File Sharing Enabled

ID

swift.file_sharing_enabled

Severity

low

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

medium

Resource

Information Leak

Language

Swift

Tags

ASVS50:v13.4.6, ASVS50:v14.2.3, ASVS50:v16.4.2, CWE:200, MASVS:MSTG-STORAGE-2

Description

Setting UIFileSharingEnabled to true in Info.plist opts the app’s sandbox Documents/ directory into iTunes / Finder file sharing and the iOS Files app. Any persisted document — cached PII, downloaded attachments, exported reports — becomes browseable to the device user.

<key>UIFileSharingEnabled</key>  <!-- FLAW -->
<true/>

Rationale

Most apps that enable this flag did so once for an export feature and never turned it off. The exposure is unbounded: anything the app writes under Documents/ is shared, including logs and database snapshots that developers do not associate with "files the user owns".

Remediation

Remove the key or set it to false. If you need user-visible export, build a deliberate share-sheet flow that exposes only the files chosen by the user.

References