Checkmarx One – Scan Summary & Details – 143fb0f4-710f-4ae7-89b6-36e73171bee0

Great job! No new security vulnerabilities introduced in this pull request

Claude finished @KatherineInCode's task —— View job

Code Review Complete

I've thoroughly reviewed PR #2072 which consolidates UIViewController extensions into BitwardenKit. Here are my findings:

Summary of Changes

This PR successfully consolidates UIViewController extensions by:

1. Moving UIViewController.swift and UIViewControllerTests.swift from BitwardenShared to BitwardenKit
2. Deleting the duplicate UIViewController.swift and UIViewControllerTests.swift from AuthenticatorShared
3. Removing a duplicate present(_:animated:overFullscreen:onCompletion:) implementation from StackNavigator in AuthenticatorShared

The consolidation is valid because both BitwardenShared and AuthenticatorShared already import BitwardenKit, ensuring continued access to these extensions.

Critical Issues

⚠️ Issue 1: Inconsistent Implementation Removed from StackNavigator

Location: AuthenticatorShared/UI/Platform/Application/Utilities/StackNavigator.swift

The PR removes a present() method implementation from StackNavigator that was less robust than the version now available from BitwardenKit. The removed implementation was missing:

1. Missing isBeingDismissed check: The while loop didn't check if a view controller is being dismissed:

   // Removed (incomplete):
   while presentedChild != nil {
   
   // BitwardenKit version (correct):
   while presentedChild != nil, presentedChild?.isBeingDismissed == false {

2. Missing popover configuration: The removed implementation lacked iPad popover crash prevention that exists in the BitwardenKit version (lines 27-38 of the moved file).

Assessment: ✅ This is actually a positive change - by removing the incomplete duplicate and relying on the BitwardenKit extension, AuthenticatorShared now gets the more robust implementation with proper dismissal handling and iPad popover support.

Suggested Improvements

📝 Improvement 1: Consider Adding Public Access Control Consistency

Location: BitwardenKit/UI/Platform/Application/Extensions/UIViewController.swift:12

The extension is declared as public extension UIViewController (line 3), but the present() method is not explicitly marked as public (line 12), while the comment still says "public func" from the original.

Current:

public extension UIViewController {
    /// ...
    func present(

Consideration: The method inherits public access from the extension, so this works correctly. However, for clarity and consistency with Swift conventions, you might consider either:

• Keeping it as-is (implicit public from extension) ✅ Recommended
• Or explicitly marking it public func present( for clarity

Note: As noted in the review comment thread, PR #2066 is modifying this same file and should be merged first to avoid conflicts.

Good Practices Observed

• ✅ Proper consolidation eliminates code duplication
• ✅ Tests were moved along with implementation
• ✅ Dependency structure supports the move (both modules import BitwardenKit)
• ✅ More robust implementation (with isBeingDismissed and popover handling) is now shared
• ✅ Clean removal of inferior duplicate implementation

Action Items

1. ✅ Already addressed: Wait for PR [PM-27219] Fix update and set master password errors #2066 to merge first to avoid conflicts (per review discussion)
2. ⏸️ Optional: Consider whether explicit public keyword on the present() method would improve code clarity (low priority, current approach is valid)

Verdict

This is a clean refactoring PR that successfully consolidates duplicate code into a shared location. The consolidation actually improves code quality by ensuring all consumers use the more robust implementation with proper dismissal handling and iPad popover support. No blocking issues identified.

The PR is ready to merge after PR #2066 is merged first (as agreed in the review comments).