rules-swift

RISK: a deep-link / `application(_:open:)` handler that acts on `url.host` or `url.path` without checking the scheme and validating the path trusts attacker-crafted `sigmashake://` URLs or rogue `.rules` file opens — path traversal or navigating the dashboard webview to a forged page (CWE-20/CWE-601). FIX: verify `url.scheme == "sigmashake"`, allowlist the action, and validate the file (`url.isFileURL` + `path.hasSuffix(".rules")` + canonicalized path inside an expected dir) before routing — as DeepLinkController does.

RISK: accepting an invalid server trust / disabling SSL pinning opens the app to MITM interception of every HTTPS request (CWE-295). The desktop updater POSTs the dashboard token to the daemon and Sparkle fetches signed bundles — a MITM here is credential theft + a path to RCE. FIX: never short-circuit `URLAuthenticationChallenge`; let the system evaluate `serverTrust`, or pin with `SecTrustEvaluateWithError`.

RISK: NSAllowsArbitraryLoads disables App Transport Security app-wide, permitting cleartext HTTP and weak TLS to ANY host (CWE-319) — Apple also rejects it at review without a documented exception. FIX: remove the global flag; the dashboard is reached over `http://127.0.0.1:<port>` which ATS already exempts as a loopback literal — scope any required exception to a single host under `NSExceptionDomains`.

RISK: shipping with the App Sandbox off (`app-sandbox = false`) or `get-task-allow = true` removes the OS confinement around a WebKit-hosting app and lets a debugger attach to the running process to read its memory (and the dashboard token) — and `get-task-allow` in a release build is a hard notarization/App Review failure (CWE-250). FIX: keep `com.apple.security.app-sandbox` true in release entitlements and never ship `get-task-allow`; scope file access with security-scoped bookmarks instead.

RISK: force-cast (`as!`) traps and crashes the app when the runtime type does not match — e.g. a private KVC accessor like `value(forKey:) as! NSObject` returning an unexpected type. FIX: use conditional cast `as?` with `guard let`/`if let` so a type mismatch is handled instead of fatal.

RISK: force-unwrap (foo!) crashes the whole app on nil — a runtime trap with no recovery path, the dominant cause of Swift production crashes. FIX: bind with `if let`/`guard let else { return }`, or supply a default with `??`. Reserve `!` for IBOutlets and values you can prove are non-nil.

RISK: a secret literal compiled into the Swift binary is trivially recoverable with `strings`/`otool` from the shipped `.app` (CWE-798). FIX: never embed credentials in source — read them from the Keychain at runtime, the macOS Secrets Store, or a server-issued short-lived token; for the dashboard token use `DashboardToken.read()`, never a constant.

RISK: a hardcoded, predictable `/tmp/...` path is world-writable, so an attacker can pre-place a symlink and race your write (TOCTOU symlink attack, CWE-377/CWE-367) or read what you drop there. FIX: use `FileManager.default.temporaryDirectory` (or `url(for: .itemReplacementDirectory …)`) for a per-user, unpredictable temp dir, and create files with `O_EXCL`/0600 so a pre-existing target fails the open.

RISK: UserDefaults persists to a world-readable, unencrypted plist under ~/Library/Preferences — any process running as the user (or a Time Machine/iCloud backup) can read a token stored there (CWE-312/CWE-922). FIX: store credentials in the Keychain via `SecItemAdd`/`SecItemCopyMatching` with `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`, never UserDefaults.

RISK: building a `Process.arguments` array element by string-interpolating user/web-supplied input (`"--path=\(userValue)"`) is safe from shell metachars but still lets an attacker inject extra flags or path-traversal values the target binary trusts (argument injection, CWE-88). FIX: validate/allowlist each interpolated value before it becomes an argv entry; pass file paths as their own array element rather than splicing them into a flag string.

RISK: logging a password/token/key writes it to the unified system log and crash reports, where any local process or support dump can read it (CWE-532). The dashboard token (`X-SigmaShake-Token`) authenticates every daemon request — logging it is a session-takeover leak. FIX: omit the value, or log a redacted prefix; mark sensitive os_log interpolation `%{private}@`.

RISK: launching `Process()`/`NSTask` against `/bin/sh -c` (or env) with an interpolated command string is OS command injection (CWE-78) — any value flowing into that string can break out with `;`, `$()`, or backticks. FIX: invoke the target binary directly via `executableURL` + an `arguments` array (as `Shell.run(exe, args)` does), never a shell; the array form passes argv verbatim with no shell parsing.

RISK: Swift string interpolation `\(value)` inside an SQL string is direct SQL injection (CWE-89) — FMDB `executeUpdate`/`executeQuery`, GRDB/SQLite `prepare`, or a raw query built with `\(…)`. FIX: use parameterized queries — FMDB `executeUpdate(sql, withArgumentsIn: [id])` with `?` placeholders, or GRDB `"… WHERE id = ?", arguments: [id]`.

RISK: writing a token/secret/key to a plain file on disk (even under ~/.sigmashake) leaves it world-readable to any process running as the user and to backups (CWE-312/CWE-922). Reading a daemon-written token file is fine; persisting an app-owned credential to a flat file is not. FIX: store app-owned secrets in the Keychain (`SecItemAdd`, `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`); if a file is unavoidable, create it with mode 0600 via `FileManager` attributes.

RISK: `try!` crashes the app if the expression throws — e.g. `try! JSONSerialization`/`try! Data(contentsOf:)` traps on any malformed input an attacker can supply. FIX: use `try?` to get nil on failure, or a `do { try … } catch { … }` block that logs and degrades gracefully.

RISK: serving the Sparkle appcast over plain `http://` lets a network attacker rewrite the feed to point at a malicious bundle; even with EdDSA this strips the transport defense-in-depth and downgrades update discovery (CWE-319, Sparkle CVE-2014-1816 class). FIX: use an `https://` appcast URL (the shipping feed is `https://download.sigmashake.com/desktop/swift/appcast.xml`) and keep `SUPublicEDKey` set.

RISK: an in-app updater that downloads and installs a new bundle WITHOUT first verifying an EdDSA/Ed25519 signature, code signature, or pinned checksum is a remote-code-execution supply-chain hole (CWE-494) — a MITM or compromised CDN ships a trojaned `.app` and you swap it in. The Sparkle path (`SUPublicEDKey` + `didFindValidUpdate`) is verified-before-apply; a hand-rolled install must NOT skip it. FIX: gate every install behind Sparkle's EdDSA check or `SecStaticCodeCheckValidity` on the downloaded bundle and a SHA-256 compare against a signed appcast.

RISK: `loadFileURL(_:allowingReadAccessTo:)` granted a broad root — "/", the home dir, Documents or Library — lets the loaded page read every file in that subtree via file:// (CWE-22). The setup/wizard views only need their own asset folder. FIX: scope `allowingReadAccessTo` to the single bundled view directory (`Resources.viewDir("wizard")`), never a parent of the user's data.

RISK: setting the private `allowFileAccessFromFileURLs` / `allowUniversalAccessFromFileURLs` preference lets JavaScript in a file:// document (the bundled setup/wizard views) read ANY local file via XHR/fetch and reach across origins (CWE-200/CWE-829) — one injected script exfiltrates ~/.sigmashake/dashboard.token and the user's whole home dir. FIX: never enable these; pass data into the view over the WKScriptMessageHandler RPC bridge instead of widening the file origin.

RISK: explicitly forcing JavaScript on (`WKWebpagePreferences.allowsContentJavaScript`/the deprecated `WKPreferences.javaScriptEnabled`) for a webview that can navigate to remote URLs gives any loaded page script execution in the app's webview, the entry point for XSS-to-native pivots through your message handlers (CWE-79). FIX: leave JS at its default and gate per-navigation in `decidePolicyFor`, allowing script only for trusted local/loopback origins you control.

RISK: a WKWebView loading a non-loopback `http://` origin transmits the page (and any token appended to the query) in cleartext, exposed to network MITM (CWE-319). The dashboard is loopback-only (`http://127.0.0.1:<port>`) which is safe; an external host is not. FIX: use `https://` for any non-loopback origin and keep dashboard navigation pinned to `127.0.0.1`.

RISK: loading a remote http(s) URL into a privileged local context — via `loadFileURL` or `loadHTMLString(baseURL:)` with a remote/file base — fuses untrusted web content with a local origin that the RPC bridge trusts, so remote JS gains the bridge's native capabilities (CWE-829/CWE-668). FIX: load the local-asset views with a file:// URL and the dashboard over `http://127.0.0.1:<port>` in a SEPARATE bridge-less webview (as WindowManager.showMain does); never mix the two origins.

ADVISORY: `preferences.setValue(_, forKey:)` is private-KVC poking at undocumented WebKit flags (e.g. `developerExtrasEnabled`). It is a known escape hatch but every key string is unaudited surface — a typo'd or copy-pasted key (allowFileAccessFromFileURLs) silently widens the sandbox, and Apple can rename/remove keys between OS releases. FIX: prefer the public `WKPreferences`/`WKWebpagePreferences` API; if KVC is unavoidable, keep the key allowlist tiny and comment why each is safe.