Swift Gen 2

Note:

Gen 1 is the default detection engine for existing customers. Please reach out to your Customer Success Manager at Mend.io to upgrade to Gen 2.
Gen 1 will be deprecated soon. Please visit this page for more information about the deprecation dates of the varioius Gen 1 engines.

In this article, we cover Swift support and vulnerability detection for Mend SAST.

Mend SAST-supported Swift file types

File Type
.swift

Mend SAST-supported Swift frameworks

Framework
N/A

Mend SAST-supported Swift vulnerability types

The Swift vulnerability types detected by SAST are provided below and are organized by CWE ID within each of their identified severities.

Swift high-severity vulnerability types

CWE	Vulnerability Type	Low Probability Impact
CWE-22	Path Traversal	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-78	Command Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-79	XSS	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-88	Argument Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-89	SQL Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-94	Code Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-502	Deserialization of Untrusted Data	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-643	XPath Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-918	Server-Side Request Forgery (SSRF)	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-939	Improper Authorization in Handler for Custom URL Scheme	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-943	NoSQL Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)

Swift medium-severity vulnerability types

CWE	Vulnerability Type	Low Probability Impact
CWE-90	LDAP Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-295	Improper Certificate Validation	UNAFFECTED
CWE-321	Hard-coded Cryptographic Key	UNAFFECTED
CWE-327	Broken or Risky Cryptographic Algorithm	UNAFFECTED
CWE-338	Cryptographically Weak PRNG	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-400	Uncontrolled Resource Consumption	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-611	XML External Entity (XXE)	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-798	Hard-coded Credentials	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)

Swift low-severity vulnerability types

CWE	Vulnerability Type	Low Probability Impact
CWE-117	Log Injection	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-328	Weak Hash	UNAFFECTED
CWE-601	Open Redirect	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-614	Sensitive Cookie Without 'Secure' Attribute	UNAFFECTED
CWE-1004	Cookie Without 'HttpOnly' Flag	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)
CWE-1333	Regex Denial of Service (ReDoS)	Additional Taint Sources: Content from files and streams, databases, environment (command line calls, main method arguments, environment variables, configurations, url access)