XPath Injection (ARCH9108)
Ce contenu n’est pas encore disponible dans votre langue.
Key swift.security.xpath-injection · Severity error · Category security · CWE CWE-643
Flags XPath expressions built by interpolation (nodes(forXPath: "...\(name)...")).
Incorrect
Section titled “Incorrect”try doc.nodes(forXPath: "//user[@name='\(name)']")Correct
Section titled “Correct”escape the value or walk the tree and compare attributesNever interpolate untrusted data into an XPath expression.