Skip to content

// mobsf-ignore: ios_log comment does not work in .swift files #107

@yanz-safe

Description

@yanz-safe

My code looks like

        if isRunningPreviews {
            Swift.print(content)  // mobsf-ignore: ios_log
        }

But scaning still generates violation

{
          "message": {
            "text": "The App logs information. Sensitive information should never be logged."
          },
          "level": "note",
          "locations": [
            {
              "physicalLocation": {
                "region": {
                  "snippet": {
                    "text": "print("
                  },
                  "endColumn": 2457,
                  "endLine": 71,
                  "startColumn": 2451,
                  "startLine": 71
                },
                "artifactLocation": {
                  "uri": "App/.../Util.swift"
                }
              }
            }
          ],
          "properties": {
            "owasp-mobile": "M1: Improper Platform Usage",
            "masvs": "MSTG-STORAGE-3",
            "cwe": "CWE-532: Insertion of Sensitive Information into Log File",
            "reference": "https://github.com/MobSF/owasp-mstg/blob/master/Document/0x06i-Testing-Code-Quality-and-Build-Settings.md#finding-debugging-code-and-verbose-error-logging-mstg-code-4"
          },
          "ruleId": "ios_log",
          "ruleIndex": 0
        },

How can I silence this violation for specific lines of code with ios_log violations

Other rules are correctly ignored:

            configuration.tlsMinimumSupportedProtocolVersion = .TLSv13  // mobsf-ignore: ios_depr_tls_min
extension Int {
    @inlinable public static func insecureRandom(in range: ClosedRange<Int>) -> Int {
        Int.random(in: range)  // mobsf-ignore: ios_insecure_random_no_generator
    }
    @inlinable public static func insecureRandom(in range: Range<Int>) -> Int {
        Int.random(in: range)  // mobsf-ignore: ios_insecure_random_no_generator
    }
}

Thank you!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions