Cleartext storage of sensitive information

Description

The file has no special protections associated with it. Using .noFileProtection or FileProtectionType.none for file protection means that the file is not encrypted on disk, leaving it vulnerable to unauthorized access if the device is compromised or if the file is accessed outside of the app's sandbox. To enhance security, it's crucial to use appropriate file protection attributes based on the sensitivity of the data being stored. For sensitive data, you should use file protection options that encrypt the data on disk, such as FileProtectionType.complete or FileProtectionType.completeUnlessOpen.

Examples

Insecure Code

let fileURL = URL(fileURLWithPath: "path/to/file")
let data = "Sensitive data".data(using:.utf8)!
data.write(to: fileURL, options:.noFileProtection)

Secure Code

let fileURL = URL(fileURLWithPath: "path/to/file")
let data = "Sensitive data".data(using:.utf8)!
do {
  try data.write(to: fileURL, options:.completeFileProtection)
  print("Data written to file with complete file protection.")
} catch {
  print("Error writing data to file: \(error)")
}

Remediation

Use file protection options that encrypt the data on disk, such as FileProtectionType.complete or FileProtectionType.completeUnlessOpen.

Rule Details

Field	Value
ID	CODE-0632
Category	Secrets
Severity	CRITICAL
CWE	CWE-312
Confidence	HIGH
Impact	HIGH
Likelihood	MEDIUM
Exploitability	EASY
Tags	sensitive data, file protection
OWASP	A3:2017-Sensitive Data Exposure, A02:2021-Cryptographic Failures

---