...
private bool CertificateCheck(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
...
return true;
}
...
HttpWebRequest webRequest = (HttpWebRequest) WebRequest.Create("https://www.myTrustedSite.com");
webRequest.ServerCertificateValidationCallback = CertificateCheck;
WebResponse response = webRequest.GetResponse();
...
...
SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, verify_callback);
...
...
config := &tls.Config{
// Set InsecureSkipVerify to skip the default validation
InsecureSkipVerify: true,
...
}
conn, err := tls.Dial("tcp", "example.com:443", conf)
..
...
Email email = new SimpleEmail();
email.setHostName("smtp.servermail.com");
email.setSmtpPort(465);
email.setAuthenticator(new DefaultAuthenticator(username, password));
email.setSSLOnConnect(true);
email.setFrom("user@gmail.com");
email.setSubject("TestMail");
email.setMsg("This is a test mail ... :-)");
email.addTo("foo@bar.com");
email.send();
...
smtp.mailserver.com:465 时，此应用程序会随时接受颁发给“hackedserver.com”的证书。此时，当服务器被黑客攻击发生 SSL 连接中断时，应用程序可能会泄漏用户敏感信息。
...
var options = {
key : fs.readFileSync('my-server-key.pem'),
cert : fs.readFileSync('server-cert.pem'),
requestCert: true,
...
}
https.createServer(options);
...
https.Server 对象时，requestCert 设置会指定为 true，但未设置 rejectUnauthorized，其默认设置为 false。这意味着尽管服务器是为了通过 SSL 验证客户端而创建，但即使未使用提供的 CA 列表对证书进行授权，也仍然会接受连接。
var tls = require('tls');
...
tls.connect({
host: 'https://www.hackersite.com',
port: '443',
...
rejectUnauthorized: false,
...
});
rejectUnauthorized 设置为 false，这意味着将接受未经授权的证书，并且仍然会与无法识别的服务器建立安全连接。此时，当服务器被黑客攻击发生 SSL 连接中断时，应用程序可能会泄漏用户敏感信息。NSURLConnectionDelegate 配置为接受任意 HTTPS 证书：
implementation NSURLRequest (IgnoreSSL)
+ (BOOL)allowsAnyHTTPSCertificateForHost:(NSString *)host
{
return YES;
}
@end
Example 1 中的 NSURLRequest 实现方式连接到受 SSL 保护的服务器时，如果所请求服务器的证书为自签名证书（进而未经验证），则不会出现警告或错误。因此，应用程序现在可能会通过断开的 SSL 连接泄漏敏感的用户信息。
...
import ssl
ssl_sock = ssl.wrap_socket(s)
...
require 'openssl'
...
ctx = OpenSSL::SSL::SSLContext.new
ctx.verify_mode=OpenSSL::SSL::VERIFY_NONE
...
NSURLConnectionDelegate 配置为接受任意 HTTPS 证书：
class Delegate: NSObject, NSURLConnectionDelegate {
...
func connection(connection: NSURLConnection, canAuthenticateAgainstProtectionSpace protectionSpace: NSURLProtectionSpace?) -> Bool {
return protectionSpace?.authenticationMethod == NSURLAuthenticationMethodServerTrust
}
func connection(connection: NSURLConnection, willSendRequestForAuthenticationChallenge challenge: NSURLAuthenticationChallenge) {
challenge.sender?.useCredential(NSURLCredential(forTrust: challenge.protectionSpace.serverTrust!), forAuthenticationChallenge: challenge)
challenge.sender?.continueWithoutCredentialForAuthenticationChallenge(challenge)
}
}
Example 1 中的 NSURLConnectionDelegate 实现方式连接到受 SSL 保护的服务器时，如果所请求服务器的证书为自签名证书（进而未经验证），则不会出现警告或错误。因此，应用程序现在可能会通过断开的 SSL 连接泄漏敏感的用户信息。NSURLSession 类中，SSL/TLS 链验证由您的应用程序的身份验证代理方法进行处理，但是您的应用程序并未向服务器提供用于验证用户或应用程序的凭据，而是检查服务器在 SSL/TLS 握手期间提供的凭据，然后告诉 URL 加载系统是应接受还是应拒绝这些凭据。以下代码显示的 NSURLSessionDelgate 直接将接收到的质询中的 proposedCredential 作为会话凭据传回，从而成功绕过了服务器验证：
class MySessionDelegate : NSObject, NSURLSessionDelegate {
...
func URLSession(session: NSURLSession, didReceiveChallenge challenge: NSURLAuthenticationChallenge, completionHandler: (NSURLSessionAuthChallengeDisposition, NSURLCredential?) -> Void) {
...
completionHandler(NSURLSessionAuthChallengeDisposition.UseCredential, challenge.proposedCredential)
...
}
...
}
allowBackup 属性设置为 true（默认值），并在 <application> 标签上定义 backupAgent 属性。Environment.getExternalStorageDirectory() 会返回对 Android 设备的外部存储的引用。 private void WriteToFile(String what_to_write) {
try{
File root = Environment.getExternalStorageDirectory();
if(root.canWrite()) {
File dir = new File(root + "write_to_the_SDcard");
File datafile = new File(dir, number + ".extension");
FileWriter datawriter = new FileWriter(datafile);
BufferedWriter out = new BufferedWriter(datawriter);
out.write(what_to_write);
out.close();
}
}
}
kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:kSecAttrAccessibleAlways:kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly:kSecAttrAccessibleAlwaysThisDeviceOnly:kSecAttrAccessibleWhenUnlocked:kSecAttrAccessibleWhenUnlockedThisDeviceOnly:ThisDeviceOnly，那么该项目将备份到 iCloud，并且即便在使用可恢复到任意设备的未加密备份的情况下仍然会备份到 iTunes。这可能会导致隐私问题，具体取决于所存储数据的敏感和私密程度。
...
NSMutableDictionary *dict = [NSMutableDictionary dictionary];
NSData *token = [@"secret" dataUsingEncoding:NSUTF8StringEncoding];
// Configure KeyChain Item
[dict setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id) kSecClass];
[dict setObject:token forKey:(__bridge id)kSecValueData];
...
[dict setObject:(__bridge id)kSecAttrAccessibleWhenUnlocked forKey:(__bridge id) kSecAttrAccessible];
OSStatus error = SecItemAdd((__bridge CFDictionaryRef)dict, NULL);
...
kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:kSecAttrAccessibleAlways:kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly:kSecAttrAccessibleAlwaysThisDeviceOnly:kSecAttrAccessibleWhenUnlocked:kSecAttrAccessibleWhenUnlockedThisDeviceOnly:ThisDeviceOnly，那么该项目将备份到 iCloud，并且即便在使用可恢复到任意设备的未加密备份的情况下仍然会备份到 iTunes。这可能会导致隐私问题，具体取决于所存储数据的敏感和私密程度。
...
// Configure KeyChain Item
let token = "secret"
var query = [String : AnyObject]()
query[kSecClass as String] = kSecClassGenericPassword
query[kSecValueData as String] = token as AnyObject?
...
query[kSecAttrAccessible as String] = kSecAttrAccessibleWhenUnlocked
SecItemAdd(query as CFDictionary, nil)
...
protected void onCreate(Bundle savedInstanceState) {
...
try {
File httpCacheDir = new File(context.getExternalCacheDir(), "http");
long httpCacheSize = 10 * 1024 * 1024; // 10 MiB
HttpResponseCache.install(httpCacheDir, httpCacheSize);
} catch (IOException e) {
Log.i(TAG, "HTTP response cache installation failed:" + e);
}
}
protected void onStop() {
...
HttpResponseCache cache = HttpResponseCache.getInstalled();
if (cache != null) {
cache.flush();
}
}
{app ID}/Library/Caches/com.mycompany.myapp/Cache.db* 文件中。{app ID}/Library/Caches/com.mycompany.myapp/Cache.db* 文件中。{app ID}/Library/Caches/com.mycompany.myapp/Cache.db* 文件中。 URLCache 类的 diskCapacity 或 memoryCapacity 属性设置为 0，就能成功禁用 HTTP(S) 响应缓存系统。但是，NSURLCache 文档指出，只有在设备的内存或磁盘空间不足的情况下，才会将磁盘和内存缓存缩减到配置的大小。这两项设置都是系统用来释放其资源以提高性能的，而非用于安全控制。{app ID}/Library/Caches/com.mycompany.myapp/Cache.db* 文件中。 URLCache 类的 diskCapacity 或 memoryCapacity 属性设置为 0，就能成功禁用 HTTP(S) 响应缓存系统。但是，NSURLCache 文档指出，只有在设备的内存或磁盘空间不足的情况下，才会将磁盘和内存缓存缩减到配置的大小。这两项设置都是系统用来释放其资源以提高性能的，而非用于安全控制。NSFileManager 的数据保护类会定义为常量，以便在与 NSFileManager 实例相关联的 NSDictionary 中指定为 NSFileProtectionKey 键的值，并可通过使用 NSFileManager 函数（包括 setAttributes:ofItemAtPath:error:、attributesOfItemAtPath:error: 和 createFileAtPath:contents:attributes:）创建文件或修改其数据保护类。此外，NSData 对象的相应数据保护常量会定义为 NSDataWritingOptions，并可将其作为 options 参数传递到 NSData 函数 writeToURL:options:error: 和 writeToFile:options:error:。NSFileManager 和 NSData 的各种数据保护类常量定义如下：NSFileProtectionComplete, NSDataWritingFileProtectionComplete:NSFileProtectionCompleteUnlessOpen, NSDataWritingFileProtectionCompleteUnlessOpen:NSFileProtectionCompleteUntilFirstUserAuthentication, NSDataWritingFileProtectionCompleteUntilFirstUserAuthentication:NSFileProtectionNone, NSDataWritingFileProtectionNone:NSFileProtectionCompleteUnlessOpen 或 NSFileProtectionCompleteUntilFirstUserAuthentication 标记一个文件，就会使用从用户密码或设备 UID 派生的密钥对其进行加密，但在某些情况下依然可以访问数据。因此，应该对 NSFileProtectionCompleteUnlessOpen 或 NSFileProtectionCompleteUntilFirstUserAuthentication 的用法进行仔细审核，以确定是否需要使用 NSFileProtectionComplete 执行进一步保护。例 2：以下例子中，给定的数据仅在用户首次打开设备和提供密码前受保护（直到下次重新引导）：
...
filepath = [self.GetDocumentDirectory stringByAppendingPathComponent:self.setFilename];
...
NSDictionary *protection = [NSDictionary dictionaryWithObject:NSFileProtectionCompleteUntilFirstUserAuthentication forKey:NSFileProtectionKey];
...
[[NSFileManager defaultManager] setAttributes:protection ofItemAtPath:filepath error:nil];
...
BOOL ok = [testToWrite writeToFile:filepath atomically:YES encoding:NSUnicodeStringEncoding error:&err];
...
...
filepath = [self.GetDocumentDirectory stringByAppendingPathComponent:self.setFilename];
...
NSData *textData = [textToWrite dataUsingEncoding:NSUnicodeStingEncoding];
...
BOOL ok = [textData writeToFile:filepath options:NSDataWritingFileProtectionCompleteUntilFirstUserAuthentication error:&err];
...
NSFileManager 中定义为常量，以便在与 NSFileManager 实例相关联的 Dictionary 中指定为 NSFileProtectionKey 密钥的值，而且通过使用 NSFileManager 函数（包括 setAttributes(_:ofItemAtPath:)、attributesOfItemAtPath(_:) 和 createFileAtPath(_:contents:attributes:)），可以创建文件或者修改其数据保护级别。此外，已在 NSDataWritingOptions 枚举中定义了 NSData 对象的相应数据保护常量，它可以作为 options 参数传递到 NSData 函数（
writeToFile(_:options:)NSFileManager 和 NSData 的各种数据保护类常量定义如下：NSFileProtectionComplete, NSDataWritingOptions.DataWritingFileProtectionComplete:NSFileProtectionCompleteUnlessOpen, NSDataWritingOptions.DataWritingFileProtectionCompleteUnlessOpen:NSFileProtectionCompleteUntilFirstUserAuthentication, NSDataWritingOptions.DataWritingFileProtectionCompleteUntilFirstUserAuthentication:NSFileProtectionNone, NSDataWritingOptions.DataWritingFileProtectionNone:NSFileProtectionCompleteUnlessOpen 或 NSFileProtectionCompleteUntilFirstUserAuthentication 标记一个文件，就会使用从用户密码或设备 UID 派生的密钥对其进行加密，但在某些情况下依然可以访问数据。因此，应该对 NSFileProtectionCompleteUnlessOpen 或 NSFileProtectionCompleteUntilFirstUserAuthentication 的用法进行仔细审核，以确定是否需要使用 NSFileProtectionComplete 执行进一步保护。示例 2：在以下示例中，给定数据仅在用户首次打开设备和提供密码前受保护（直到下次重新引导）：
...
let documentsPath = NSURL(fileURLWithPath: NSSearchPathForDirectoriesInDomains(.DocumentDirectory, .UserDomainMask, true)[0])
let filename = "\(documentsPath)/tmp_activeTrans.txt"
let protection = [NSFileProtectionKey: NSFileProtectionCompleteUntilFirstUserAuthentication]
do {
try NSFileManager.defaultManager().setAttributes(protection, ofItemAtPath: filename)
} catch let error as NSError {
NSLog("Unable to change attributes: \(error.debugDescription)")
}
...
BOOL ok = textToWrite.writeToFile(filename, atomically:true)
...
...
let documentsPath = NSURL(fileURLWithPath: NSSearchPathForDirectoriesInDomains(.DocumentDirectory, .UserDomainMask, true)[0])
let filename = "\(documentsPath)/tmp_activeTrans.txt"
...
BOOL ok = textData.writeToFile(filepath, options: .DataWritingFileProtectionCompleteUntilFirstUserAuthentication);
...
kSecAttrAccessible 键的值。下面列出了各种密钥链可访问性常量的定义：kSecAttrAccessibleAfterFirstUnlock:kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:kSecAttrAccessibleAlways:kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly:kSecAttrAccessibleAlwaysThisDeviceOnly:kSecAttrAccessibleWhenUnlocked:kSecAttrAccessibleWhenUnlockedThisDeviceOnly:kSecAttrAccessibleAfterFirstUnlock 标记一个密钥链项目，就会使用从用户密码或设备 UID 派生的密钥对其进行加密，但在某些情况下依然可以访问数据。因此，应该对 kSecAttrAccessibleAfterFirstUnlock 的用法进行仔细审核，以确定是否需要执行进一步保护。
...
NSMutableDictionary *dict = [NSMutableDictionary dictionary];
NSData *token = [@"secret" dataUsingEncoding:NSUTF8StringEncoding];
// Configure KeyChain Item
[dict setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id) kSecClass];
[dict setObject:token forKey:(__bridge id)kSecValueData];
...
[dict setObject:(__bridge id)kSecAttrAccessibleAfterFirstUnlock forKey:(__bridge id) kSecAttrAccessible];
OSStatus error = SecItemAdd((__bridge CFDictionaryRef)dict, NULL);
...
kSecAttrAccessible 键的值。下面列出了各种密钥链可访问性常量的定义：kSecAttrAccessibleAfterFirstUnlock:kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:kSecAttrAccessibleAlways:kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly:kSecAttrAccessibleAlwaysThisDeviceOnly:kSecAttrAccessibleWhenUnlocked:kSecAttrAccessibleWhenUnlockedThisDeviceOnly:kSecAttrAccessibleAfterFirstUnlock 标记一个密钥链项目，就会使用从用户密码或设备 UID 派生的密钥对其进行加密，但在某些情况下依然可以访问数据。因此，应该对 kSecAttrAccessibleAfterFirstUnlock 的用法进行仔细审核，以确定是否需要执行进一步保护。
...
// Configure KeyChain Item
let token = "secret"
var query = [String : AnyObject]()
query[kSecClass as String] = kSecClassGenericPassword
query[kSecValueData as String] = token as AnyObject?
...
query[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
SecItemAdd(query as CFDictionary, nil)
...
NSFileManager 的数据保护类会定义为常量，以便在与 NSFileManager 实例相关联的 NSDictionary 中指定为 NSFileProtectionKey 键的值，并可通过使用 NSFileManager 函数（包括 setAttributes:ofItemAtPath:error:、attributesOfItemAtPath:error: 和 createFileAtPath:contents:attributes:）创建文件或修改其数据保护类。此外，NSData 对象的相应数据保护常量会定义为 NSDataWritingOptions，并可将其作为 options 参数传递到 NSData 函数 writeToURL:options:error: 和 writeToFile:options:error:。NSFileManager 和 NSData 的各种数据保护类常量定义如下：NSFileProtectionComplete, NSDataWritingFileProtectionComplete:NSFileProtectionCompleteUnlessOpen, NSDataWritingFileProtectionCompleteUnlessOpen:NSFileProtectionCompleteUntilFirstUserAuthentication, NSDataWritingFileProtectionCompleteUntilFirstUserAuthentication:NSFileProtectionNone, NSDataWritingFileProtectionNone:NSFileProtectionNone 结果。这使此文件在设备打开时随时可以进行访问，包括用密码锁定或正在引导时。因此，应该对 NSFileProtectionNone 的用法进行仔细审核，以确定是否需要执行更严格的数据保护。例 2：在以下例子中，给定数据不受保护（设备打开时可随时访问）：
...
filepath = [self.GetDocumentDirectory stringByAppendingPathComponent:self.setFilename];
...
NSDictionary *protection = [NSDictionary dictionaryWithObject:NSFileProtectionNone forKey:NSFileProtectionKey];
...
[[NSFileManager defaultManager] setAttributes:protection ofItemAtPath:filepath error:nil];
...
BOOL ok = [testToWrite writeToFile:filepath atomically:YES encoding:NSUnicodeStringEncoding error:&err];
...
...
filepath = [self.GetDocumentDirectory stringByAppendingPathComponent:self.setFilename];
...
NSData *textData = [textToWrite dataUsingEncoding:NSUnicodeStingEncoding];
...
BOOL ok = [textData writeToFile:filepath options:NSDataWritingFileProtectionNone error:&err];
...
NSFileManager 中定义为常量，以便在与 NSFileManager 实例相关联的 Dictionary 中指定为 NSFileProtectionKey 密钥的值。通过使用 NSFileManager 函数（包括 setAttributes(_:ofItemAtPath:)、attributesOfItemAtPath(_:) 和 createFileAtPath(_:contents:attributes:)），可以创建文件或者修改其数据保护级别。此外，已在 NSDataWritingOptions 枚举中定义了 NSData 对象的相应数据保护常量，它可以作为 options 参数传递到 NSData 函数（例如
writeToFile(_:options:)NSFileManager 和 NSData 的各种数据保护类常量定义如下：NSFileProtectionComplete, NSDataWritingOptions.DataWritingFileProtectionComplete:NSFileProtectionCompleteUnlessOpen, NSDataWritingOptions.DataWritingFileProtectionCompleteUnlessOpen:NSFileProtectionCompleteUntilFirstUserAuthentication, NSDataWritingOptions.DataWritingFileProtectionCompleteUntilFirstUserAuthentication:NSFileProtectionNone, NSDataWritingOptions.DataWritingFileProtectionNone:NSFileProtectionNone 结果。这使此文件在设备打开时随时可以进行访问，包括用密码锁定或正在引导时。因此，应该对 NSFileProtectionNone 的用法进行仔细审核，以确定是否需要执行更严格的数据保护。示例 2：在以下示例中，给定数据不受保护（设备打开时可随时访问）：
...
let documentsPath = NSURL(fileURLWithPath: NSSearchPathForDirectoriesInDomains(.DocumentDirectory, .UserDomainMask, true)[0])
let filename = "\(documentsPath)/tmp_activeTrans.txt"
let protection = [NSFileProtectionKey: NSFileProtectionNone]
do {
try NSFileManager.defaultManager().setAttributes(protection, ofItemAtPath: filename)
} catch let error as NSError {
NSLog("Unable to change attributes: \(error.debugDescription)")
}
...
BOOL ok = textToWrite.writeToFile(filename, atomically:true)
...
...
let documentsPath = NSURL(fileURLWithPath: NSSearchPathForDirectoriesInDomains(.DocumentDirectory, .UserDomainMask, true)[0])
let filename = "\(documentsPath)/tmp_activeTrans.txt"
...
BOOL ok = textData.writeToFile(filepath, options: .DataWritingFileProtectionNone);
...
kSecAttrAccessible 键的值。下面列出了各种密钥链可访问性常量的定义：kSecAttrAccessibleAfterFirstUnlock:kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:kSecAttrAccessibleAlways:kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly:kSecAttrAccessibleAlwaysThisDeviceOnly:kSecAttrAccessibleWhenUnlocked:kSecAttrAccessibleWhenUnlockedThisDeviceOnly:kSecAttrAccessibleAlways 结果。这使此文件在设备打开时随时可以进行访问，包括用密码锁定或正在引导时。因此，应该对 kSecAttrAccessibleAlways 的用法进行仔细审核，以确定是否需要执行更严格的密钥链可访问性级别。
...
NSMutableDictionary *dict = [NSMutableDictionary dictionary];
NSData *token = [@"secret" dataUsingEncoding:NSUTF8StringEncoding];
// Configure KeyChain Item
[dict setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id) kSecClass];
[dict setObject:token forKey:(__bridge id)kSecValueData];
...
[dict setObject:(__bridge id)kSecAttrAccessibleAlways forKey:(__bridge id) kSecAttrAccessible];
OSStatus error = SecItemAdd((__bridge CFDictionaryRef)dict, NULL);
...
kSecAttrAccessible 键的值。下面列出了各种密钥链可访问性常量的定义：kSecAttrAccessibleAfterFirstUnlock:kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:kSecAttrAccessibleAlways:kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly:kSecAttrAccessibleAlwaysThisDeviceOnly:kSecAttrAccessibleWhenUnlocked:kSecAttrAccessibleWhenUnlockedThisDeviceOnly:kSecAttrAccessibleAlways 结果。这使此文件在设备打开时随时可以进行访问，包括用密码锁定或正在引导时。因此，应该对 kSecAttrAccessibleAlways 的用法进行仔细审核，以确定是否需要执行更严格的密钥链可访问性级别。
...
// Configure KeyChain Item
let token = "secret"
var query = [String : AnyObject]()
query[kSecClass as String] = kSecClassGenericPassword
query[kSecValueData as String] = token as AnyObject?
...
query[kSecAttrAccessible as String] = kSecAttrAccessibleAlways
SecItemAdd(query as CFDictionary, nil)
...
Realm 数据库的连接：
Realm realm = Realm.getDefaultInstance();
Realm 数据库的连接：
RLMRealmConfiguration *config = [RLMRealmConfiguration defaultConfiguration];
RLMRealm *realm = [RLMRealm realmWithConfiguration:config error:nil];
Realm 数据库的连接：
let realm = try! Realm()
UIImageWriteToSavedPhotosAlbum 将图像保存到相册：
- (void) imagePickerController:(UIImagePickerController *)picker didFinishPickingMediaWithInfo:(NSDictionary *)info
{
// Access the uncropped image from info dictionary
UIImage *image = [info objectForKey:UIImagePickerControllerOriginalImage];
// Save image
UIImageWriteToSavedPhotosAlbum(image, self, @selector(image:didFinishSavingWithError:contextInfo:), nil);
...
}
UIImageWriteToSavedPhotosAlbum 将图像保存到相册：
func imagePickerController(picker: UIImagePickerController, didFinishPickingMediaWithInfo info: [NSObject : AnyObject]) {
if let pickedImage = info[UIImagePickerControllerOriginalImage] as? UIImage {
imageView.contentMode = .ScaleAspectFit
imageView.image = pickedImage
}
// Save image
UIImageWriteToSavedPhotosAlbum(pickedImage!, self, nil, nil)
dismissViewControllerAnimated(true, completion: nil)
}
kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:kSecAttrAccessibleAlways:kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly:kSecAttrAccessibleAlwaysThisDeviceOnly:kSecAttrAccessibleWhenUnlocked:kSecAttrAccessibleWhenUnlockedThisDeviceOnly:kSecAttrAccessibleWhenUnlocked 等较安全的策略存储，那么如果您的设备在设置了密码的情况下被盗，则盗窃者需要解锁设备才能将密钥链项目解除锁定。如果无法输入正确的密码，盗窃者便无法解密密钥链项目。但是，如果没有设置密码，则攻击者只需滑动手指即可对设备解除锁定，并获得密钥链来解密其项目。因此，如果不强制要求为设备设置密码，则可能会削弱密钥链加密机制的安全性。
...
NSMutableDictionary *dict = [NSMutableDictionary dictionary];
NSData *token = [@"secret" dataUsingEncoding:NSUTF8StringEncoding];
// Configure KeyChain Item
[dict setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id) kSecClass];
[dict setObject:token forKey:(__bridge id)kSecValueData];
...
[dict setObject:(__bridge id)kSecAttrAccessibleWhenUnlockedThisDeviceOnly forKey:(__bridge id) kSecAttrAccessible];
OSStatus error = SecItemAdd((__bridge CFDictionaryRef)dict, NULL);
...
kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:kSecAttrAccessibleAlways:kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly:kSecAttrAccessibleAlwaysThisDeviceOnly:kSecAttrAccessibleWhenUnlocked:kSecAttrAccessibleWhenUnlockedThisDeviceOnly:kSecAttrAccessibleWhenUnlocked 等较安全的策略存储，那么如果您的设备在设置了密码的情况下被盗，则盗窃者需要解锁设备才能将密钥链项目解除锁定。如果无法输入正确的密码，盗窃者便无法解密密钥链项目。但是，如果没有设置密码，则攻击者只需滑动手指即可对设备解除锁定，并获得密钥链来解密其项目。因此，如果不强制要求为设备设置密码，则可能会削弱密钥链加密机制的安全性。
...
// Configure KeyChain Item
let token = "secret"
var query = [String : AnyObject]()
query[kSecClass as String] = kSecClassGenericPassword
query[kSecValueData as String] = token as AnyObject?
...
query[kSecAttrAccessible as String] = kSecAttrAccessibleWhenUnlockedThisDeviceOnly
SecItemAdd(query as CFDictionary, nil)
...
setPersistent:YES 创建命名粘贴板并将其配置为永久。
...
UIPasteboard *pasteboard = [UIPasteboard pasteboardWithName:@"myPasteboard" create:YES];
[pasteboard setPersistent:YES];
...
setPersistent(true) 创建命名粘贴板并将其配置为永久。
...
let pasteboard = UIPasteboard(name: UIPasteboard.Name(rawValue: "myPasteboard"), create: true)!
pasteboard.setPersistent(true)
...
Access Control Policy可授予对 foo 存储桶的完全匿名访问权限。
GetBucketAclRequest bucketAclReq = GetBucketAclRequest.builder().bucket("foo").build();
GetBucketAclResponse getAclRes = s3.getBucketAcl(bucketAclReq);
List<Grant> grants = getAclRes.grants();
Grantee allusers = Grantee.builder().uri("http://acs.amazonaws.com/groups/global/AllUsers").build();
Permission fc_permission = Permission.fromValue("FullControl");
Grant grant = Grant.builder().grantee(allusers).permission(fc_permission).build();
grants.add(grant);
AccessControlPolicy acl = AccessControlPolicy.builder().grants(grants).build();
Access Control Policy可授予对 foo 存储桶的匿名读取 ACP 访问权限。
GetBucketAclRequest bucketAclReq = GetBucketAclRequest.builder().bucket("foo").build();
GetBucketAclResponse getAclRes = s3.getBucketAcl(bucketAclReq);
List<Grant> grants = getAclRes.grants();
Grantee allusers = Grantee.builder().uri("http://acs.amazonaws.com/groups/global/AllUsers").build();
Permission fc_permission = Permission.fromValue("READ_ACP");
Grant grant = Grant.builder().grantee(allusers).permission(fc_permission).build();
grants.add(grant);
AccessControlPolicy acl = AccessControlPolicy.builder().grants(grants).build();
Access Control Policy可授予对 foo 存储桶的匿名读取访问权限。
GetBucketAclRequest bucketAclReq = GetBucketAclRequest.builder().bucket("foo").build();
GetBucketAclResponse getAclRes = s3.getBucketAcl(bucketAclReq);
List<Grant> grants = getAclRes.grants();
Grantee allusers = Grantee.builder().uri("http://acs.amazonaws.com/groups/global/AllUsers").build();
Permission fc_permission = Permission.fromValue("Read");
Grant grant = Grant.builder().grantee(allusers).permission(fc_permission).build();
grants.add(grant);
AccessControlPolicy acl = AccessControlPolicy.builder().grants(grants).build();
Access Control Policy可授予对 foo 存储桶的匿名写入 ACP 访问权限。
GetBucketAclRequest bucketAclReq = GetBucketAclRequest.builder().bucket("foo").build();
GetBucketAclResponse getAclRes = s3.getBucketAcl(bucketAclReq);
List<Grant> grants = getAclRes.grants();
Grantee allusers = Grantee.builder().uri("http://acs.amazonaws.com/groups/global/AllUsers").build();
Permission fc_permission = Permission.fromValue("WRITE_ACP");
Grant grant = Grant.builder().grantee(allusers).permission(fc_permission).build();
grants.add(grant);
AccessControlPolicy acl = AccessControlPolicy.builder().grants(grants).build();
Access Control Policy可授予对 foo 存储桶的匿名写入访问权限。
GetBucketAclRequest bucketAclReq = GetBucketAclRequest.builder().bucket("foo").build();
GetBucketAclResponse getAclRes = s3.getBucketAcl(bucketAclReq);
List<Grant> grants = getAclRes.grants();
Grantee allusers = Grantee.builder().uri("http://acs.amazonaws.com/groups/global/AllUsers").build();
Permission fc_permission = Permission.fromValue("Write");
Grant grant = Grant.builder().grantee(allusers).permission(fc_permission).build();
grants.add(grant);
AccessControlPolicy acl = AccessControlPolicy.builder().grants(grants).build();