Rules / Swift
SHIELD-SWIFT-001
SQL injection via string interpolation
What it detects
SQLite query built with Swift string interpolation allows SQL injection.
How to fix
Use sqlite3_prepare_v2 with bound parameters via sqlite3_bind_* instead of interpolating values.
Vulnerable — Shield flags thisUserStore.swift
import SQLite3
func deleteSessions(db: OpaquePointer?, username: String) {
sqlite3_exec(db, "DELETE FROM sessions WHERE user = '\(username)'", nil, nil, nil)
}
Fixed — scans cleanUserStore.swift
import SQLite3
func deleteSessions(db: OpaquePointer?, username: String) {
var stmt: OpaquePointer?
sqlite3_prepare_v2(db, "DELETE FROM sessions WHERE user = ?", -1, &stmt, nil)
sqlite3_bind_text(stmt, 1, username, -1, nil)
sqlite3_step(stmt)
sqlite3_finalize(stmt)
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-001, the fixed one does not.