File Sharing Enabled
ID |
swift.file_sharing_enabled |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Information Leak |
Language |
Swift |
Tags |
ASVS50:v13.4.6, ASVS50:v14.2.3, ASVS50:v16.4.2, CWE:200, MASVS:MSTG-STORAGE-2 |
Description
Setting UIFileSharingEnabled to true in Info.plist opts the app’s
sandbox Documents/ directory into iTunes / Finder file sharing and the
iOS Files app. Any persisted document — cached PII, downloaded
attachments, exported reports — becomes browseable to the device user.
<key>UIFileSharingEnabled</key> <!-- FLAW -->
<true/>
Rationale
Most apps that enable this flag did so once for an export feature and
never turned it off. The exposure is unbounded: anything the app writes
under Documents/ is shared, including logs and database snapshots that
developers do not associate with "files the user owns".
Remediation
Remove the key or set it to false. If you need user-visible export,
build a deliberate share-sheet flow that exposes only the files chosen
by the user.
References
-
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.