General Pasteboard Access

import UIKit

class PasteboardManager {
    // VULNERABLE: Accessing general pasteboard exposes data to all apps
    func pasteText_vulnerable1() -> String? {
        let pasteboard = UIPasteboard.general  // FLAW
        return pasteboard.string
    }

    // VULNERABLE: Reading clipboard content without user awareness
    func checkClipboard_vulnerable2() {
        if let clipboardText = UIPasteboard.general.string {  // FLAW
            print("Clipboard contains: \(clipboardText)")
            // This could be logging/exfiltrating user's sensitive data
        }
    }

    // VULNERABLE: Copying sensitive data to general pasteboard
    func copyPassword_vulnerable3(password: String) {
        UIPasteboard.general.string = password  // FLAW
        // Password is now accessible to all apps
    }

    // VULNERABLE: Monitoring clipboard for changes
    func monitorClipboard_vulnerable4() {
        NotificationCenter.default.addObserver(
            self,
            selector: #selector(pasteboardChanged),
            name: UIPasteboard.changedNotification,
            object: UIPasteboard.general  // FLAW
        )
    }

    @objc func pasteboardChanged() {
        // Background app can silently monitor all clipboard changes
        if let text = UIPasteboard.general.string {  // FLAW
            // Potential data exfiltration
            sendToServer(text)
        }
    }

    private func sendToServer(_ data: String) {
        // Send data to external server
    }
}

// VULNERABLE: Auto-paste feature reading clipboard
class AutoPasteViewController: UIViewController {
    override func viewDidAppear(_ animated: Bool) {
        super.viewDidAppear(animated)

        // VULNERABLE: Automatically reading clipboard when view appears
        if let clipboardURL = UIPasteboard.general.url {  // FLAW
            // Opening URLs from clipboard without user confirmation
            openURL(clipboardURL)
        }
    }

    private func openURL(_ url: URL) {
        UIApplication.shared.open(url)
    }
}

// Malicious app code running in background
class MaliciousClipboardMonitor {
    init() {
        // Register for clipboard changes
        NotificationCenter.default.addObserver(
            self,
            selector: #selector(stealClipboardData),
            name: UIPasteboard.changedNotification,
            object: UIPasteboard.general
        )
    }

    @objc func stealClipboardData() {
        // User copies password from password manager
        if let password = UIPasteboard.general.string {
            // Silently exfiltrate to attacker's server
            sendToAttackerServer(password)
        }
    }
}

// Attacker's app
if let code = UIPasteboard.general.string {
    if code.count == 6 && code.allSatisfy({ $0.isNumber }) {
        // Detected 2FA code, exfiltrate immediately
        exfiltrate2FACode(code)
    }
}

// Compromised app's telemetry code
func collectDiagnostics() {
    var diagnostics = ["version": appVersion]

    // "Accidentally" include clipboard content in diagnostics
    if let clipboard = UIPasteboard.general.string {
        diagnostics["clipboard"] = clipboard  // API keys, passwords leaked
    }

    sendTelemetry(diagnostics)  // Sent to analytics server
}

import UIKit

class SecurePasteboardManager {
    // SECURE: Create app-specific, non-persistent pasteboard
    private static let privatePasteboard = UIPasteboard.withName(
        UIPasteboard.Name("com.example.app.private"),
        create: true
    )!

    static func setupPasteboard() {
        // Make pasteboard non-persistent (cleared when app terminates)
        privatePasteboard.isPersistent = false
    }

    // SECURE: Copy to private pasteboard only
    func copyText_secure1(_ text: String) {
        Self.privatePasteboard.string = text
        print("Text copied to private pasteboard (not accessible to other apps)")
    }

    // SECURE: Read from private pasteboard
    func pasteText_secure2() -> String? {
        return Self.privatePasteboard.string
    }

    // SECURE: Clear pasteboard after use
    func clearPasteboard_secure3() {
        Self.privatePasteboard.items = []
    }
}

// SECURE: Avoid clipboard for sensitive data entirely
class SecurePasswordManager {
    // SECURE: Use secure input methods instead of clipboard
    func copyPassword_secure4(password: String) {
        // DON'T copy passwords to any pasteboard
        // Instead: use password autofill, biometric authentication, or secure sharing
        print("❌ Not copying password to clipboard for security reasons")

        // Alternative: Use iOS Password AutoFill
        // Users can access passwords without clipboard exposure
    }

    // SECURE: Direct data transfer between screens
    func transferData_secure5(data: SensitiveData, to viewController: UIViewController) {
        // Pass data directly via properties, not clipboard
        if let targetVC = viewController as? DestinationViewController {
            targetVC.receivedData = data
        }
    }
}

// SECURE: Conditional pasteboard access with user awareness
class ConditionalPasteManager {
    func pasteWithUserConsent_secure6() {
        // Show alert asking user permission first
        let alert = UIAlertController(
            title: "Paste Content?",
            message: "Do you want to paste clipboard content?",
            preferredStyle: .alert
        )

        alert.addAction(UIAlertAction(title: "Paste", style: .default) { _ in
            // Only access clipboard after explicit user consent
            if let text = UIPasteboard.general.string {
                self.processText(text)
            }
        })

        alert.addAction(UIAlertAction(title: "Cancel", style: .cancel))

        // Present alert to user
        // (requires view controller context)
    }

    private func processText(_ text: String) {
        // Process pasted text
    }
}

// SECURE: Use iOS 14+ UIPasteboard detection APIs
@available(iOS 14.0, *)
class iOS14PasteboardDetection {
    func checkPasteboardAvailability_secure7() {
        // iOS 14+ provides methods to check clipboard without reading content
        if UIPasteboard.general.hasStrings {
            // Clipboard has strings, but we haven't read them yet
            print("Clipboard contains text (not read)")
        }

        if UIPasteboard.general.hasURLs {
            print("Clipboard contains URLs (not read)")
        }

        // Only read after user action (e.g., tapping paste button)
    }
}

// BAD
UIPasteboard.general.string = userPassword

// GOOD
// Don't use pasteboard for passwords at all
// Use iOS Password AutoFill or biometric authentication

// Create app-private pasteboard
let privatePasteboard = UIPasteboard.withName(
    UIPasteboard.Name("com.example.app.private"),
    create: true
)!
privatePasteboard.isPersistent = false

// Use and clear
privatePasteboard.string = temporaryData
processData()
privatePasteboard.items = []  // Clear immediately

// Instead of clipboard for inter-screen data transfer
class DataTransfer {
    var sharedData: Data?  // Direct property

    func passData(to destination: ViewController) {
        destination.receivedData = self.sharedData
    }
}

@available(iOS 14.0, *)
func detectClipboardAccess() {
    // Check type without reading content
    if UIPasteboard.general.hasStrings {
        // Ask user if they want to paste
        showPasteConfirmation()
    }
}