What is NSSecureCoding, what attack does it prevent, and how do you unarchive data from an untrusted source?

Predict first

Does a secure unarchive run the attacker’s initialiser?

import Foundation

class Evil: NSObject, NSCoding {
    override init() { super.init() }
    required init?(coder: NSCoder) { print("Evil.init(coder:) ran"); super.init() }
    func encode(with coder: NSCoder) {}
}
class Note: NSObject, NSSecureCoding {
    static var supportsSecureCoding = true
    var text: String
    init(_ t: String) { text = t }
    required init?(coder: NSCoder) { text = coder.decodeObject(of: NSString.self, forKey: "t") as String? ?? ""; super.init() }
    func encode(with coder: NSCoder) { coder.encode(text, forKey: "t") }
}
let evilData = try NSKeyedArchiver.archivedData(withRootObject: Evil(), requiringSecureCoding: false)
do { _ = try NSKeyedUnarchiver.unarchivedObject(ofClass: Note.self, from: evilData) }
catch { print("secure unarchive as Note fails:", (error as NSError).domain, (error as NSError).code) }
let loose = try NSKeyedUnarchiver(forReadingFrom: evilData)
loose.requiresSecureCoding = false
_ = loose.decodeObject(forKey: NSKeyedArchiveRootObjectKey)
print("insecure unarchiver ran the attacker's class")
let good = try NSKeyedArchiver.archivedData(withRootObject: Note("hello"), requiringSecureCoding: true)
print("secure round trip:", try NSKeyedUnarchiver.unarchivedObject(ofClass: Note.self, from: good)!.text)
do { _ = try NSKeyedArchiver.archivedData(withRootObject: Evil(), requiringSecureCoding: true) }
catch { print("archiving a non-secure class with requiringSecureCoding:", (error as NSError).code) }

• secure unarchive as Note fails: NSCocoaErrorDomain 4864 / Evil.init(coder:) ran / insecure unarchiver ran the attacker's class / secure round trip: hello / archiving a non-secure class with requiringSecureCoding: 4866
• Evil.init(coder:) ran / secure unarchive as Note fails: NSCocoaErrorDomain 4864
• secure round trip: hello / insecure unarchiver ran the attacker's class