vetkit.swift.tls.trust-without-evaluation
An authentication challenge is answered with URLCredential(trust:) for the server's trust object without evaluating it (SecTrustEvaluateWithError) or pinning it. Any certificate, including an attacker's, is accepted.
Last updated:
Suite: Security
swift
An authentication challenge is answered with URLCredential(trust:) for the server's trust object without evaluating it (SecTrustEvaluateWithError) or pinning it. Any certificate, including an attacker's, is accepted.
Category: SECURITY · Engine rule severity: ERROR
How to fix it
Return .performDefaultHandling unless you implement pinning; when pinning, call SecTrustEvaluateWithError and compare the leaf/public key before calling the completion handler with .useCredential.
References
Source: packages/engine/rules/sast/swift.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.