Split out of the #3 review so it is not a contributor's problem.
DocuSignManager.presentCaptiveSigningWithUrl (ios/DocuSignManager.swift:680) passes signingUrl straight to DSMEnvelopesManager.presentCaptiveSigning with no validation. CaptiveSigningUrlRecord.signingUrl defaults to "" when JS omits it, so a blank or malformed URL reaches the SDK and the promise settles only if the presented controller happens to call back.
The Android side is getting a blank / non-https guard in #3. iOS should match, and the guard should live next to the existing isInitialized check so it throws before pendingCompletion is claimed.
Split out of the #3 review so it is not a contributor's problem.
DocuSignManager.presentCaptiveSigningWithUrl(ios/DocuSignManager.swift:680) passessigningUrlstraight toDSMEnvelopesManager.presentCaptiveSigningwith no validation.CaptiveSigningUrlRecord.signingUrldefaults to""when JS omits it, so a blank or malformed URL reaches the SDK and the promise settles only if the presented controller happens to call back.The Android side is getting a blank / non-https guard in #3. iOS should match, and the guard should live next to the existing
isInitializedcheck so it throws beforependingCompletionis claimed.