ATS Allows Arbitrary Loads For Media

ID

swift.ats_allows_arbitrary_loads_for_media

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

medium

Resource

Information Leak

Language

Swift

Tags

ASVS50:v12.2.1, ASVS50:v12.3.1, ASVS50:v12.3.3, ASVS50:v4.4.1, ASVS50:v4.4.4, CWE:319, MASVS:MSTG-NETWORK-1, OWASP:2025:A06

Description

The NSAllowsArbitraryLoadsForMedia key in Info.plist disables App Transport Security (ATS) for media URLs loaded through AVFoundation (AVPlayer, AVAsset, AVURLAsset). When set to true, the framework will stream over plain HTTP without complaint.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoadsForMedia</key>  <!-- FLAW -->
    <true/>
</dict>

Rationale

The bypass survives review at organisations that scan only the top-level NSAllowsArbitraryLoads flag: NSAllowsArbitraryLoadsForMedia is a separate, narrower ATS opt-out that many engineers enable for a quick test against an HTTP video URL and forget to revert.

Remediation

Remove the key or set it to false. Migrate any HTTP media URLs to HTTPS; if a single host must stay HTTP, add a narrow NSExceptionDomains entry for that domain only.

References