Unprivileged input controls a privileged URL sink

Rule ID: security.privileged-url-input@1.0.0. Availability below refers to source-scan at product 524fa07e.

V-SEC-08 — Unprivileged input controls a privileged URL sink#

Unprivileged input controls a privileged URL sink. It examines trust boundaries, sensitive flows, validation, and security-sensitive effects.

Availability#

Not available in source-scan. There is no source-scan flag to activate this condition.

Example and action#

Illustrative design scenario, not a runnable Swift example or a reproduced analyzer result. The stated availability and evidence boundaries still apply.

Before: An untrusted URL is fetched by a client that can reach privileged services.

Review the following change against the contract and build variants described above.

After: Restrict the allowed schemes and destinations at the fetch boundary, including redirects and address resolution. Avoid forwarding privileged credentials to destinations chosen by untrusted input.

Intended analysis#

Intended reasoning: Relate the selected security contract to a source, transformation and sensitive operation. The intended check requires identity, flow and policy evidence; a suspicious API name alone does not establish exploitation. Required evidence: source, sink, trust, policy, validation, and flow facts

Assumptions and unknown#

The relevant facts must be admitted for the selected immutable build world. Unknown aliases, external effects, unsupported source forms or incomplete consumers can prevent a conclusion. Availability in this workflow is stated above; the illustration does not expand that availability.

Evidence and interpretation#

The target catalog describes the intended condition. It is not evidence of an active source-scan diagnostic.

Historical evidence at 4558458d: recovery-required (historical qualification is incomplete and needs further evidence). That evidence has not been requalified for this product revision.

How we validate checks explains the evidence boundary. Foundations separates method assumptions from implementation claims.