Missing Dangerous Permission

ID

swift.missing_dangerous_permission

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

medium

Resource

Misconfiguration

Language

Swift

Tags

ASVS50:v13.2.4, CWE:732, MASVS:MSTG-PLATFORM-1, OWASP:2025:A01

Description

iOS requires a "usage description" string in Info.plist for every privacy-sensitive resource an app accesses (camera, microphone, photo library, location, contacts, health, Bluetooth). When the matching key is absent and the app attempts to access the resource, iOS silently denies the permission — no system dialog is shown, the framework call fails, and the defect typically surfaces only on a real device in production.

The rule cross-references Swift source for references to privacy-gated framework classes and checks Info.plist for the corresponding usage description key. Mappings used:

Source class Required key

AVCaptureDevice

NSCameraUsageDescription

AVAudioSession, AVAudioRecorder

NSMicrophoneUsageDescription

PHPhotoLibrary, PHAsset

NSPhotoLibraryUsageDescription

CLLocationManager

NSLocationWhenInUseUsageDescription or NSLocationAlwaysAndWhenInUseUsageDescription

CNContactStore

NSContactsUsageDescription

HKHealthStore

NSHealthShareUsageDescription or NSHealthUpdateUsageDescription

CBCentralManager, CBPeripheralManager

NSBluetoothAlwaysUsageDescription

 
import AVFoundation

// Requires NSCameraUsageDescription in Info.plist
let device = AVCaptureDevice.default(for: .video)

Rationale

Apple’s App Review will reject submissions missing required usage descriptions; the failure mode at runtime is silent — no exception, no log — making this one of the harder iOS misconfigurations to debug.

Remediation

Add the required key to the application’s Info.plist, with a clear, user-facing string explaining why the app needs the permission.

References