Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-003

Command injection via Process arguments

criticalSwiftCWE-78CVSS 9.8

What it detects

Process/NSTask is launched with arguments derived from variable interpolation.

How to fix

Avoid shell interpolation and pass fixed argument arrays with validated inputs.

Vulnerable — Shield flags thisPingRunner.swift
import Foundation

func ping(host: String) throws {
    let task = Process()
    task.executableURL = URL(fileURLWithPath: "/bin/sh")
    task.arguments = ["-c", "ping -c 1 \(host)"]
    try task.run()
}
Fixed — scans cleanPingRunner.swift
import Foundation

func ping(host: String) throws {
    guard host.range(of: "^[A-Za-z0-9.-]+$", options: .regularExpression) != nil else { return }
    let task = Process()
    task.executableURL = URL(fileURLWithPath: "/sbin/ping")
    var args = ["-c", "1"]
    args.append(host)
    task.arguments = args
    try task.run()
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-003, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-SWIFT-003: Command injection via Process arguments — Zennoxa Shield