Raw SQL Injection Risk (ARCH9055)
Esta página aún no está disponible en tu idioma.
Key swift.orm.raw-sql-injection-risk · Severity critical · Category orm · CWE CWE-89
Flags raw SQL or predicate strings built with interpolation (sqlite3_exec, FMDB executeQuery, NSPredicate(format:) with (…)).
Incorrect
Section titled “Incorrect”let predicate = NSPredicate(format: "name == '\(name)'")Correct
Section titled “Correct”let predicate = NSPredicate(format: "name == %@", name)Use format arguments / bound parameters; never interpolate values into query text.