Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-005

WebView JavaScript injection

highSwiftCWE-79CVSS 8.1

What it detects

evaluateJavaScript is called with a string containing interpolated variable data.

How to fix

Pass data via WKScriptMessageHandler or JSON-encode and escape values before injection.

Vulnerable — Shield flags thisGreetingWebView.swift
import WebKit

func showGreeting(in webView: WKWebView, name: String) {
    webView.evaluateJavaScript("showGreeting('\(name)')")
}
Fixed — scans cleanGreetingWebView.swift
import WebKit

func showGreeting(in webView: WKWebView, name: String) throws {
    let payload = try JSONEncoder().encode([name])
    let json = String(data: payload, encoding: .utf8) ?? "[]"
    webView.evaluateJavaScript("showGreeting.apply(null, " + json + ")")
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-005, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-SWIFT-005: WebView JavaScript injection — Zennoxa Shield