Security vulnerability flagging

@pramod-nair wrote:

One of our static security code analysis tool is flagging following iOS code for “Path Manipulation” vulnerability.

1. /cordova-plugin-ionic-webview/IONAssetHandler.m

2. NSData * data = [[NSData alloc] initWithContentsOfFile:startPath];

3. /CordovaLib/Classes/Public/CDVViewController.m

4. self.configParser = [[NSXMLParser alloc] initWithContentsOfURL:url];

5. /CordovaLib/Classes/Private/Plugins/CDVLocalStorage/CDVLocalStorage.m

6. BOOL ok = [appPlistDict writeToFile:appPlistPathatomically:YES];

7. /CordovaLib/Classes/Private/Plugins/CDVLocalStorage/CDVLocalStorage.m

8. NSMutableDictionary* appPlistDict = [NSMutableDictionary dictionaryWithContentsOfFile:appPlistPath];
   …

9. BOOL ok = [appPlistDict writeToFile:appPlistPath atomically:YES];

PLEASE HELP TO MITIGATE THIS important issue.

Posts: 1

Participants: 1

Read full topic