Rules / Swift
SHIELD-SWIFT-004
Command injection via system call
What it detects
A shell command is executed through system() or a shell with interpolated data.
How to fix
Do not pass user data to a shell; use Process with an explicit argument array.
Vulnerable — Shield flags thisLogArchiver.swift
import Foundation
func archiveLogs(directory: String) {
system("tar -czf /tmp/logs.tar.gz \(directory)")
}
Fixed — scans cleanLogArchiver.swift
import Foundation
func archiveLogs(directory: String) throws {
let task = Process()
task.executableURL = URL(fileURLWithPath: "/usr/bin/tar")
var args = ["-czf", "/tmp/logs.tar.gz"]
args.append(directory)
task.arguments = args
try task.run()
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-004, the fixed one does not.