User input in "loadHTMLString" will result in JavaScript Injection.
ID |
objectivec.platform.ios_load_html_string |
Severity |
low |
Resource |
Platform |
Language |
Objective-C |
Rationale
User input in "loadHTMLString" will result in JavaScript Injection.
The following code illustrates a vulnerable pattern detected by this rule:
@interface BadViewController : UIViewController
@property (nonatomic, strong) WKWebView *webView;
@end
@implementation BadViewController
- (void)badLoadUserHTML:(NSString *)userInput {
// VULNERABLE: User input in "loadHTMLString" will result in JavaScript Injection.
[self.webView loadHTMLString:userInput baseURL:nil];
}