Description

Detects when untrusted deep link URL parameters are used to write files in Dart applications. This vulnerability could allow attackers to manipulate file contents through maliciously crafted deep links, potentially leading to file system attacks or code execution.

Detection Strategy

• Check if the application imports both 'package:uni_links/uni_links.dart' and 'dart:io' packages

• Look for file write operations using '.writeAsString' method calls

• Verify if the data being written comes from uni_links URL parameters without proper validation

• Confirm that the URL parameter is directly used in the file write operation without sanitization

Vulnerable code example

import 'package:uni_links/uni_links.dart';
import 'dart:io';

Future<void> handleDeepLink() async {
  uriLinkStream.listen((Uri? uri) async {
    if (uri != null) {
      // UNSAFE: Directly using untrusted URI parameters for file operations
      File(uri.queryParameters['filename']).writeAsString(uri.queryParameters['data']);...

✅ Secure code example

import 'package:uni_links/uni_links.dart';
import 'dart:io';
import 'package:path/path.dart' as path;

Future<void> handleDeepLink() async {
  uriLinkStream.listen((Uri? uri) async {
    if (uri != null) {
      final filename = uri.queryParameters['filename'];...