtBearerToken);
         }
 

com.onesignal.unity.core/Runtime/InputGuard.cs

@@ -0,0 +1,108 @@
+using System;
+using System.Collections.Generic;
+using OneSignalSDK.Debug.Models;
+using OneSignalSDK.Debug.Utilities;
+
+namespace OneSignalSDK
+{
+    internal static class InputGuard
+    {
+        public static bool IsMissing(string value, string api)
+        {
+            if (!string.IsNullOrEmpty(value))
+                return false;
+            SDKDebug.Error(api + " is required");
+            return true;
+        }
+
+        public static bool IsMissingAny(string[] values, string api)
+        {
+            if (values == null)
+                return IsMissing(null, api);
+            foreach (var value in values)
+            {
+                if (IsMissing(value, api))
+                    return true;
+            }
+            return false;
+        }
+
+        public static bool IsNull(object value, string api)
+        {
+            if (value != null)
+                return false;
+            SDKDebug.Error(api + " is required");
+            return true;
+        }
+
+        public static bool IsNotFinite(float value, string api)
+        {
+            if (!float.IsNaN(value) && !float.IsInfinity(value))
+                return false;
+            SDKDebug.Error(api + " must be a finite number");
+            return true;
+        }
+
+        public static bool IsInvalidLogLevel(LogLevel value, string api)
+        {
+            if (Enum.IsDefined(typeof(LogLevel), value))
+                return false;
+            SDKDebug.Error(api + " is not a valid log level");
+            return true;
+        }
+
+        // Native JSON serializers reject NaN and Infinity (Android throws, iOS drops the payload).
+        public static Dictionary<string, object> ReplaceNonFiniteNumbers(
+            IDictionary<string, object> values
+        )
+        {
+            if (values == null)
+                return null;
+            var result = new Dictionary<string, object>(values.Count);
+            foreach (var pair in values)
+                result[pair.Key] = ReplaceNonFiniteNumber(pair.Value);
+            return result;
+        }
+
+        private static object ReplaceNonFiniteNumber(object value)
+        {
+            switch (value)
+            {
+                case double d when double.IsNaN(d) || double.IsInfinity(d):
+                case float f when float.IsNaN(f) || float.IsInfinity(f):
+                    return null;
+                case IDictionary<string, object> dict:
+                    return ReplaceNonFiniteNumbers(dict);
+                case IList<object> list:
+                    var items = new List<object>(list.Count);
+                    foreach (var item in list)
+                        items.Add(ReplaceNonFiniteNumber(item));
+                    return items;
+                default:
+                    return value;
+            }
+        }
+
+        public static bool HasMissingEntries(
+            IDictionary<string, string> values,
+            string api,
+            bool allowEmptyValue
+        )
+        {
+            if (values == null)
+                return IsNull(values, api);
+            foreach (var pair in values)
+            {
+                if (IsMissing(pair.Key, api + ": key"))
+                    return true;
+                if (
+                    allowEmptyValue
+                        ? IsNull(pair.Value, api + ": value")
+                        : IsMissing(pair.Value, api + ": value")
+                )
+                    return true;
+            }
+            return false;
+        }
+    }
+}

com.onesignal.unity.ios/Runtime/OneSignaliOS.cs

@@ -143,6 +143,8 @@ public override bool ConsentRequired
 
         public override void Initialize(string appId)
         {
+            if (InputGuard.IsMissing(appId, "initialize: appId"))
+                return;
             _oneSignalInitialize(appId);
 
             if (_inAppMessages == null)
@@ -183,7 +185,9 @@ public override void Initialize(string appId)
 
         public override void Login(string externalId, string jwtBearerToken = null)
         {
-            if (jwtBearerToken == null)
+            if (InputGuard.IsMissing(externalId, "login: externalId"))
+                return;
+            if (string.IsNullOrWhiteSpace(jwtBearerToken))
             {
                 _oneSignalLogin(externalId);
             }