MASTG-TEST-0280: Pasteboard Contents Not Restricted to Local Device
Overview¶
This test checks if the app restricts the contents of the general pasteboard to the local device by using the UIPasteboard.setItems(_:options:)
method with the UIPasteboard.OptionsKey.localOnly
option. If sensitive data is placed in the general pasteboard without this restriction, it can be synced across devices via Universal Clipboard, leading to potential data leaks.
Steps¶
- Run a static analysis scan using radare2 for iOS to detect usage of the
UIPasteboard.general
property. - Run a static analysis scan using radare2 for iOS to detect usage of the
UIPasteboard.setItems(_:options:)
method.
Observation¶
The output should contain a list of locations where relevant APIs are used.
Evaluation¶
The test fails if the app uses the general pasteboard without restricting its contents to the local device. Specifically, ensure that the UIPasteboard.setItems(_:options:)
method is called with the UIPasteboard.Options.localOnly
option.