Xcode is Apple Computer’s integrated development environment (IDE) for Mac OS X. The full Xcode package is free to ADC members and includes all the tools you need to create, debug, and optimize your own Universal applications, targeting both Intel and PowerPC platforms. At the heart of Xcode is a graphical workbench that tightly integrates a syntax-highlighting text editor, a robust build control system, a debugger, and the powerful GCC compiler capable of targeting both Intel and PowerPC regardless of host platform. Xcode is both easy to use, using assistants to create working projects in just minutes, and also powerful enough to build the largest Mac OS X applications. Xcode is bundled with Interface Builder, AppleScript Studio, Java development support, and WebObjects development tools, among many others.
What’s new:
Version 3.1 is an update release of the developer tools for Mac OS X, and is the same version included with the iPhone SDK. This release provides additional GCC and LLVM compiler options, general bug fixes, and must be installed on Leopard, Mac OS X 10.5.0 and higher. Xcode 3.1 defaults to upgrading Xcode 3.0, but may optionally be installed along side existing Xcode installations.
Version 3.1 addresses the following security problems:
Xcode tools contain an example application called Core Image Fun House that handles content with the “.funhouse” extension. A buffer overflow may occur in this application when processing “.funhouse” files. Opening a maliciously-crafted “.funhouse” file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. WebObjects contains an API to generate URLs in HTML documents via the WOHyperlink dynamic element. When WOHyperlink is used, it always appends a session ID to the generated URL, even for absolute URLs. Using WOHyperlink to create URLs that point at other web sites may result in the disclosure of the current user’s session ID to those sites. This update addresses the issue by appending session IDs to absolute URLs only when explicitly requested.
