+
+Evaluating JavaScript that contains a substring from a remote origin may lead to remote code execution. Code written by an attacker can execute unauthorized actions, including exfiltration of local data through a third party web service.
+
+
+
+
+When loading JavaScript into a web view, evaluate only known, locally-defined source code. If part of the input comes from a remote source, do not inject it into the JavaScript code to be evaluated. Instead, send it to the web view as data using an API such as WKWebView.callAsyncJavaScript with the arguments dictionary to pass remote data objects.
+
+
+
+
+In the following (bad) example, a call to WKWebView.evaluateJavaScript evaluates JavaScript source code that is tainted with remote data, potentially introducing a code injection vulnerability.
+
+
+
+In the following (good) example, we sanitize the remote data by passing it using the arguments dictionary of WKWebView.callAsyncJavaScript. This ensures that untrusted data cannot be evaluated as JavaScript source code.
+
+
+
+
+
+
+
+ Apple Developer Documentation: WKWebView.callAsyncJavaScript(_:arguments:in:contentWorld:)
+
+
+
+
diff --git a/unified/ql/src/queries/security/CWE-094/UnsafeJsEval.ql b/unified/ql/src/queries/security/CWE-094/UnsafeJsEval.ql
new file mode 100644
index 000000000000..6de65a451d5d
--- /dev/null
+++ b/unified/ql/src/queries/security/CWE-094/UnsafeJsEval.ql
@@ -0,0 +1,47 @@
+/**
+ * @name JavaScript Injection
+ * @description Evaluating JavaScript code containing a substring from a remote source may lead to remote code execution.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 9.3
+ * @precision medium
+ * @id unified/swift/unsafe-js-eval
+ * @tags security
+ * external/cwe/cwe-094
+ * external/cwe/cwe-095
+ * external/cwe/cwe-749
+ */
+
+import unified
+
+/**
+ * A taint configuration from taint sources to sinks for this query.
+ */
+module UnsafeJsEvalConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node node) { Models::isSource(node, _) }
+
+ predicate isSink(DataFlow::Node node) { Models::isSink(node, "code-injection") }
+
+ predicate isBarrier(DataFlow::Node node) {
+ // TODO: Port the numeric-type barrier from original Swift's UnsafeJsEvalExtensions.qll.
+ none()
+ }
+
+ predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+ // TODO: Port the base-address flow step from original Swift's UnsafeJsEvalExtensions.qll.
+ none()
+ }
+
+ predicate observeDiffInformedIncrementalMode() { any() }
+}
+
+/**
+ * Detect taint flow of taint sources to sinks for this query.
+ */
+module UnsafeJsEvalFlow = TaintTracking::Global