vetkit.swift.sql-injection.sqlkit-raw
A SQLKit/Fluent raw SQL string interpolates a value with \(raw:) or builds .sql(raw:) from interpolation. Raw interpolation is copied into the statement unescaped (SQL injection).
Last updated:
Suite: Security
swift
A SQLKit/Fluent raw SQL string interpolates a value with \(raw:) or builds .sql(raw:) from interpolation. Raw interpolation is copied into the statement unescaped (SQL injection).
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Use \(bind: value) for values and \(ident: name) for identifiers; never interpolate request data with raw:.
References
Source: packages/engine/rules/sast/swift.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.