Port MASTG-TEST-0056 to v2: Determining Whether Sensitive Data Is Exposed via IPC Mechanisms (ios) by Copilot · Pull Request #3793 · OWASP/mastg

Copilot · 2026-05-09T19:11:01Z

This PR no longer introduces a new MASTG v2 test for iOS IPC. Based on review feedback, the previous draft test coverage was considered insufficient, so the scope was adjusted to focus on theory and best-practice guidance for iOS IPC, while deferring new v2 tests to follow-up work for specific IPC mechanisms.

No new v2 test added
- The previously drafted tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0x56.md was removed.
No new demo added
- The previously drafted demos/ios/MASVS-PLATFORM/MASTG-DEMO-0x56/ content was removed.
Theory and guidance coverage retained/expanded
- IPC background is covered through the iOS IPC knowledge pages (including existing and newly added IPC-focused knowledge content in this branch).
- Best-practice guidance is provided in best-practices/MASTG-BEST-0x56.md, with cross-links aligned to current knowledge entries and without linking to removed draft test IDs.
v1 deprecation update (tests/ios/MASVS-PLATFORM/MASTG-TEST-0056.md)
- Keeps the test deprecated and updates deprecation metadata to reflect the current status:
  - status: deprecated
  - covered_by: []
  - deprecation_note explains that existing content was insufficient for direct porting and that new focused MASTG v2 tests will be created later for relevant IPC parts.

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

cpholguera · 2026-05-09T19:31:34Z

@copilot Ensure you followed the relevant instructions in .gitHub/instructions for porting and creation (for example you didn't use fake IDs and you didn't deprecate the old test)

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/7d67b6c0-ad75-4101-927a-a1b9cff4f144 Co-authored-by: cpholguera <[email protected]>

Copilot · 2026-05-09T19:34:15Z

@copilot Ensure you followed the relevant instructions in .gitHub/instructions for porting and creation (for example you didn't use fake IDs and you didn't deprecate the old test)

Addressed in commit 6f54d9c.

I switched all newly added porting artifacts to fake IDs (MASTG-TEST-0x56, MASTG-DEMO-0x56, MASTG-KNOW-0x56, MASTG-BEST-0x56) and updated cross-references accordingly. I also deprecated the v1 test at tests/ios/MASVS-PLATFORM/MASTG-TEST-0056.md with status: deprecated, covered_by: [MASTG-TEST-0x56], and deprecation_note.

No UI changes were made in this PR, so no screenshot applies.

…n Place in iOS

…OW-0x01

…ences, clarifying data handling guidelines, and adding new sections on validating incoming IPC data and securing document exchange flows.

…entation and focus on updated best practices.

… status and future plans

cpholguera · 2026-05-10T10:30:08Z

@copilot Check the latest changes in their PR and update the description. For now, we're not going to create new tests since they were insufficient. Instead, we will cover the relevant theory and best practices, and create new tests for the relevant parts in MASTG v2.

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/9622f0ad-fd6f-4a03-8586-38934b8aaef2 Co-authored-by: cpholguera <[email protected]>

Copilot · 2026-05-10T10:32:41Z

@copilot Check the latest changes in their PR and update the description. For now, we're not going to create new tests since they were insufficient. Instead, we will cover the relevant theory and best...

Updated to match the latest PR scope.

The branch now reflects documentation-first coverage (theory + best practices) and no new v2 test/demo for this item right now. I also aligned best-practices/MASTG-BEST-0x56.md to remove links to removed draft IDs in commit 0ae961b.

No UI changes were made, so no screenshot applies.

ab-rizk · 2026-05-17T11:25:24Z

+iOS does not provide a general-purpose mechanism for arbitrary third-party apps to communicate directly. Instead, apps exchange data through platform-mediated channels, user actions, shared entitlements, or network interfaces.

-In contrast to Android's rich Inter-Process Communication (IPC) capability, iOS offers some rather limited options for communication between apps. In fact, there's no way for apps to communicate directly. In this section we will present the different types of indirect communication offered by iOS and how to test them. Here's an overview:
+Each [IPC mechanism](https://developer.apple.com/forums/tags/inter-process-communication) can be characterized by who can send data, who can receive data, whether user interaction is required, how long the data remains available, and whether the channel is restricted by an entitlement or app group.


nit: You might wanna remove this link IMHO, it links to Apple's forums with the IPC tag which is not very active.

ab-rizk · 2026-05-17T11:26:26Z

 ---

-During implementation of a mobile application, developers may apply traditional techniques for IPC (such as using shared files or network sockets). The IPC system functionality offered by mobile application platforms should be used because it is much more mature than traditional techniques. Using IPC mechanisms with no security in mind may cause the application to leak or expose sensitive data.
+iOS does not provide a general-purpose mechanism for arbitrary third-party apps to communicate directly. Instead, apps exchange data through platform-mediated channels, user actions, shared entitlements, or network interfaces.


Suggested change

iOS does not provide a general-purpose mechanism for arbitrary third-party apps to communicate directly. Instead, apps exchange data through platform-mediated channels, user actions, shared entitlements, or network interfaces.

iOS does not provide a general-purpose mechanism for third-party apps to communicate directly. Instead, apps exchange data through platform-mediated interfaces of varying levels of abstraction.

ab-rizk · 2026-05-17T16:07:09Z

+knowledge: [MASTG-KNOW-0083, MASTG-KNOW-0079, MASTG-KNOW-0080, MASTG-KNOW-0081, MASTG-KNOW-0082, MASTG-KNOW-0x01, MASTG-KNOW-0x02, MASTG-KNOW-0x03, MASTG-KNOW-0x04, MASTG-KNOW-0x05, MASTG-KNOW-0x06, MASTG-KNOW-0x07, MASTG-KNOW-0x08, MASTG-KNOW-0104]
+---
+
+When your app exchanges data across iOS IPC channels, share the minimum amount of data for the shortest time possible. Design these flows so that intercepted, persisted, logged, indexed, donated, or forwarded payloads are low value and short lived.


nit: Maybe you wanna mention least privilege and input sanitization/validation here?

ab-rizk · 2026-05-17T16:09:56Z

+knowledge: [MASTG-KNOW-0083, MASTG-KNOW-0079, MASTG-KNOW-0080, MASTG-KNOW-0081, MASTG-KNOW-0082, MASTG-KNOW-0x01, MASTG-KNOW-0x02, MASTG-KNOW-0x03, MASTG-KNOW-0x04, MASTG-KNOW-0x05, MASTG-KNOW-0x06, MASTG-KNOW-0x07, MASTG-KNOW-0x08, MASTG-KNOW-0104]
+---
+
+When your app exchanges data across iOS IPC channels, share the minimum amount of data for the shortest time possible. Design these flows so that intercepted, persisted, logged, indexed, donated, or forwarded payloads are low value and short lived.


Suggested change

When your app exchanges data across iOS IPC channels, share the minimum amount of data for the shortest time possible. Design these flows so that intercepted, persisted, logged, indexed, donated, or forwarded payloads are low value and short lived.

When your app exchanges data across iOS IPC channels, share the minimum amount of data for the shortest time possible. Design these flows so that intercepted payloads are low value and short lived.

ab-rizk · 2026-05-17T16:29:48Z

+
+## Avoid Unsupported Low-Level IPC
+
+Do not use low-level mechanisms such as XPC, Mach ports, or CFMessagePort as general-purpose app-to-app IPC channels for unrelated third-party iOS apps. Prefer Apple-supported system-mediated APIs, App Groups, Keychain access groups, document exchange, App Intents, Siri Shortcuts, Handoff, or network protocols where appropriate.


As you mention below, XPC is not usable for app-to-app communication anyway but the opposite is implied in:

Do not use low-level mechanisms such as XPC, Mach ports, or CFMessagePort as general-purpose app-to-app IPC channels for unrelated third-party iOS apps.

ab-rizk · 2026-05-17T16:33:24Z

+
+Any app or extension in the App Group can potentially read or modify shared data, so avoid storing secrets, session tokens, or high-value personal data unless strictly necessary.
+
+## Limit Shared Keychain Access


You might wanna mention not storing overly sensitive data like (hashed) passwords since jailbroken devices can read the keychain of any process.

ab-rizk · 2026-05-17T17:01:23Z

+
+## Prefer Short-Lived Exchange Data
+
+For URL-based handoff, such as [custom URL schemes](https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app) and [Universal Links](https://developer.apple.com/documentation/xcode/supporting-universal-links-in-your-app), avoid embedding long-lived secrets, tokens, credentials, or personal data in URLs. Use one-time or short-lived references and have the receiving side redeem them through an authenticated channel.


Suggested change

For URL-based handoff, such as [custom URL schemes](https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app) and [Universal Links](https://developer.apple.com/documentation/xcode/supporting-universal-links-in-your-app), avoid embedding long-lived secrets, tokens, credentials, or personal data in URLs. Use one-time or short-lived references and have the receiving side redeem them through an authenticated channel.

For URL-based interfaces, such as [custom URL schemes](https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app) and [Universal Links](https://developer.apple.com/documentation/xcode/supporting-universal-links-in-your-app), avoid embedding long-lived secrets, tokens, credentials, or personal data in URLs. Use one-time or short-lived references and have the receiving side redeem them through an authenticated channel.

ab-rizk · 2026-05-17T17:01:41Z

+
+Apply the same pattern to Handoff, Siri Shortcuts, App Intents, shared files, and document exchange flows. Pass references, identifiers, or scoped URLs instead of full sensitive payloads whenever possible.
+
+## Validate All Incoming IPC Data


Suggested change

## Validate All Incoming IPC Data

## Validate All IPC Input

ab-rizk · 2026-05-17T17:05:48Z

+- Peer-to-peer communication between iOS devices on the same local network.
+- Integration with network-accessible devices, such as printers, media players, or IoT hardware.
+
+## APIs


Do you wanna mention BLE and NFC here? Since they're also network-based

Initial plan

8148a52

Copilot AI assigned Copilot and cpholguera May 9, 2026

Copilot AI linked an issue May 9, 2026 that may be closed by this pull request

MASTG v1->v2 MASTG-TEST-0056: Determining Whether Sensitive Data Is Exposed via IPC Mechanisms (ios) #2963

Open

Copilot started work on behalf of cpholguera May 9, 2026 19:11 View session

Copilot AI and others added 10 commits May 9, 2026 19:16

Add iOS v2 IPC exposure test, demo, knowledge, and best practice

bf24fc3

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Remove temporary duplicate-check artifact from repo

69ce152

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Address review feedback on test metadata and demo script readability

4fce2ea

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Refine demo pattern grouping and best-practice actionability

d29176d

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Tighten demo API pattern matching and normalize file endings

296a55b

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Fix pasteboard regex grouping in demo run script

9289e5b

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Harden demo run script and refine IPC best-practice wording

f5769a5

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Simplify regex escaping in demo run script

ff22d2d

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Handle grep exit paths explicitly in IPC demo script

a5d753e

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Improve grep error handling and output normalization in demo script

2781901

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/4365f6e1-bd68-452f-b7c3-696d243b8004 Co-authored-by: cpholguera <[email protected]>

Copilot AI changed the title ~~[WIP] Create MASTG v2 test for sensitive data exposure via IPC mechanisms~~ Port MASTG-TEST-0056 to v2 for iOS IPC sensitive-data exposure, with linked demo/knowledge/best-practice content May 9, 2026

Copilot AI requested a review from cpholguera May 9, 2026 19:23

Copilot finished work on behalf of cpholguera May 9, 2026 19:23

Copilot started work on behalf of cpholguera May 9, 2026 19:31 View session

Use fake IDs for new IPC porting content and deprecate v1 test

6f54d9c

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/7d67b6c0-ad75-4101-927a-a1b9cff4f144 Co-authored-by: cpholguera <[email protected]>

Copilot finished work on behalf of cpholguera May 9, 2026 19:34

cpholguera changed the title ~~Port MASTG-TEST-0056 to v2 for iOS IPC sensitive-data exposure, with linked demo/knowledge/best-practice content~~ Port MASTG-TEST-0056 to v2: Determining Whether Sensitive Data Is Exposed via IPC Mechanisms (ios) May 10, 2026

cpholguera added 6 commits May 10, 2026 09:53

first content draft for IPC

7577345

move 104

b533261

improve Low-Level System IPC Mechanisms

be82f6c

Improve article for Document Picker, Document Interaction, and Open i…

6da54a1

…n Place in iOS

Update File Coordination APIs

0d29678

minor update

328d4e9

cpholguera added 11 commits May 10, 2026 11:58

Update handoff

afde4a2

Add documentation for SiriKit and App Intents frameworks

8bbceaf

Add documentation for App Groups in iOS

a2cbd10

Refactor documentation for File Coordination APIs

f96d2bb

Add documentation for Keychain Access Groups in iOS

558e688

Add documentation for Bonjour networking in iOS

0c3f301

Update knowledge references in MASTG-TEST-0303.md to include MASTG-KN…

d0e0151

…OW-0x01

Refactor IPC documentation for clarity and consistency

1b2ccbd

Enhance IPC best practices documentation by expanding knowledge refer…

d88b90c

…ences, clarifying data handling guidelines, and adding new sections on validating incoming IPC data and securing document exchange flows.

Remove deprecated IPC test and related demo files to streamline docum…

5f117a6

…entation and focus on updated best practices.

Update deprecation note in MASTG-TEST-0056.md for clarity on IPC test…

7a60f4d

… status and future plans

Copilot started work on behalf of cpholguera May 10, 2026 10:30 View session

Align IPC best-practice links with no-new-test scope

0ae961b

Agent-Logs-Url: https://github.com/OWASP/mastg/sessions/9622f0ad-fd6f-4a03-8586-38934b8aaef2 Co-authored-by: cpholguera <[email protected]>

Copilot AI changed the title ~~Port MASTG-TEST-0056 to v2: Determining Whether Sensitive Data Is Exposed via IPC Mechanisms (ios)~~ iOS IPC: focus on theory and best practices, deprecate MASTG-TEST-0056 pending new v2 tests May 10, 2026

Copilot finished work on behalf of cpholguera May 10, 2026 10:33

cpholguera requested review from ab-rizk and removed request for cpholguera May 10, 2026 12:22

cpholguera changed the title ~~iOS IPC: focus on theory and best practices, deprecate MASTG-TEST-0056 pending new v2 tests~~ Port MASTG-TEST-0056 to v2: Determining Whether Sensitive Data Is Exposed via IPC Mechanisms (ios) May 10, 2026

cpholguera marked this pull request as ready for review May 10, 2026 16:22

ab-rizk reviewed May 17, 2026

View reviewed changes

	iOS does not provide a general-purpose mechanism for arbitrary third-party apps to communicate directly. Instead, apps exchange data through platform-mediated channels, user actions, shared entitlements, or network interfaces.
	iOS does not provide a general-purpose mechanism for third-party apps to communicate directly. Instead, apps exchange data through platform-mediated interfaces of varying levels of abstraction.

	When your app exchanges data across iOS IPC channels, share the minimum amount of data for the shortest time possible. Design these flows so that intercepted, persisted, logged, indexed, donated, or forwarded payloads are low value and short lived.
	When your app exchanges data across iOS IPC channels, share the minimum amount of data for the shortest time possible. Design these flows so that intercepted payloads are low value and short lived.


		## Avoid Unsupported Low-Level IPC

		Do not use low-level mechanisms such as XPC, Mach ports, or CFMessagePort as general-purpose app-to-app IPC channels for unrelated third-party iOS apps. Prefer Apple-supported system-mediated APIs, App Groups, Keychain access groups, document exchange, App Intents, Siri Shortcuts, Handoff, or network protocols where appropriate.


		Any app or extension in the App Group can potentially read or modify shared data, so avoid storing secrets, session tokens, or high-value personal data unless strictly necessary.

		## Limit Shared Keychain Access


		## Prefer Short-Lived Exchange Data

		For URL-based handoff, such as [custom URL schemes](https://developer.apple.com/documentation/xcode/defining-a-custom-url-scheme-for-your-app) and [Universal Links](https://developer.apple.com/documentation/xcode/supporting-universal-links-in-your-app), avoid embedding long-lived secrets, tokens, credentials, or personal data in URLs. Use one-time or short-lived references and have the receiving side redeem them through an authenticated channel.


		Apply the same pattern to Handoff, Siri Shortcuts, App Intents, shared files, and document exchange flows. Pass references, identifiers, or scoped URLs instead of full sensitive payloads whenever possible.

		## Validate All Incoming IPC Data

Uh oh!

Conversation

Copilot AI commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cpholguera commented May 9, 2026

Uh oh!

Copilot AI commented May 9, 2026

Uh oh!

cpholguera commented May 10, 2026

Uh oh!

Copilot AI commented May 10, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 9, 2026 •

edited

Loading