Use of <stdio.h> in production Objective-C code
ID |
objectivec.maintainability.avoid_stdio |
Severity |
info |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
Resource |
Api Misuse |
Language |
Objective-C |
Description
Reports an include of <stdio.h> or a call to one of its stream and formatted-I/O functions from Objective-C code.
Rationale
The C stream API sits outside every Cocoa facility an application relies on. A FILE * is not covered by data protection, sandbox-relative URL resolution or the coordinated-file machinery, its error reporting is a return code plus errno rather than an NSError, and the formatted-I/O family is untyped, so a format string that no longer matches its arguments is a runtime fault rather than a compile error. Console output written this way also bypasses the unified logging system, so it never reaches the device log and cannot be filtered or redacted.
The following code illustrates the pattern detected by this rule:
// FLAGGED: Use of <stdio.h> in production Objective-C code
#include <stdio.h>
#import <Foundation/Foundation.h>Remediation
Use the Foundation equivalents - NSFileHandle, NSFileManager and NSData/NSString +…WithContentsOfURL: for file access, NSString stringWithFormat: for formatting, NSScanner or NSNumberFormatter for parsing, and os_log for diagnostic output - all of which report failures through NSError and participate in data protection and unified logging.