custodela / igoat-swift Goto Github PK

Unscrubbed_Secret issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/CouchBase/CouchbaseLite.framework/Headers/CBLAuthenticator.h in branch master

Method + at line 30 of iGoat-Swift\iGoat-Swift\ThirdParty\CouchBase\CouchbaseLite.framework\Headers\CBLAuthenticator.h defines password, which is designated to contain user passwords. However, while plaintext passwords are later assigned to password, this variable is never cleared from memory.

Severity: Low

CWE:226

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 31

Code (Line #31):

                                           password: (NSString*)password;

Unchecked_CString_Convertion issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/CocoaLumberjack/DDTTYLogger.m in branch master

The element app at line 810 of iGoat-Swift\iGoat-Swift\ThirdParty\CocoaLumberjack\DDTTYLogger.m contains a C-String that was converted from a CFString object. The length of app was not checked after conversion.

Severity: Low

CWE:252

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 851 1427 1462 840 1224

Code (Line #851):

        BOOL processedID = [processID getCString:pid maxLength:(pidLen+1) encoding:NSUTF8StringEncoding];

Code (Line #1427):

            BOOL fgCodeRawEsc = [fgCodeRaw getCString:(fgCode+len1) maxLength:(len2+1) encoding:NSUTF8StringEncoding];

Code (Line #1462):

            BOOL bgCodeRawEsc = [bgCodeRaw getCString:(bgCode+len1) maxLength:(len2+1) encoding:NSUTF8StringEncoding];

Code (Line #840):

        BOOL processedAppName = [appName getCString:app maxLength:(appLen+1) encoding:NSUTF8StringEncoding];

Code (Line #1224):

        BOOL logMsgEnc = [logMsg getCString:msg maxLength:(msgLen + 1) encoding:NSUTF8StringEncoding];

Use_of_Hardcoded_Password issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/KeychainAnalyze/KeychainExerciseVC.swift in branch master

The application uses a single, hard-coded password passwordItem for authentication purposes, either using it to verify users' identities, or to access another remote system. This password at line 14 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\KeychainAnalyze\KeychainExerciseVC.swift appears in the code as plaintext, and cannot be changed without rebuilding the application.

Severity: Low

CWE:259

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 17 50

Code (Line #17):

            let passwordItem = KeychainPasswordItem(service: "SaveUser",

Code (Line #50):

            let passwordItem = KeychainPasswordItem(service: "SaveUser",

Jailbrake_File_Referenced_By_Name issue exists @ iGoat-Swift/iGoat-Swift/Source/External/SVProgressHUD/SVProgressHUD.m in branch master

A method imageWithContentsOfFile: at line 398 of iGoat-Swift\iGoat-Swift\Source\External\SVProgressHUD\SVProgressHUD.m accessing a file by filename.

Severity: Low

CWE:668

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 427 428 429

Code (Line #427):

        UIImage* infoImage = [UIImage imageWithContentsOfFile:[imageBundle pathForResource:@"info" ofType:@"png"]];

Code (Line #428):

        UIImage* successImage = [UIImage imageWithContentsOfFile:[imageBundle pathForResource:@"success" ofType:@"png"]];

Code (Line #429):

        UIImage* errorImage = [UIImage imageWithContentsOfFile:[imageBundle pathForResource:@"error" ofType:@"png"]];

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/KeychainAnalyze/KeychainExerciseVC.swift in branch master

The passwordTextField at line 6 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\KeychainAnalyze\KeychainExerciseVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 32 6 39

Code (Line #32):

            let password = passwordTextField.text

Code (Line #6):

    @IBOutlet weak var passwordTextField: UITextField!

Code (Line #39):

        passwordTextField.resignFirstResponder()

Dynamic_SQL_Queries issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/Views/YapDatabaseViewTransaction.m in branch master

Severity: Information

CWE:89

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 1315 1317 278 552 1320 507 558 1310 527

Code (Line #1315):

					[query appendFormat:@"?"];

Code (Line #1317):

					[query appendFormat:@", ?"];

Code (Line #278):

		NSString *string = [NSString stringWithFormat:

Code (Line #552):

		NSString *createMapTable = [NSString stringWithFormat:

Code (Line #1320):

			[query appendString:@");"];

Code (Line #507):

		NSString *dropKeyTable = [NSString stringWithFormat:@"DROP TABLE IF EXISTS \"%@\";", keyTableName];

Code (Line #558):

		NSString *createPageTable = [NSString stringWithFormat:

Code (Line #1310):

			[query appendFormat:@"SELECT \"rowid\", \"pageKey\" FROM \"%@\" WHERE \"rowid\" IN (", [self mapTableName]];

Code (Line #527):

		NSString *dropPageTable = [NSString stringWithFormat:@"DROP TABLE IF EXISTS \"%@\";", [self pageTableName]];

Client_Hardcoded_Domain issue exists @ igoat-swift/igoat-swift/resources/html/splash.html in branch master

The JavaScript file imported in "https://platform.twitter.com/widgets.js" in igoat-swift\igoat-swift\resources\html\splash.html at line 16 is from a remote domain, which may allow attackers to replace its contents with malicious code.

Severity: Low

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 16 27

Code (Line #16):

    &nbsp;&nbsp;&nbsp;Swaroop Yermalkar <a href="https://twitter.com/swaroopsy?ref_src=twsrc%5Etfw" class="twitter-follow-button" data-show-count="false">Follow @swaroopsy</a><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

Code (Line #27):

    Get latest updates about project <a href="https://twitter.com/owaspigoat?ref_src=twsrc%5Etfw" class="twitter-follow-button" data-show-count="false">Follow @owaspigoat</a><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift in branch master

The passwordField at line 8 of iGoat-Swift\iGoat-Swift\Source\Exercises\Key Management\Random Key Generation\RandomKeyGenerationExerciseVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [20](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L20) [8](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L8) [25](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L25) [10](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L10) [14](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L14)

[Code (Line #20):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L20)

        let password = passwordField.text

[Code (Line #8):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L8)

    @IBOutlet weak var passwordField: UITextField!

[Code (Line #25):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L25)

        passwordField.text = ""

[Code (Line #10):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L10)

    @IBOutlet weak var secretKeyField: UITextField!

[Code (Line #14):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L14)

        let message = (encryptionKeyStr == secretKeyField.text) ? "Success!!" : "Try Harder!!"

Dynamic_SQL_Queries issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/SecondaryIndex/YapDatabaseSecondaryIndexTransaction.m in branch master

Severity: Information

CWE:89

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 608 226 610 613 1061 230 234 238 1262 602 251 220 190

Code (Line #608):

			[query appendFormat:@"?"];

Code (Line #226):

			[createTable appendFormat:@", \"%@\" INTEGER", column.name];

Code (Line #610):

			[query appendFormat:@", ?"];

Code (Line #613):

	[query appendString:@");"];

Code (Line #1061):

	    [NSString stringWithFormat:@"SELECT \"rowid\" FROM \"%@\" %@;", [self tableName], query.queryString];

Code (Line #230):

			[createTable appendFormat:@", \"%@\" REAL", column.name];

Code (Line #234):

			[createTable appendFormat:@", \"%@\" TEXT", column.name];

Code (Line #238):

	[createTable appendString:@");"];

Code (Line #1262):

	    [NSString stringWithFormat:@"SELECT COUNT(*) AS NumberOfRows FROM \"%@\" %@;",

Code (Line #602):

	[query appendFormat:@"DELETE FROM \"%@\" WHERE \"rowid\" IN (", [self tableName]];

Code (Line #251):

		    [NSString stringWithFormat:@"CREATE INDEX IF NOT EXISTS \"%@\" ON \"%@\" (\"%@\");",

Code (Line #220):

	[createTable appendFormat:@"CREATE TABLE IF NOT EXISTS \"%@\" (\"rowid\" INTEGER PRIMARY KEY", tableName];

Code (Line #190):

	NSString *dropTable = [NSString stringWithFormat:@"DROP TABLE IF EXISTS \"%@\";", tableName];

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/Realm/RealmExerciseVC.swift in branch master

The creditNameTextField at line 12 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\Realm\RealmExerciseVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 12 44 13 14

Code (Line #12):

    @IBOutlet weak var creditNameTextField: UITextField!

Code (Line #44):

        let isVerified = verifyName(name: creditNameTextField.text!, number: creditNumberTextField.text!, cvv: creditCVVTextField.text!)

Code (Line #13):

    @IBOutlet weak var creditNumberTextField: UITextField!

Code (Line #14):

    @IBOutlet weak var creditCVVTextField: UITextField!

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/PlistStorage/PlistStorageExerciseViewController.swift in branch master

The txt_pwd at line 8 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\PlistStorage\PlistStorageExerciseViewController.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 32 36 8 27

Code (Line #32):

            let password = txt_pwd.text

Code (Line #36):

                txt_pwd.text = ""

Code (Line #8):

    @IBOutlet weak var txt_pwd: UITextField!

Code (Line #27):

        if self.txt_user.text!.isEmpty || self.txt_pwd.text!.isEmpty {

Autocorrection_Keystroke_Logging issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift in branch master

The UI element ssnField at line 15 of iGoat-Swift\iGoat-Swift\Source\Exercises\Server Communication\ServerCommunicationExerciseVC.swift provides interactive input of sensitive text data. Autocorrection dictionary may cache the sensitive information, and make it accessible to attackers.

Severity: Medium

CWE:359

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [15](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift#L15)

[Code (Line #15):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift#L15)

    @IBOutlet weak var ssnField: UITextField!

Screen_Caching issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/PlistStorage/PlistStorageExerciseViewController.swift in branch master

The UI element txt_pwd at line 8 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\PlistStorage\PlistStorageExerciseViewController.swift displays sensitive data on screen. Background screen caching of this sensitive information is not prevented by any means.

Severity: Medium

CWE:524

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 8

Code (Line #8):

    @IBOutlet weak var txt_pwd: UITextField!

Jailbrake_File_Referenced_By_Name issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/Relationships/YapDatabaseRelationshipTransaction.m in branch master

A method removeItemAtPath:error: at line 2959 of iGoat-Swift\iGoat-Swift\ThirdParty\YapDatabase\Extensions\Relationships\YapDatabaseRelationshipTransaction.m accessing a file by filename.

Severity: Low

CWE:668

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 2966

Code (Line #2966):

				if (![fileManager removeItemAtPath:filePath error:&error])

Missing_Device_Lock_Verification issue exists @ iGoat-Swift/iGoat-SwiftTests/Info.plist in branch master

The application does not perform any checks to verify if the device must be lockable.

Severity: Low

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 1

Code (Line #1):

<?xml version="1.0" encoding="UTF-8"?>

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/Yap/YapExerciseVC.swift in branch master

The passwordTextField at line 15 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\Yap\YapExerciseVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 15 31

Code (Line #15):

    @IBOutlet weak var passwordTextField: UITextField!

Code (Line #31):

        let isVerified = verifyName(usernameTextField.text!, enteredPassword: passwordTextField.text!)

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift in branch master

The ssnField at line 15 of iGoat-Swift\iGoat-Swift\Source\Exercises\Server Communication\ServerCommunicationExerciseVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [23](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift#L23) [29](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift#L29) [15](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift#L15)

[Code (Line #23):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift#L23)

                           "socialSecurityNumber":ssnField.text]

[Code (Line #29):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift#L29)

            ssnField.resignFirstResponder()

[Code (Line #15):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Server Communication/ServerCommunicationExerciseVC.swift#L15)

    @IBOutlet weak var ssnField: UITextField!

Dynamic_SQL_Queries issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/SearchResults/YapDatabaseSearchResultsViewTransaction.m in branch master

Severity: Information

CWE:89

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 931 936 938 268 941

Code (Line #931):

			[query appendFormat:@"DELETE FROM \"%@\" WHERE \"rowid\" IN (", [self snippetTableName]];

Code (Line #936):

					[query appendFormat:@"?"];

Code (Line #938):

					[query appendFormat:@", ?"];

Code (Line #268):

			NSString *createSnippetTable = [NSString stringWithFormat:

Code (Line #941):

			[query appendString:@");"];

Empty_Password issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Social Engineering/SocialEngineeringVC.swift in branch master

The application uses the empty password password for authentication purposes, either using it to verify users' identities, or to access another remote system. This empty password is set at line 29 of iGoat-Swift\iGoat-Swift\Source\Exercises\Social Engineering\SocialEngineeringVC.swift appears in the code, cannot be changed without rebuilding the application and indicates its associated account is exposed.

Severity: Low

CWE:521

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [31](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Social Engineering/SocialEngineeringVC.swift#L31)

[Code (Line #31):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Social Engineering/SocialEngineeringVC.swift#L31)

        let password = passwordTxtField.text ?? ""

Signed_Memory_Arithmetic issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/CocoaLumberjack/DDTTYLogger.m in branch master

Signed integer useStack at line 1162 of iGoat-Swift\iGoat-Swift\ThirdParty\CocoaLumberjack\DDTTYLogger.m specifies size of memory to allocate.

Severity: High

CWE:190

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 1218

Code (Line #1218):

        const BOOL useStack = msgLen < (1024 * 4);

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift in branch master

The passwordTextField at line 30 of iGoat-Swift\iGoat-Swift\Source\Exercises\Key Management\Hard Coded Keys\BrokenCryptographyExerciseVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [33](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L33) [11](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L11)

[Code (Line #33):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L33)

        passwordTextField.text = password

[Code (Line #11):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L11)

    @IBOutlet weak var passwordTextField: UITextField!

Unscrubbed_Secret issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift in branch master

Method UITextField! at line 4 of iGoat-Swift\iGoat-Swift\Source\Exercises\Binary Patching\BinaryPatchingVC.swift defines passwordTextField, which is designated to contain user passwords. However, while plaintext passwords are later assigned to passwordTextField, this variable is never cleared from memory.

Severity: Low

CWE:226

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [4](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L4) [11](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L11)

[Code (Line #4):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L4)

    @IBOutlet weak var passwordTextField: UITextField!

[Code (Line #11):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L11)

        let password = passwordTextField.text!

Unscrubbed_Secret issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/FilteredViews/YapDatabaseFilteredViewTransaction.m in branch master

Method - at line 759 of iGoat-Swift\iGoat-Swift\ThirdParty\YapDatabase\Extensions\FilteredViews\YapDatabaseFilteredViewTransaction.m defines passesFilter, which is designated to contain user passwords. However, while plaintext passwords are later assigned to passesFilter, this variable is never cleared from memory.

Severity: Low

CWE:226

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 800 905 1213 1054

Code (Line #800):

	BOOL passesFilter;

Code (Line #905):

	BOOL passesFilter;

Code (Line #1213):

	BOOL passesFilter;

Code (Line #1054):

	BOOL passesFilter;

Empty_Password issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/CoreData/KeychainUsage/KeychainDumper.swift in branch master

The application uses the empty password passwordInGenp for authentication purposes, either using it to verify users' identities, or to access another remote system. This empty password is set at line 9 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\CoreData\KeychainUsage\KeychainDumper.swift appears in the code, cannot be changed without rebuilding the application and indicates its associated account is exposed.

Severity: Low

CWE:521

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 9

Code (Line #9):

    var passwordInGenp = ""

Unscrubbed_Secret issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Authentication/Remote/RemoteAuthenticationExerciseVC.swift in branch master

Method loginUser at line 5 of iGoat-Swift\iGoat-Swift\Source\Exercises\Authentication\Remote\RemoteAuthenticationExerciseVC.swift defines password, which is designated to contain user passwords. However, while plaintext passwords are later assigned to password, this variable is never cleared from memory.

Severity: Low

CWE:226

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 5 25 13

Code (Line #5):

        static func loginUser(name: String, password: String) -> String {

Code (Line #25):

        let password = passwordTextField.text ?? ""

Code (Line #13):

    @IBOutlet weak var passwordTextField: UITextField!

Dynamic_SQL_Queries issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/FullTextSearch/YapDatabaseFullTextSearchTransaction.m in branch master

Severity: Information

CWE:89

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 434 179 181 200 440 442 171 445 142

Code (Line #434):

	[query appendFormat:@"DELETE FROM \"%@\" WHERE \"rowid\" IN (", [self tableName]];

Code (Line #179):

			[createTable appendFormat:@"\"%@\"", columnName];

Code (Line #181):

			[createTable appendFormat:@", \"%@\"", columnName];

Code (Line #200):

	[createTable appendString:@");"];

Code (Line #440):

			[query appendFormat:@"?"];

Code (Line #442):

			[query appendFormat:@", ?"];

Code (Line #171):

	[createTable appendFormat:@"CREATE VIRTUAL TABLE IF NOT EXISTS \"%@\" USING fts4(", tableName];

Code (Line #445):

	[query appendString:@");"];

Code (Line #142):

	NSString *dropTable = [NSString stringWithFormat:@"DROP TABLE IF EXISTS \"%@\";", tableName];

Use_of_Hardcoded_Password issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift in branch master

The application uses a single, hard-coded password password for authentication purposes, either using it to verify users' identities, or to access another remote system. This password at line 30 of iGoat-Swift\iGoat-Swift\Source\Exercises\Key Management\Hard Coded Keys\BrokenCryptographyExerciseVC.swift appears in the code as plaintext, and cannot be changed without rebuilding the application.

Severity: Low

CWE:259

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [32](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L32)

[Code (Line #32):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L32)

        let password = "b@nkP@ssword123"

Unscrubbed_Secret issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/CouchBase/CouchbaseLite.framework/Headers/CBLDatabase.h in branch master

Method - at line 99 of iGoat-Swift\iGoat-Swift\ThirdParty\CouchBase\CouchbaseLite.framework\Headers\CBLDatabase.h defines keyOrPassword, which is designated to contain user passwords. However, while plaintext passwords are later assigned to keyOrPassword, this variable is never cleared from memory.

Severity: Low

CWE:226

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 99

Code (Line #99):

- (BOOL) changeEncryptionKey: (nullable id)keyOrPassword

Sensitive_Data_In_Temp_Folders issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift in branch master

The app's viewDidLoad method takes sensitive personal data, data: at line 30 of iGoat-Swift\iGoat-Swift\Source\Exercises\Key Management\Hard Coded Keys\BrokenCryptographyExerciseVC.swift. The viewDidLoad of iGoat-Swift\iGoat-Swift\Source\Exercises\Key Management\Hard Coded Keys\BrokenCryptographyExerciseVC.swift then saves this data to disk, at line 30. However, the atomic parameter causes the operation to write the data to a temporary file.

Severity: Low

CWE:377

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [32](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L32) [34](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L34)

[Code (Line #32):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L32)

        let password = "b@nkP@ssword123"

[Code (Line #34):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L34)

        let data = password.data(using: .utf8)

App_Transport_Security_Bypass issue exists @ iGoat-Swift/iGoat-Swift/Info.plist in branch master

App Transport Security was disabled in line number 1. This may lead to file disclosures. ATS should not be disabled in order to comply with Apple Store's security compliance and make the application safe.

Severity: High

CWE:319

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 1

Code (Line #1):

<?xml version="1.0" encoding="UTF-8"?>

Unchecked_CString_Convertion issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Internal/YapDatabaseString.h in branch master

The element str at line 75 of iGoat-Swift\iGoat-Swift\ThirdParty\YapDatabase\Internal\YapDatabaseString.h contains a C-String that was converted from a CFString object. The length of str was not checked after conversion.

Severity: Low

CWE:252

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 95

Code (Line #95):

		[nsStr getCString:dbStr->str maxLength:(dbStr->length + 1) encoding:NSUTF8StringEncoding];

Unscrubbed_Secret issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift in branch master

Method UITextField! at line 8 of iGoat-Swift\iGoat-Swift\Source\Exercises\Key Management\Random Key Generation\RandomKeyGenerationExerciseVC.swift defines passwordField, which is designated to contain user passwords. However, while plaintext passwords are later assigned to passwordField, this variable is never cleared from memory.

Severity: Low

CWE:226

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [20](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L20) [8](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L8) [28](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L28)

[Code (Line #20):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L20)

        let password = passwordField.text

[Code (Line #8):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L8)

    @IBOutlet weak var passwordField: UITextField!

[Code (Line #28):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Random Key Generation/RandomKeyGenerationExerciseVC.swift#L28)

    func storeCredentials(forUsername username: String?, withPassword password: String?) {

Third_Party_Keyboard_Enabled issue exists @ iGoat-Swift/iGoat-Swift/AppDelegate.swift in branch master

We did not find any code in the application that disables third party keyboards.

Severity: Low

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 7

Code (Line #7):

class AppDelegate: UIResponder, UIApplicationDelegate {

Screen_Caching issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift in branch master

The UI element passwordTextField at line 11 of iGoat-Swift\iGoat-Swift\Source\Exercises\Key Management\Hard Coded Keys\BrokenCryptographyExerciseVC.swift displays sensitive data on screen. Background screen caching of this sensitive information is not prevented by any means.

Severity: Medium

CWE:524

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [11](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L11)

[Code (Line #11):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L11)

    @IBOutlet weak var passwordTextField: UITextField!

Autocorrection_Keystroke_Logging issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift in branch master

The UI element passwordTextField at line 11 of iGoat-Swift\iGoat-Swift\Source\Exercises\Key Management\Hard Coded Keys\BrokenCryptographyExerciseVC.swift provides interactive input of sensitive text data. Autocorrection dictionary may cache the sensitive information, and make it accessible to attackers.

Severity: Medium

CWE:359

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [11](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L11)

[Code (Line #11):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Key Management/Hard Coded Keys/BrokenCryptographyExerciseVC.swift#L11)

    @IBOutlet weak var passwordTextField: UITextField!

Dynamic_SQL_Queries issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/Relationships/YapDatabaseRelationshipTransaction.m in branch master

Severity: Information

CWE:89

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 226 213 229 189 223

Code (Line #226):

	NSString *createSrcIndex = [NSString stringWithFormat:

Code (Line #213):

	NSString *createTable = [NSString stringWithFormat:

Code (Line #229):

	NSString *createDstIndex = [NSString stringWithFormat:

Code (Line #189):

	NSString *dropTable = [NSString stringWithFormat:@"DROP TABLE IF EXISTS \"%@\";", tableName];

Code (Line #223):

	NSString *createNameIndex = [NSString stringWithFormat:

Jailbrake_File_Referenced_By_Name issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/CocoaLumberjack/DDFileLogger.m in branch master

A method createFileAtPath:contents:attributes: at line 455 of iGoat-Swift\iGoat-Swift\ThirdParty\CocoaLumberjack\DDFileLogger.m accessing a file by filename.

Severity: Low

CWE:668

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 496 1264 1265 1270 200 235 1132 477

Code (Line #496):

            [[NSFileManager defaultManager] createFileAtPath:filePath contents:nil attributes:attributes];

Code (Line #1264):

        if ([[NSFileManager defaultManager] fileExistsAtPath:newFilePath] &&

Code (Line #1265):

           ![[NSFileManager defaultManager] removeItemAtPath:newFilePath error:&error])

Code (Line #1270):

        if (![[NSFileManager defaultManager] moveItemAtPath:filePath toPath:newFilePath error:&error])

Code (Line #200):

        [[NSFileManager defaultManager] removeItemAtPath:logFileInfo.filePath error:nil];

Code (Line #235):

    if (![[NSFileManager defaultManager] fileExistsAtPath:_logsDirectory])

Code (Line #1132):

        fileAttributes = [[NSFileManager defaultManager] attributesOfItemAtPath:filePath error:nil];

Code (Line #477):

        if (![[NSFileManager defaultManager] fileExistsAtPath:filePath])

Missing_Jailbreak_Check issue exists @ iGoat-Swift/iGoat-SwiftTests/Info.plist in branch master

No checks to identify whether the device has been rooted were found.

Severity: Low

CWE:693

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 1

Code (Line #1):

<?xml version="1.0" encoding="UTF-8"?>

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift in branch master

The passwordTextField at line 4 of iGoat-Swift\iGoat-Swift\Source\Exercises\Binary Patching\BinaryPatchingVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [4](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L4) [7](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L7) [11](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L11)

[Code (Line #4):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L4)

    @IBOutlet weak var passwordTextField: UITextField!

[Code (Line #7):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L7)

        if passwordTextField.text?.isEmpty ?? true {

[Code (Line #11):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Binary Patching/BinaryPatchingVC.swift#L11)

        let password = passwordTextField.text!

Dynamic_SQL_Queries issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/FullTextSearch/YapDatabaseFullTextSearch.m in branch master

Severity: Information

CWE:89

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 32

Code (Line #32):

	NSString *dropTable = [NSString stringWithFormat:@"DROP TABLE IF EXISTS \"%@\";", tableName];

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/CoreData/CoreDataExerciseVC.swift in branch master

The passwordTextField at line 52 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\CoreData\CoreDataExerciseVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 66 52

Code (Line #66):

            let password = passwordTextField.text

Code (Line #52):

    @IBOutlet weak var passwordTextField: UITextField!

Autocorrection_Keystroke_Logging issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Authentication/Remote/RemoteAuthenticationExerciseVC.swift in branch master

The UI element passwordTextField at line 13 of iGoat-Swift\iGoat-Swift\Source\Exercises\Authentication\Remote\RemoteAuthenticationExerciseVC.swift provides interactive input of sensitive text data. Autocorrection dictionary may cache the sensitive information, and make it accessible to attackers.

Severity: Medium

CWE:359

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 13

Code (Line #13):

    @IBOutlet weak var passwordTextField: UITextField!

Dynamic_SQL_Queries issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/SearchResults/YapDatabaseSearchResultsView.m in branch master

Severity: Information

CWE:89

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 38

Code (Line #38):

		NSString *dropTable = [NSString stringWithFormat:@"DROP TABLE IF EXISTS \"%@\";", snippetTableName];

Unscrubbed_Secret issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/KeychainAnalyze/KeychainPasswordItem.swift in branch master

Method noPassword at line 15 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\KeychainAnalyze\KeychainPasswordItem.swift defines noPassword, which is designated to contain user passwords. However, while plaintext passwords are later assigned to noPassword, this variable is never cleared from memory.

Severity: Low

CWE:226

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 16 70 150 72 154 61 62 15

Code (Line #16):

        case unexpectedPasswordData

Code (Line #70):

    func savePassword(_ password: String) throws {

Code (Line #150):

        var passwordItems = [KeychainPasswordItem]()

Code (Line #72):

        let encodedPassword = password.data(using: String.Encoding.utf8)!

Code (Line #154):

            let passwordItem = KeychainPasswordItem(service: service, account: account, accessGroup: accessGroup)

Code (Line #61):

            let passwordData = existingItem[kSecValueData as String] as? Data,

Code (Line #62):

            let password = String(data: passwordData, encoding: String.Encoding.utf8)

Code (Line #15):

        case noPassword

Autocorrection_Keystroke_Logging issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/InsecureLocalDataStorage/CoreData/CoreDataExerciseVC.swift in branch master

The UI element passwordTextField at line 52 of iGoat-Swift\iGoat-Swift\Source\Exercises\InsecureLocalDataStorage\CoreData\CoreDataExerciseVC.swift provides interactive input of sensitive text data. Autocorrection dictionary may cache the sensitive information, and make it accessible to attackers.

Severity: Medium

CWE:359

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 52

Code (Line #52):

    @IBOutlet weak var passwordTextField: UITextField!

SQL_Injection issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Injection Flaws/SQL Injection/SQLInjectionExerciseVC.swift in branch master

Method search at line 7 of iGoat-Swift\iGoat-Swift\Source\Exercises\Injection Flaws\SQL Injection\SQLInjectionExerciseVC.swift gets user input from the text element. This element’s value then flows through the code without being properly sanitized or validated, and is eventually used in a database query in method search at line 7 of iGoat-Swift\iGoat-Swift\Source\Exercises\Injection Flaws\SQL Injection\SQLInjectionExerciseVC.swift. This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: [17](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Injection Flaws/SQL Injection/SQLInjectionExerciseVC.swift#L17)

[Code (Line #17):](https://github.com/Custodela/iGoat-Swift/blob/master/iGoat-Swift/iGoat-Swift/Source/Exercises/Injection Flaws/SQL Injection/SQLInjectionExerciseVC.swift#L17)

             searchStr = "%" + "\(searchField.text!)" + "%"

Empty_Password issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Authentication/Remote/RemoteAuthenticationExerciseVC.swift in branch master

The application uses the empty password password for authentication purposes, either using it to verify users' identities, or to access another remote system. This empty password is set at line 15 of iGoat-Swift\iGoat-Swift\Source\Exercises\Authentication\Remote\RemoteAuthenticationExerciseVC.swift appears in the code, cannot be changed without rebuilding the application and indicates its associated account is exposed.

Severity: Low

CWE:521

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 25

Code (Line #25):

        let password = passwordTextField.text ?? ""

Log_Forging issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/SideChannelDataLeaks/DeviceLogs/DeviceLogsExerciseVC.swift in branch master

Method submitItemPressed at line 8 of iGoat-Swift\iGoat-Swift\Source\Exercises\SideChannelDataLeaks\DeviceLogs\DeviceLogsExerciseVC.swift gets user input from element text. This element’s value flows through the code without being properly sanitized or validated, and is eventually used in writing an audit log in submitItemPressed at line 8 of iGoat-Swift\iGoat-Swift\Source\Exercises\SideChannelDataLeaks\DeviceLogs\DeviceLogsExerciseVC.swift.

Severity: Low

CWE:117

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 9 10 11

Code (Line #9):

        NSLog("ccNo: %@", ccNoTextField.text ?? "")

Code (Line #10):

        NSLog("cvvNo: %@", cvvTextField.text ?? "")

Code (Line #11):

        NSLog("pinNo: %@", pinTextField.text ?? "")

Third_Party_Keyboards_On_Sensitive_Field issue exists @ iGoat-Swift/iGoat-Swift/Source/Exercises/Authentication/Remote/RemoteAuthenticationExerciseVC.swift in branch master

The passwordTextField at line 13 of iGoat-Swift\iGoat-Swift\Source\Exercises\Authentication\Remote\RemoteAuthenticationExerciseVC.swift contains sensitive data, and is not protected from third party keyboards by either: 1) Setting secureTextEntry=YES, -Or- 2) Disabling third party keyboards application wide.

Severity: High

CWE:829

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 19 25 13

Code (Line #19):

        } else if passwordTextField.text?.isEmpty ?? true {

Code (Line #25):

        let password = passwordTextField.text ?? ""

Code (Line #13):

    @IBOutlet weak var passwordTextField: UITextField!

Dynamic_SQL_Queries issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/Relationships/YapDatabaseRelationship.m in branch master

Severity: Information

CWE:89

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 41

Code (Line #41):

	NSString *dropTable = [NSString stringWithFormat:@"DROP TABLE IF EXISTS \"%@\";", tableName];