Description

Detects unencrypted HTTP requests in Ruby code using the net/http library. When applications make HTTP requests without encryption (using http:// instead of https://), sensitive data transmitted over the network can be intercepted and exposed to attackers through man-in-the-middle attacks.

Detection Strategy

• Identifies when the net/http library is imported in Ruby code

• Looks for HTTP client request methods (like GET, POST, PUT, etc.) called on the HTTP object

• Checks if the URL provided to these HTTP requests uses an unencrypted http:// protocol

• Reports a vulnerability when HTTP requests are made without using encryption (HTTPS)

Vulnerable code example

require 'net/http'

def fetch_data
    # Vulnerable: Uses insecure HTTP instead of HTTPS
    uri = URI('http://example.com/data')
    Net::HTTP.get(uri)
end

✅ Secure code example

require 'net/http'

def fetch_data
    # Secure: Uses HTTPS for encrypted data transmission
    uri = URI('https://example.com/data')
    Net::HTTP.get(uri)
end