Rules / Swift
SHIELD-SWIFT-012
Sensitive data stored in UserDefaults
What it detects
A password or token is persisted in UserDefaults, which is unencrypted.
How to fix
Store credentials in the Keychain with an appropriate accessibility class instead of UserDefaults.
Vulnerable — Shield flags thisSessionStore.swift
import Foundation
func cacheSession(token: String) {
UserDefaults(suiteName: "group-shield")?.set(token, forKey: "sessionToken")
}
Fixed — scans cleanSessionStore.swift
import Foundation
import Security
func cacheSession(token: String) {
let item: [String: Any] = [
kSecClass as String: kSecClassGenericPassword,
kSecAttrAccount as String: "session",
kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
kSecValueData as String: Data(token.utf8)
]
SecItemAdd(item as CFDictionary, nil)
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-012, the fixed one does not.