Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-010

Insecure TLS trust bypass

criticalSwiftCWE-295CVSS 9.1

What it detects

A URLSession delegate returns a credential from serverTrust without validation.

How to fix

Validate the server trust with SecTrustEvaluateWithError or pinning before accepting.

Vulnerable — Shield flags thisSessionDelegate.swift
import Foundation

final class SessionDelegate: NSObject, URLSessionDelegate {
    func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge,
                    completionHandler: (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        let trust = challenge.protectionSpace.serverTrust!
        completionHandler(.useCredential, URLCredential(trust: trust))
    }
}
Fixed — scans cleanSessionDelegate.swift
import Foundation

final class SessionDelegate: NSObject, URLSessionDelegate {
    func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge,
                    completionHandler: (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        guard let trust = challenge.protectionSpace.serverTrust,
              SecTrustEvaluateWithError(trust, nil) else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        completionHandler(.performDefaultHandling, nil)
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-010, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-SWIFT-010: Insecure TLS trust bypass — Zennoxa Shield