Description

This vulnerability detector identifies Dart applications that transmit sensitive information over unencrypted HTTP connections instead of using secure HTTPS. This creates a significant security risk as sensitive data can be intercepted by attackers through man-in-the-middle attacks or network eavesdropping.

Detection Strategy

• Identifies function calls to HTTP methods from the dart:io http package that are known to transmit data (like POST, PUT, PATCH requests)

• Checks if these HTTP calls are made on HTTP client objects or through direct imported HTTP function calls

• Analyzes the request parameters, headers, or body content to determine if sensitive information is being transmitted

• Reports a vulnerability when an HTTP method call contains sensitive data but uses cleartext HTTP protocol instead of encrypted HTTPS

Vulnerable code example

import 'package:http/http.dart' as http;

// VULNERABLE: sending password over unencrypted HTTP connection
Future<void> login() async {
  await http.post(Uri.parse('http://api.example.com/login'),
      body: {'password': 'secret123'});
}

✅ Secure code example

import 'package:http/http.dart' as http;

// SAFE: using HTTPS to encrypt password transmission
Future<void> login() async {
  await http.post(Uri.parse('https://api.example.com/login'), // Use HTTPS instead of HTTP
      body: {'password': 'secret123'});
}