Insecure storage mechanism used

Documentos > Datadog Security > Code Security > Static Code Analysis (SAST) > Reglas de SAST > Insecure storage mechanism used

Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Metadata

ID: swift-security/insecure-storage

Language: Unknown

Severity: Warning

Category: Security

Description

This rule identifies the use of insecure storage mechanisms, such as legacy or non-secure archiving APIs, that can expose sensitive data to tampering or unauthorized access. Storing data insecurely can lead to serious security vulnerabilities, including data leaks, integrity issues, and potential exploitation by attackers.

Developers can avoid violations of this rule by adopting secure archiving patterns, for example: NSKeyedArchiver.archivedData(withRootObject:requiringSecureCoding:) and NSKeyedUnarchiver.unarchivedObject(ofClass:from:). Where applicable, encrypt archived data before saving it to disk or transmitting it. Following these best practices helps protect user data confidentiality and integrity in Swift applications.

Non-Compliant Code Examples

class SomeController: UIViewController {
    func foo(picker: UIImagePickerController, didFinishPickingMediaWithInfo info: [NSObject : AnyObject]) {
        if let pickedImage = info[UIImagePickerControllerOriginalImage] as? UIImage {
            imageView.contentMode = .ScaleAspectFit
            imageView.image = pickedImage
        }
        NSKeyedArchiver.archivedData(pickedImage!)
        dismissViewControllerAnimated(true, completion: nil)
    }
}

class SomeController: UIViewController {
    func foo(picker: UIImagePickerController, didFinishPickingMediaWithInfo info: [NSObject : AnyObject]) {
        if let pickedImage = info[UIImagePickerControllerOriginalImage] as? UIImage {
            imageView.contentMode = .ScaleAspectFit
            imageView.image = pickedImage
        }
        UIImageWriteToSavedPhotosAlbum(pickedImage!, self, nil, nil)
        dismissViewControllerAnimated(true, completion: nil)
    }
}

Compliant Code Examples

import Foundation
import CryptoKit

enum SecureArchive {
    // Archive (secure coding required)
    static func archive<T: NSSecureCoding>(_ value: T) throws -> Data {
        try NSKeyedArchiver.archivedData(withRootObject: value, requiringSecureCoding: true)
    }
}