Hi, our app written with Xamarin.iOS 6.3 and XCode 8.3 was tested by a security check and 4 issues were found
- fobj-arc flag is not found
App is not compiled with Automatic Reference Counting (ARC) flag.
ARC is a compiler feature that provides automatic memory
management of Objective-C objects and protects from memory
corruption vulnerabilities.
=> I tried the -gcc-flags "-fobj-orc" parameters with same result
- Binary make use of banned API(s)
The binary may contain the following banned API(s)
vsnprintf, sscanf, strtok, strlen, strcat, alloca, strcpy, sprintf,
printf, gets, vsprintf, memcpy, strncpy.
=> Any chance we can change that ?
- Binary make use of the following Weak HASH API(s)
The binary may use the following weak hash API(s)
CC_MD2_Final, CC_MD5_Update, CC_MD4_Update, CC_MD4_Init,
CC_MD2_Update, CC_SHA1_Init, CC_SHA1_Update,
CC_MD2_Init, CC_MD4_Final, CC_MD5_Final, CC_SHA1_Final,
CC_MD5_Init.
=> We reference an external library and I think these old crypting apis are used for crypting pdf
- Binary make use of malloc Function
The binary may use malloc function instead of calloc.
=>Is-it possible to change this when converting to Objectiv-C ?
Any helps would be greatly appreciated...
Regards