Cross-Site Scripting (ARCH9101)

Key swift.security.xss · Severity error · Category security · CWE CWE-79

Flags WKWebView sinks (evaluateJavaScript, loadHTMLString) fed with interpolated data.

Incorrect

webView.evaluateJavaScript("showUser('\(name)')")

Correct

let payload = try JSONEncoder().encode(name)
webView.evaluateJavaScript("showUser(\(String(data: payload, encoding: .utf8)!))")

Fix

JSON-encode data crossing into JavaScript; escape HTML before loadHTMLString.