89 lines
5.1 KiB
TypeScript
89 lines
5.1 KiB
TypeScript
// Local scan of an iOS project for Apple's privacy manifest rules (no network, no credentials, no config needed).
|
|
// storebound privacy-manifest --ios ios/App [--sdk-dirs node_modules/@capacitor,node_modules/some-plugin] [--json]
|
|
// Reports: the app's PrivacyInfo.xcprivacy, required-reason API categories used in app sources vs declared, tracking
|
|
// flag vs the ATT usage string, and every SDK (CocoaPods, .xcframework / .framework, SwiftPM checkouts, local SwiftPM
|
|
// packages, the native plugins of a Capacitor / Cordova / React Native app found through node_modules and workspaces
|
|
// the way Node resolves them, so a monorepo's apps/native/node_modules works without flags, and --sdk-dirs)
|
|
// without its own manifest. Heuristic text scan: it can miss uses inside binaries and flag harmless matches.
|
|
import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
|
|
import { basename, join, relative, resolve } from 'node:path';
|
|
import type { Args } from './lib/args';
|
|
import { log } from './lib/log';
|
|
import { nativeIosPlugins } from './lib/node-packages';
|
|
import { evaluatePrivacyManifest, type Manifest, parseManifest, scanSources, type SdkInfo } from './lib/privacy-manifest';
|
|
|
|
const SKIP = new Set(['.git', 'build', 'DerivedData', 'node_modules', '.build', 'xcuserdata']);
|
|
const SRC = /\.(swift|m|mm|c|cc|cpp|h|hpp)$/;
|
|
const POD_META = new Set(['Target Support Files', 'Headers', 'Local Podspecs', 'Pods.xcodeproj', 'Manifest.lock']);
|
|
|
|
function walk(dir: string, visit: (p: string, isDir: boolean) => boolean | void, depth = 0): void {
|
|
if (depth > 14) return;
|
|
let names: string[] = [];
|
|
try { names = readdirSync(dir); } catch { return; }
|
|
for (const n of names) {
|
|
if (SKIP.has(n)) continue;
|
|
const p = join(dir, n);
|
|
let st;
|
|
try { st = statSync(p); } catch { continue; }
|
|
const descend = visit(p, st.isDirectory());
|
|
if (st.isDirectory() && descend !== false) walk(p, visit, depth + 1);
|
|
}
|
|
}
|
|
|
|
function hasManifest(dir: string): boolean {
|
|
let found = false;
|
|
walk(dir, p => { if (basename(p) === 'PrivacyInfo.xcprivacy') found = true; return !found; });
|
|
return found;
|
|
}
|
|
|
|
export async function run(args: Args): Promise<void> {
|
|
const ios = args.get('ios');
|
|
if (!ios) throw new Error('usage: privacy-manifest --ios <path to the iOS project folder, e.g. ios/App> [--sdk-dirs a,b] [--json]');
|
|
const root = resolve(ios);
|
|
if (!existsSync(root)) throw new Error(`${root} does not exist`);
|
|
const sdks: SdkInfo[] = [];
|
|
const sdkRoots = new Set<string>();
|
|
const seen = new Set<string>();
|
|
const addSdk = (p: string, name?: string) => {
|
|
let key = p;
|
|
try { key = realpathSync(p); } catch { /* keep p */ }
|
|
if (seen.has(key)) return;
|
|
seen.add(key); sdkRoots.add(p);
|
|
sdks.push({ name: name ?? basename(p).replace(/\.(xc)?framework$/, ''), path: relative(process.cwd(), p), hasManifest: hasManifest(p) });
|
|
};
|
|
const addPods = (dir: string) => { for (const n of readdirSync(dir)) if (!POD_META.has(n) && statSync(join(dir, n)).isDirectory()) addSdk(join(dir, n)); };
|
|
|
|
const pods = join(root, 'Pods');
|
|
if (existsSync(pods)) addPods(pods);
|
|
// Capacitor / Cordova / React Native plugins: node_modules next to the app's package.json and above it, workspace
|
|
// packages, local SwiftPM packages (CapApp-SPM)
|
|
for (const pl of nativeIosPlugins(root)) addSdk(pl.dir, pl.name);
|
|
for (const extra of args.list('sdk-dirs')) {
|
|
const d = resolve(extra);
|
|
if (!existsSync(d)) continue;
|
|
const kids = readdirSync(d).filter(n => statSync(join(d, n)).isDirectory());
|
|
if (kids.some(k => k === 'ios' || k === 'src')) addSdk(d); else for (const k of kids) addSdk(join(d, k));
|
|
}
|
|
const manifests: string[] = [];
|
|
const sources: { path: string; text: string }[] = [];
|
|
let infoPlist = '';
|
|
walk(root, (p, isDir) => {
|
|
if ([...sdkRoots].some(s => p.startsWith(s + '/') || p === s)) return false;
|
|
if (isDir) {
|
|
if (/\.(xc)?framework$/.test(p)) { addSdk(p); return false; }
|
|
if (basename(p) === 'Pods') { addPods(p); return false; }
|
|
if (basename(p) === 'checkouts' && p.includes('SourcePackages')) { for (const n of readdirSync(p)) addSdk(join(p, n)); return false; }
|
|
return true;
|
|
}
|
|
const n = basename(p);
|
|
if (n === 'PrivacyInfo.xcprivacy') manifests.push(p);
|
|
else if (n === 'Info.plist' && !infoPlist && !/Tests?\//.test(p)) infoPlist = readFileSync(p, 'utf8');
|
|
else if (SRC.test(n) && statSync(p).size < 2_000_000) sources.push({ path: relative(process.cwd(), p), text: readFileSync(p, 'utf8') });
|
|
});
|
|
const appManifest: Manifest | null = manifests[0] ? parseManifest(relative(process.cwd(), manifests[0]), readFileSync(manifests[0], 'utf8')) : null;
|
|
log('privacy', `${sources.length} source files, ${sdks.length} SDKs, ${manifests.length} app manifest(s)`);
|
|
const findings = evaluatePrivacyManifest({ appManifest, sourceHits: scanSources(sources), sdks, asksTracking: /NSUserTrackingUsageDescription/.test(infoPlist) });
|
|
if (args.has('json')) console.log(JSON.stringify({ appManifest, sdks, findings }, null, 2));
|
|
else for (const f of findings) console.log(`${f.level.toUpperCase().padEnd(7)} ${f.msg}`);
|
|
if (findings.some(f => f.level === 'blocker')) process.exitCode = 1;
|
|
}
|