User input in "loadHTMLString" will result in JavaScript Injection.
ID |
objectivec.platform.ios_load_html_string |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Platform |
Language |
Objective-C |
Rationale
User input in "loadHTMLString" will result in JavaScript Injection.
The following code illustrates a vulnerable pattern detected by this rule:
// ============================================
// POSITIVE CASES (should trigger findings)
// ============================================
@interface BadViewController : UIViewController
@property (nonatomic, strong) WKWebView *webView;
@end
@implementation BadViewController
- (void)badLoadUserHTML:(NSString *)userInput {
// VULNERABLE: User input in "loadHTMLString" will result in JavaScript Injection.
[self.webView loadHTMLString:userInput baseURL:nil];
}
@endRemediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A05 : Injection.