Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-006

WebView HTML injection via loadHTMLString

highSwiftCWE-79CVSS 7.4

What it detects

loadHTMLString renders HTML built from interpolated variable data.

How to fix

Sanitize and HTML-encode user data before embedding it into loaded markup.

Vulnerable — Shield flags thisCommentWebView.swift
import WebKit

func renderComment(in webView: WKWebView, comment: String) {
    webView.loadHTMLString("<html><body><p>\(comment)</p></body></html>", baseURL: nil)
}
Fixed — scans cleanCommentWebView.swift
import WebKit

func renderComment(in webView: WKWebView, comment: String) {
    var safe = comment.replacingOccurrences(of: "&", with: "&amp;")
    safe = safe.replacingOccurrences(of: "<", with: "&lt;")
    safe = safe.replacingOccurrences(of: ">", with: "&gt;")
    webView.loadHTMLString("<html><body><p>" + safe + "</p></body></html>", baseURL: nil)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-006, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-SWIFT-006: WebView HTML injection via loadHTMLString — Zennoxa Shield