Rules / Swift
SHIELD-SWIFT-017
Keychain item without access control
What it detects
A Keychain item is added with an insecure always-accessible protection class.
How to fix
Use kSecAttrAccessibleWhenUnlockedThisDeviceOnly or add SecAccessControl with biometrics.
Vulnerable — Shield flags thisKeychainStore.swift
import Foundation
import Security
func storeSession(_ data: Data) {
let query: [String: Any] = [
kSecClass as String: kSecClassGenericPassword,
kSecAttrAccount as String: "api-session",
kSecAttrAccessible as String: kSecAttrAccessibleAlways,
kSecValueData as String: data
]
SecItemAdd(query as CFDictionary, nil)
}
Fixed — scans cleanKeychainStore.swift
import Foundation
import Security
func storeSession(_ data: Data) {
let query: [String: Any] = [
kSecClass as String: kSecClassGenericPassword,
kSecAttrAccount as String: "api-session",
kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
kSecValueData as String: data
]
SecItemAdd(query as CFDictionary, nil)
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-017, the fixed one does not.