Description

This detector identifies insecure PostgreSQL database connections in Dart applications that disable SSL/TLS encryption. When SSL is disabled or set to insecure modes, database communications are transmitted in plaintext, exposing sensitive data to network eavesdropping and man-in-the-middle attacks.

Detection Strategy

• Scan Dart source files (excluding test files) that import the postgres package (package:postgres/postgres.dart)

• Look for ConnectionSettings constructor calls or method invocations

• Check if any arguments passed to ConnectionSettings specify unsafe SSL modes that disable encryption or use insecure SSL configurations

• Report a vulnerability when ConnectionSettings is called with parameters that result in unencrypted or insecurely encrypted database connections

Vulnerable code example

import 'package:postgres/postgres.dart';

Future<void> vulnerableConnection() async {
  final endpoint = Endpoint(host: 'db.example.com', database: 'app');
  await Connection.open(
    endpoint,
    settings: ConnectionSettings(sslMode: SslMode.disable), // Vulnerable: disables TLS encryption
  );...

✅ Secure code example

import 'package:postgres/postgres.dart';

Future<void> secureConnection() async {
  final endpoint = Endpoint(host: 'db.example.com', database: 'app');
  await Connection.open(
    endpoint,
    settings: ConnectionSettings(sslMode: SslMode.verifyFull), // Safe: enables TLS with full certificate verification
  );...