OS Command Injection (ARCH9102)

Key swift.security.os-command-injection · Severity error · Category security · CWE CWE-78

Flags Process launched through a shell (/bin/sh -c) with an interpolated command line.

Incorrect

process.arguments = ["-c", "ls \(dir)"]

Correct

process.executableURL = URL(fileURLWithPath: "/bin/ls")
process.arguments = [dir]

Fix

Invoke the executable directly with an argument array; no shell.