search

Custodela / iGoat-Swift

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS
https://igoatapp.com/
GNU General Public License v3.0
0 stars 0 forks source link

CX Unscrubbed_Secret @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/PlistStorage/PlistStorageExerciseViewController.swift [master] #71

Open tsunez opened 4 years ago

tsunez commented 4 years ago

Unscrubbed_Secret issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/PlistStorage/PlistStorageExerciseViewController.swift in branch master

Method login at line 25 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\PlistStorage\PlistStorageExerciseViewController.swift defines password, which is designated to contain user passwords. However, while plaintext passwords are later assigned to password, this variable is never cleared from memory.

Severity: Low

CWE:226

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 32 8

Code (Line #32):

            let password = txt_pwd.text

Code (Line #8):

    @IBOutlet weak var txt_pwd: UITextField!
tsunez commented 4 years ago

Issue still exists.

SUMMARY

Issue has 2 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)

tsunez commented 4 years ago

Issue still exists.

SUMMARY

Issue has 2 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)