Description

This detector identifies insecure gRPC client connections in Rust code that use unencrypted HTTP protocols instead of HTTPS/TLS. Using HTTP for gRPC communication exposes sensitive data to interception and man-in-the-middle attacks, compromising the confidentiality and integrity of client-server communications.

Detection Strategy

• The code must import the 'tonic' Rust gRPC library

• A gRPC channel endpoint constructor must be called (like Channel::from_static, Channel::builder, etc.)

• The endpoint URL parameter must use the insecure 'http://' protocol scheme instead of 'https://'

• The vulnerability is reported on the constructor call that creates the insecure channel connection

Vulnerable code example

use tonic::transport::{Channel, Endpoint};

async fn vulnerable_grpc_connections() -> Result<(), Box<dyn std::error::Error>> {
    // Vulnerable: HTTP endpoint without TLS - data sent in plaintext
    let _channel = Channel::from_static("http://api.example.com:50051")
        .connect()
        .await?;
    ...

✅ Secure code example

use tonic::transport::{Channel, Endpoint};

async fn secure_grpc_connections() -> Result<(), Box<dyn std::error::Error>> {
    // Secure: HTTPS endpoint with TLS encryption
    let _channel = Channel::from_static("https://api.example.com:50051")
        .connect()
        .await?;
    ...