[vendored] XCDebugLogDelegate-Protocol.h delegates arbitrary debug strings — no category, no redaction hook, no severity

[dariusta]

Source

Filed from a downstream consumer (Straton-Labs-LLC/stratton-internal, vendoring WebDriverAgentLib.xcframework).
Tracking ID in our audit: ocr-prelim-06939.

Affected file

WebDriverAgentLib/RodmanRunnerLib/XCDebugLogDelegate-Protocol.h (vendored header at native/runner/Frameworks/WebDriverAgentLib.xcframework/ios-arm64/RodmanRunnerLib.framework/Headers/XCDebugLogDelegate-Protocol.h)

Defect

The protocol takes one parameter:

- (void)logDebugMessage:(NSString *)arg1;

with no documented category, severity, source, or redaction hook. XCTest's internal _XCTestLogDelegate callers (visible in the open-source XCTestCore dSYMs) pass strings ranging from:

• XCTestCase.h:testCaseWithSelector: invocation traces
• XCUIDevice accessibility-tree dumps (which include text content of all visible elements — i.e. passwords typed in form fields during a UI test)
• XCTestLog buffered assertions, which include the file path and the expected-vs-actual stringified diff
• Random progress messages from the XCTestObservation pipeline

A downstream delegate that wants to redact secrets, route by severity, or filter out accessibility dumps has no signal to work with. The protocol as published forces every consumer to either (a) accept arbitrary strings into a private log sink, or (b) parse the message and guess.

Suggested fix

Add a structured-record variant and keep the string one for back-compat:

typedef NS_ENUM(NSInteger, XCDebugLogCategory) {
    XCDebugLogCategoryUnknown = 0,
    XCDebugLogCategoryAssertion,
    XCDebugLogCategoryActivity,
    XCDebugLogCategoryAccessibilitySnapshot,   // may contain user-visible text — redaction matters
    XCDebugLogCategoryInternal,                // XCTest private — do not surface to consumers
};

@protocol XCDebugLogDelegate <NSObject>
- (void)logDebugMessage:(nullable NSString *)message;
@optional
- (void)logDebugRecord:(NSString *)message
              category:(XCDebugLogCategory)category
              severity:(XCDebugLogSeverity)severity
            redactable:(BOOL)containsUserInput;
@end

Where redactable:YES means "this message may contain user-typed text — sanitize before persisting".

Why this matters downstream

The phone-farm runner passes through text-typed inputs during UI tests. Logging the entire XCTest debug stream to a public destination (e.g. CI artefacts) without a category/severity signal is a credential-exposure risk. We currently redact by string-matching [SynthesizedGestures typeText:] output; a first-class redactable: flag is the right fix at the protocol layer.