Description

Detects insecure database operations in Swift applications using Vapor/Fluent frameworks that could potentially expose sensitive information. This vulnerability occurs when database save operations are performed without proper data protection mechanisms, potentially leading to sensitive data exposure.

Detection Strategy

• Application must be using both Vapor and Fluent frameworks

• Identifies database save operations in the code

• Checks if the save operation is performed on a Fluent query

• Validates if the save operation is unsafe (lacking proper data protection)

• Reports a vulnerability when an unsafe save operation is detected that could expose sensitive data

Vulnerable code example

import Vapor
import Fluent

struct User: Content, Model {
    static let schema = "users"
    
    @ID(key: .id)
    var id: UUID?...

✅ Secure code example

import Vapor
import Fluent
import Bcrypt

struct User: Content, Model {
    static let schema = "users"
    
    @ID(key: .id)...