Description

This detector identifies insecure mixed content configurations in Flutter InAppWebView implementations. Mixed content occurs when HTTPS pages load HTTP resources, which can be exploited by attackers to inject malicious content or perform man-in-the-middle attacks, compromising the security of the web view.

Detection Strategy

• Scans Dart source files that import the flutter_inappwebview package

• Identifies calls to InAppWebViewSettings constructor or configuration methods

• Checks if any arguments to these calls configure unsafe mixed content handling modes

• Reports vulnerabilities when mixed content is explicitly allowed or configured in an insecure manner

• Excludes test files from analysis to focus on production code

Vulnerable code example

import 'package:flutter_inappwebview/flutter_inappwebview.dart';

Future<void> vulnerableExample() async {
  final settings = InAppWebViewSettings( // VULNERABLE: Allows insecure HTTP content from HTTPS origins
    mixedContentMode: MixedContentMode.MIXED_CONTENT_ALWAYS_ALLOW,
  );
}

✅ Secure code example

import 'package:flutter_inappwebview/flutter_inappwebview.dart';

Future<void> secureExample() async {
  final settings = InAppWebViewSettings( // SECURE: Blocks insecure HTTP content from HTTPS origins
    mixedContentMode: MixedContentMode.MIXED_CONTENT_NEVER_ALLOW,
  );
}