run method

@override Future<AuditResult> run(ProjectContext context)

Executes the audit.

Implementation

@override
Future<AuditResult> run(ProjectContext context) async {
  final issues = <SecurityIssue>[];

  final plist = await InfoPlistHelper.load(context);

  if (plist == null || plist['UIFileSharingEnabled'] != true) {
    return AuditResult(issues: issues);
  }

  final supportsOpeningInPlace =
      plist['LSSupportsOpeningDocumentsInPlace'] == true;

  issues.add(
    SecurityIssue(
      id: 'ios.file_sharing.enabled',
      title: 'File Sharing Enabled',
      description: supportsOpeningInPlace
          ? 'UIFileSharingEnabled and LSSupportsOpeningDocumentsInPlace are both true, exposing the app\'s Documents directory to the Files app, Finder, and iTunes, and allowing other apps to open and edit those files directly.'
          : 'UIFileSharingEnabled is true, exposing the app\'s Documents directory to the Files app, Finder, and iTunes.',
      severity: Severity.medium,
      file: context.iosInfoPlist.path,
      recommendation:
          'Set UIFileSharingEnabled to false unless the app must share files with users this way, and never store sensitive data (tokens, credentials, private user data) in the Documents directory while it is enabled.',
    ),
  );

  return AuditResult(issues: issues);
}