XPath Injection (ARCH9108)

Key swift.security.xpath-injection · Severity error · Category security · CWE CWE-643

Flags XPath expressions built by interpolation (nodes(forXPath: "...\(name)...")).

Incorrect

try doc.nodes(forXPath: "//user[@name='\(name)']")

Correct

escape the value or walk the tree and compare attributes

Fix

Never interpolate untrusted data into an XPath expression.