search

Custodela / iGoat-Swift

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS
https://igoatapp.com/
GNU General Public License v3.0
0 stars 0 forks source link

CX Third_Party_Keyboards_On_Sensitive_Field @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/Yap/YapExerciseVC.swift [master] #11

Open tsunez opened 4 years ago

tsunez commented 4 years ago

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/Yap/YapExerciseVC.swift in branch master

The passwordTextField at line 15 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\Yap\YapExerciseVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 15 31

Code (Line #15):

    @IBOutlet weak var passwordTextField: UITextField!

Code (Line #31):

        let isVerified = verifyName(usernameTextField.text!, enteredPassword: passwordTextField.text!)
tsunez commented 4 years ago

Issue still exists.

SUMMARY

Issue has 2 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)

tsunez commented 4 years ago

Issue still exists.

SUMMARY

Issue has 2 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)

tsunez commented 4 years ago

Issue still exists.

SUMMARY

Issue has 2 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)