Description

Detects insecure TCP socket usage in Dart applications where network communications are not properly secured. This vulnerability could allow attackers to intercept or manipulate sensitive data transmitted over the network due to lack of encryption or proper security controls.

Detection Strategy

• Checks if the code imports the 'dart:io' library which is required for socket operations

• Identifies socket-related expressions and function calls that create TCP connections

• Verifies if the socket is configured without proper security measures or encryption

• Reports a vulnerability when TCP sockets are used without appropriate security controls

Vulnerable code example

import 'dart:io';

Future<void> vulnerableSocket() async {
  final socket = await Socket.connect('example.com', 443);
  final apiKey = "SECRET_API_KEY_123";  // Sensitive data being exposed
  socket.write(apiKey);  // Vulnerable: Writing sensitive data to socket without encryption
}

✅ Secure code example

import 'dart:io';

Future<void> secureSocket() async {
  // Use SecureSocket for encrypted communication over TLS/SSL
  final secureSocket = await SecureSocket.connect('example.com', 443);
  
  // API key should be loaded from secure configuration/environment
  final apiKey = Platform.environment['API_KEY'];...