Server-Side Request Forgery (ARCH9104)

Key swift.security.ssrf · Severity warning · Category security · CWE CWE-918

Flags URLSession requests whose URL is built from request or user input, not from a value the app assembled itself.

Incorrect

let url = URL(string: request.query["url"]!)!
let (data, _) = try await URLSession.shared.data(from: url)

Correct

guard let url = URL(string: raw), allowedHosts.contains(url.host ?? "") else { throw Forbidden() }

Fix

Allowlist hosts, refuse loopback and link-local addresses.