Cross-Site Scripting (ARCH9101)
Ce contenu n’est pas encore disponible dans votre langue.
Key swift.security.xss · Severity error · Category security · CWE CWE-79
Flags WKWebView sinks (evaluateJavaScript, loadHTMLString) fed with interpolated data.
Incorrect
Section titled “Incorrect”webView.evaluateJavaScript("showUser('\(name)')")Correct
Section titled “Correct”let payload = try JSONEncoder().encode(name)webView.evaluateJavaScript("showUser(\(String(data: payload, encoding: .utf8)!))")JSON-encode data crossing into JavaScript; escape HTML before loadHTMLString.