skills.rest
patrickserrano
patrickserranoCOMMUNITY
Explore all skills by this author →
Website𝕏@patrickgserranoGitHub

url-validation-security

Validates user-provided URLs against a positive allowlist before AVPlayer, URLSession, or WKWebView use.

3|Updated Jun 15, 2026
Search Tags:#swift#url validation#allowlist#urlsession#wkwebview#ios security#urlcomponents
One-click install
npx skills add https://github.com/patrickserrano/lacquer --skill url-validation-security-patrickserrano
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: url-validation-security
Source: https://github.com/patrickserrano/lacquer/tree/main/profiles/ios/skills/url-validation-security
Command: npx skills add https://github.com/patrickserrano/lacquer --skill url-validation-security-patrickserrano

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? User-provided or externally-sourced URLs that reach networking or media APIs without validation open iOS apps to dangerous schemes (javascript:, data:, file:), embedded credentials, and malformed input. This Skill provides a positive-allowlist validator and review guidance so every URL is checked before it reaches AVPlayer, URLSession, or a WKWebView. ## Core Features & Use Cases - Positive-Allowlist Validation: A Swift SecureURLValidator that parses once via URLComponents and enforces http/https schemes only, a non-empty host, and no userinfo credentials. - Defense-in-Depth Placement: Guidance to validate at both manager and service boundaries so a single missed check does not expose the app. - Hardened Input Checks: UTF-8 byte-length cap (2048), rejection of C0 controls, DEL, and literal or percent-encoded null bytes, plus a redundant dangerous-scheme denylist. - Use Case: When reviewing a media playback feature that accepts stream URLs from a server response, apply this validator at the service layer and again in the player manager before handing the URL to AVPlayer. ## Quick Start Ask the AI to build or review a URL validator for user-provided URLs in your Swift networking or media code using this Skill.

Frequently Asked Questions about url-validation-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate a user-provided URL in Swift before loading it?▼

Parse the string once with URLComponents and require an http or https scheme, a non-empty host, and no user or password components. Also cap the UTF-8 byte length and reject control characters and null bytes before passing the URL to URLSession or a web view.

How to block javascript: and data: URLs in an iOS WKWebView?▼

Use a positive allowlist that only accepts http and https schemes rather than relying on a denylist alone. The validator checks components.scheme against ["http", "https"], with a dangerous-scheme prefix denylist (javascript:, data:, file:, vbscript:) as redundant defense.

Should URL validation happen in the service layer or the manager layer?▼

Validate at both boundaries. The duplication is intentional defense-in-depth: if one layer is bypassed or refactored, the other still rejects unsafe URLs before they reach AVPlayer, URLSession, or a WKWebView.

Does URLComponents validation detect IDN homograph attacks?▼

No. Homograph and IDN look-alike hosts are a known limitation of this validator and are not detected. If phishing-style host spoofing is a concern, add explicit host allowlisting or punycode comparison on top of scheme and structure checks.

Why reject URLs containing userinfo credentials in Swift?▼

URLs with embedded user or password components (https://user:pass@host) can leak credentials into logs and enable phishing via misleading hosts. The validator rejects any URL where components.user or components.password is non-nil.

Related Skills

Explore More Software Engineering Skills→
AstorYHAstorYH
15

tiktok-video-id-fetch

Extract the 16-digit video ID from TikTok URLs.

Community
Basic
CsHengCsHeng
10

security-logging

Implement security logging and input validation for audit and incident response.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

enum-tls-security

Enumerate TLS protocol versions, cipher suites, and certificate chain validity across network endpoints.

Community
Advanced
monang404monang404
2

frontend-security-coder

Implements XSS prevention, CSP configuration, and secure DOM manipulation for frontend code.

Community
Intermediate