Template Injection (ARCH9130)

Key swift.security.template-injection · Severity error · Category security · CWE CWE-1336

Flags Leaf rendering where the template name / text comes from request data.

Incorrect

req.view.render(req.query["page"] ?? "home")

Correct

req.view.render("home", ctx)

Fix

Templates are files under your control; request data is only ever context data.