Dynamic Code Execution (ARCH9131)
Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.
Key swift.security.dynamic-code-execution · Severity critical · Category security · CWE CWE-95
Flags JSContext.evaluateScript / NSExpression(format:) / NSPredicate(format:) with a script built from untrusted data.
Incorrect
Section titled “Incorrect”context.evaluateScript(userInput)Correct
Section titled “Correct”map the request onto a fixed set of operationsNever evaluate user input as code.