JavaScript or HTML context injection

Rule ID: security.javascript-code-injection@1.0.0. Availability below refers to source-scan at product 524fa07e.

V-SEC-07 — JavaScript or HTML context injection#

JavaScript or HTML context injection. It examines trust boundaries, sensitive flows, validation, and security-sensitive effects.

Availability#

Not available in source-scan. There is no source-scan flag to activate this condition.

Example and action#

Illustrative design scenario, not a runnable Swift example or a reproduced analyzer result. The stated availability and evidence boundaries still apply.

Before: Untrusted text is interpolated inside a JavaScript string sent to a WebView.

Review the following change against the contract and build variants described above.

After: Pass data through an API that separates script from arguments where supported, or use encoding appropriate to the exact interpreter context. HTML escaping does not by itself make a JavaScript string safe.

Intended analysis#

Intended reasoning: Relate the selected security contract to a source, transformation and sensitive operation. The intended check requires identity, flow and policy evidence; a suspicious API name alone does not establish exploitation. Required evidence: source, sink, trust, policy, validation, and flow facts

Assumptions and unknown#

The relevant facts must be admitted for the selected immutable build world. Unknown aliases, external effects, unsupported source forms or incomplete consumers can prevent a conclusion. Availability in this workflow is stated above; the illustration does not expand that availability.

Evidence and interpretation#

The target catalog describes the intended condition. It is not evidence of an active source-scan diagnostic.

Historical evidence at 4558458d: recovery-required (historical qualification is incomplete and needs further evidence). That evidence has not been requalified for this product revision.

How we validate checks explains the evidence boundary. Foundations separates method assumptions from implementation claims.