Crash - handleUrl passes nil NSURL force-bridged to non-optional Swift URL (iOS < 17 only)

[glc-helmbarki]

Affected versions

Confirmed present from 5.1.3 up to and including the latest 6.4.0 (source unchanged).

Environment

• @contentsquare/react-native-bridge: 5.1.3 (repro), verified 6.4.0
• iOS: < 17 (reproduced on iOS 16.7.x, iPhone 8 / iPhone X)
• Not reproducible on iOS 17+ (lenient RFC 3986 parser auto-encodes)

Description

ContentsquareBridgeModule.mm passes a possibly-nil NSURL to a non-optional Swift signature func handle(url: URL), which crashes.

RCT_EXPORT_METHOD(handleUrl:(NSString *)urlString) {
    if (!urlString) { return; }                       // only guards nil STRING
    NSURL* url = [NSURL URLWithString:urlString];      // returns nil on iOS < 17 for unescaped chars
    [contentsquareSDKInterfaceWrapper handleWithUrl:url]; // nil -> crash
}
On iOS < 17, [NSURL URLWithString:] returns nil when the string contains unescaped characters (accents é/è/à/î, space, < > { } | \ ^ \ "). That nil is force-bridged to the non-optional Swift URL`:

Stack trace

EXC_BREAKPOINT (SIGTRAP)
URL._unconditionallyBridgeFromObjectiveC   (Foundation)
-[ContentsquareBridgeModule handleUrl:]
facebook::react::ObjCTurboModule::performVoidMethodInvocation
Reproduction
Call from JS with a raw (non-OS-routed) URL — e.g. a Braze push ab_uri / deferred deeplink / content card:


Contentsquare.handleUrl('https://example.com/listing?ville=Nîmes'); // literal î
On iOS 16 → nil NSURL → crash. (OS-routed universal links are pre-encoded and don't trigger it.)

Root cause
func handle(url: URL) (both CSQInterfaceCSInApp and ContentsquareSDKInterfaceLegacy) is non-optional; a nil NSURL triggers URL._unconditionallyBridgeFromObjectiveC(nil) → trap.

Suggested fix (either)
Guard in the bridge:

NSURL* url = [NSURL URLWithString:urlString];
if (!url) { return; }
[contentsquareSDKInterfaceWrapper handleWithUrl:url];
Or make the Swift signature optional: func handle(url: URL?).
Or use -[NSURL URLWithString:encodingInvalidCharacters:] on iOS 17+ and percent-encode as a fallback.