Description

This detector identifies hardcoded salt values in Dart cryptographic key derivation functions. Using hardcoded salts significantly weakens cryptographic security because salts should be unique and random for each password hash to prevent rainbow table attacks and ensure that identical passwords produce different hashes.

Detection Strategy

• The cryptography package must be imported in the Dart file (using 'package:cryptography' import)

• A key derivation function call is made using methods like deriveKey, derive, or similar KDF operations

• The salt parameter in the KDF function call contains a hardcoded literal value (string, byte array, or other constant) instead of a dynamically generated or user-provided value

Vulnerable code example

import 'package:cryptography/cryptography.dart';

Future<void> vulnerableExample() async {
  final pbkdf2 = Pbkdf2(macAlgorithm: Hmac.sha256(), iterations: 10000, bits: 256);
  final k = await pbkdf2.deriveKeyFromPassword(
    password: 'userPassword',
    nonce: [0, 1, 2, 3, 4, 5, 6, 7], // VULNERABLE: hardcoded salt enables rainbow table attacks
  );...

✅ Secure code example

import 'dart:math';
import 'package:cryptography/cryptography.dart';

List<int> _generateRandomSalt(int length) {
  final random = Random.secure();
  return List<int>.generate(length, (_) => random.nextInt(256));
}
...