Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-004

Command injection via system call

criticalSwiftCWE-78CVSS 9.8

What it detects

A shell command is executed through system() or a shell with interpolated data.

How to fix

Do not pass user data to a shell; use Process with an explicit argument array.

Vulnerable — Shield flags thisLogArchiver.swift
import Foundation

func archiveLogs(directory: String) {
    system("tar -czf /tmp/logs.tar.gz \(directory)")
}
Fixed — scans cleanLogArchiver.swift
import Foundation

func archiveLogs(directory: String) throws {
    let task = Process()
    task.executableURL = URL(fileURLWithPath: "/usr/bin/tar")
    var args = ["-czf", "/tmp/logs.tar.gz"]
    args.append(directory)
    task.arguments = args
    try task.run()
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-004, the fixed one does not.

SHIELD-SWIFT-004: Command injection via system call — Zennoxa Shield