Exclude unsafe ivars from evaluation

Classes/Utility/Runtime/FLEXIvar.m

@@ -9,6 +9,7 @@
 
 #import "FLEXIvar.h"
 #import "FLEXRuntimeUtility.h"
+#import "FLEXRuntimeSafety.h"
 
 @interface FLEXIvar () {
     NSString *_flex_description;
@@ -82,6 +83,10 @@
 
 - (id)getValue:(id)target {
     id value = nil;
+    if (!FLEXIvarIsSafe(_objc_ivar)) {
+        return nil;
+    }
+
 #ifdef __arm64__
     // See http://www.sealiesoftware.com/blog/archive/2013/09/24/objc_explain_Non-pointer_isa.html
     if (self.type == FLEXTypeEncodingObjcClass && [self.name isEqualToString:@"isa"]) {

Classes/Utility/Runtime/FLEXRuntimeSafety.h

@@ -6,7 +6,9 @@
 //
 
 #import <Foundation/Foundation.h>
+#import <objc/runtime.h>
 
+#pragma mark - Classes
 
 extern NSUInteger const kFLEXKnownUnsafeClassCount;
 extern const Class * FLEXKnownUnsafeClassList();
@@ -16,7 +18,7 @@ extern CFSetRef FLEXKnownUnsafeClasses;
 static inline BOOL FLEXClassIsSafe(Class cls) {
     if (!cls) return NO;
 
-    return CFSetContainsValue(FLEXKnownUnsafeClasses, (__bridge void *)cls);
+    return !CFSetContainsValue(FLEXKnownUnsafeClasses, (__bridge void *)cls);
 }
 
 static inline BOOL FLEXClassNameIsSafe(NSString *cls) {
@@ -25,3 +27,13 @@ static inline BOOL FLEXClassNameIsSafe(NSString *cls) {
     NSSet *ignored = FLEXKnownUnsafeClassNames();
     return ![ignored containsObject:cls];
 }
+
+#pragma mark - Ivars
+
+extern CFSetRef FLEXKnownUnsafeIvars;
+
+static inline BOOL FLEXIvarIsSafe(Ivar ivar) {
+    if (!ivar) return NO;
+
+    return !CFSetContainsValue(FLEXKnownUnsafeIvars, ivar);
+}

Classes/Utility/Runtime/FLEXRuntimeSafety.m

@@ -10,10 +10,14 @@
 NSUInteger const kFLEXKnownUnsafeClassCount = 19;
 Class * _UnsafeClasses = NULL;
 CFSetRef FLEXKnownUnsafeClasses = nil;
+CFSetRef FLEXKnownUnsafeIvars = nil;
 
 #define FLEXClassPointerOrCFNull(name) \
     (NSClassFromString(name) ?: (__bridge id)kCFNull)
 
+#define FLEXIvarOrCFNull(cls, name) \
+    (class_getInstanceVariable([cls class], name) ?: (void *)kCFNull)
+
 __attribute__((constructor))
 void FLEXRuntimeSafteyInit() {
     FLEXKnownUnsafeClasses = CFSetCreate(
@@ -22,6 +26,17 @@ void FLEXRuntimeSafteyInit() {
         kFLEXKnownUnsafeClassCount,
         nil
     );
+
+    Ivar unsafeIvars[] = {
+        FLEXIvarOrCFNull(NSURL, "_urlString"),
+        FLEXIvarOrCFNull(NSURL, "_baseURL"),
+    };
+    FLEXKnownUnsafeIvars = CFSetCreate(
+        kCFAllocatorDefault,
+        (const void **)unsafeIvars,
+        sizeof(unsafeIvars),
+        nil
+    );
 }
 
 const Class * FLEXKnownUnsafeClassList() {