Insecure storage mechanism used

Docs > Plateforme de sécurité Datadog > Code Security > Static Code Analysis (SAST) > Règles SAST > Insecure storage mechanism used

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: swift-security/insecure-storage

Language: Unknown

Severity: Warning

Category: Security

Description

This rule identifies the use of insecure storage mechanisms, such as legacy or non-secure archiving APIs, that can expose sensitive data to tampering or unauthorized access. Storing data insecurely can lead to serious security vulnerabilities, including data leaks, integrity issues, and potential exploitation by attackers.

Developers can avoid violations of this rule by adopting secure archiving patterns, for example: NSKeyedArchiver.archivedData(withRootObject:requiringSecureCoding:) and NSKeyedUnarchiver.unarchivedObject(ofClass:from:). Where applicable, encrypt archived data before saving it to disk or transmitting it. Following these best practices helps protect user data confidentiality and integrity in Swift applications.

Non-Compliant Code Examples

class SomeController: UIViewController {
    func foo(picker: UIImagePickerController, didFinishPickingMediaWithInfo info: [NSObject : AnyObject]) {
        if let pickedImage = info[UIImagePickerControllerOriginalImage] as? UIImage {
            imageView.contentMode = .ScaleAspectFit
            imageView.image = pickedImage
        }
        NSKeyedArchiver.archivedData(pickedImage!)
        dismissViewControllerAnimated(true, completion: nil)
    }
}

class SomeController: UIViewController {
    func foo(picker: UIImagePickerController, didFinishPickingMediaWithInfo info: [NSObject : AnyObject]) {
        if let pickedImage = info[UIImagePickerControllerOriginalImage] as? UIImage {
            imageView.contentMode = .ScaleAspectFit
            imageView.image = pickedImage
        }
        UIImageWriteToSavedPhotosAlbum(pickedImage!, self, nil, nil)
        dismissViewControllerAnimated(true, completion: nil)
    }
}

Compliant Code Examples

import Foundation
import CryptoKit

enum SecureArchive {
    // Archive (secure coding required)
    static func archive<T: NSSecureCoding>(_ value: T) throws -> Data {
        try NSKeyedArchiver.archivedData(withRootObject: value, requiringSecureCoding: true)
    }
}