Skip to content

// mobsf-ignore: ios_log comment does not work in .swift files #107

Description

@yanz-safe

My code looks like

        if isRunningPreviews {
            Swift.print(content)  // mobsf-ignore: ios_log
        }

But scaning still generates violation

{
          "message": {
            "text": "The App logs information. Sensitive information should never be logged."
          },
          "level": "note",
          "locations": [
            {
              "physicalLocation": {
                "region": {
                  "snippet": {
                    "text": "print("
                  },
                  "endColumn": 2457,
                  "endLine": 71,
                  "startColumn": 2451,
                  "startLine": 71
                },
                "artifactLocation": {
                  "uri": "App/.../Util.swift"
                }
              }
            }
          ],
          "properties": {
            "owasp-mobile": "M1: Improper Platform Usage",
            "masvs": "MSTG-STORAGE-3",
            "cwe": "CWE-532: Insertion of Sensitive Information into Log File",
            "reference": "https://github.com/MobSF/owasp-mstg/blob/master/Document/0x06i-Testing-Code-Quality-and-Build-Settings.md#finding-debugging-code-and-verbose-error-logging-mstg-code-4"
          },
          "ruleId": "ios_log",
          "ruleIndex": 0
        },

How can I silence this violation for specific lines of code with ios_log violations

Other rules are correctly ignored:

            configuration.tlsMinimumSupportedProtocolVersion = .TLSv13  // mobsf-ignore: ios_depr_tls_min
extension Int {
    @inlinable public static func insecureRandom(in range: ClosedRange<Int>) -> Int {
        Int.random(in: range)  // mobsf-ignore: ios_insecure_random_no_generator
    }
    @inlinable public static func insecureRandom(in range: Range<Int>) -> Int {
        Int.random(in: range)  // mobsf-ignore: ios_insecure_random_no_generator
    }
}

Thank you!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions