安全部门提供的检测：The binary has Runpath Search Path (@rpath) set. In certain cases an attacker can abuse this feature to run arbitrary executable for code execution and privilege escalation. Remove the compiler option -rpath to remove @rpath.
自己使用命令行检测：otool -L + .app 包的路径(IPA包解压) +包名，确实存在@rpath的路径
比如：yang.yang@yangyang ~ % otool -L /Users/yang.yang/Library/Developer/Xcode/DerivedData/acqmkdlhqnoswfftcltfnewtpzib/Build/Products/Debug-iphoneos/aaaa.app/aaaa
然后开始解决，可能每个人遇到的问题会有点区别，有的只需要删除run path即可解决，但我遇到的问题跟网上的不太一样，首先需要说明的是我们项目使用的是Swift语言+OC的混合开发
移除前检测
第一次移除：通过在Podfile文件最后添加
post_install do |installer|
installer.pods_project.targets.each do |target|
target.build_configurations.each do |config|
config.build_settings['DYLIB_INSTALL_NAME_BASE'] = '@executable_path/Frameworks'
end
end
end
重新执行pod install 命令检测，仍然还有
第二次移除，网上另外针对系统库的移除方法：
The Runpath Search Path instructs the dynamic linker to search for a dynamic library (dylib) on an ordered list of paths, sort of like how Unix looks for binaries on $PATH.
If your application uses the Swift Package Manager, in order to compile the libraries without rpath you need to use some hidden build flags. On your local command line run:
Note the swift compiler option no-stdlib-rpath which disables rpath entries during compilation. Configure your build settings so that the application is built with this configuration flag, e.g.: swift build -c release -Xswiftc -no-toolchain-stdlib-rpath.
上面方法我试了好像无效，然后我发现了下面的问题
第三次移除，最最重要的一点是，经过大量排查和实践项目工程必须最低支持iOS版本为12.2才能完全被移除，看截图
最后一步：第四次移除在build settings搜索Runpath Search Paths，全部删除
参考
https://inesmartins.github.io/mobsf-ipa-binary-analysis-step-by-step/index.html
https://stackoverflow.com/questions/66048178/mobsf-solve-rpath-violation
