Intro

This vulnerable IOS app is an extended fork of oversecured/OversecuredVulnerableiOSApp. Intended vulnerabilities are marked in the code with a // VULNERABILITY comment.

Build Requirements

• Swift toolchain (>= 6.1)
• Swift SDK (supported by the toolchain)
• Xcode, or the Xcode command line tools (xcode-select --install)

Building

xcodebuild -project shiftleft_swift_demo.xcodeproj/ -scheme shiftleft_swift_demo -configuration Debug -destination 'generic/platform=iOS Simulator,name=iPhone 17' build

Installing on the emulator

xcodebuild -project shiftleft_swift_demo.xcodeproj/ -scheme shiftleft_swift_demo -configuration Debug -destination 'platform=iOS Simulator,name=iPhone 17' install

SL-based analyis

Force a full rebuild of the project by doing a clean and build, and store a log of what happened in build.log:

xcodebuild -project shiftleft_swift_demo.xcodeproj/ -scheme shiftleft_swift_demo -configuration Debug -destination 'generic/platform=iOS Simulator,name=iPhone 17' clean build -verbose > build.log

Invoke SL, specifying the build log:

sl analyze --wait --strict --swiftsrc . -- --build-log-path build.log