Description

This detector identifies explicit use of ECB (Electronic Codebook) mode in Dart's PointyCastle cryptographic library. ECB mode is insecure because it encrypts identical plaintext blocks into identical ciphertext blocks, revealing patterns in encrypted data and making cryptanalysis easier.

Detection Strategy

• The scanner first checks if the PointyCastle cryptographic library (package:pointycastle) is imported in the Dart code

• It then examines function calls to identify direct ECB constructor calls or cipher factory methods

• For direct ECB constructors, it flags any call to known ECB cipher constructors

• For cipher factory methods, it checks if the first argument contains an explicit ECB transformation string (like 'AES/ECB/PKCS7')

• A vulnerability is reported when either direct ECB constructor usage or cipher factory calls with ECB transformation parameters are detected

Vulnerable code example

import 'package:pointycastle/export.dart';

class UploadService {
  Uint8List encryptData(Uint8List key, Uint8List data) {
    // Vulnerable: ECB mode does not use initialization vectors, making identical plaintext blocks produce identical ciphertext
    final cipher = PaddedBlockCipher('AES/ECB/PKCS7');
    cipher.init(true, PaddedBlockCipherParameters(KeyParameter(key), null));
    return cipher.process(data);...

✅ Secure code example

import 'package:pointycastle/export.dart';
import 'dart:math';

class UploadService {
  final Random _random = Random.secure();

  Uint8List _generateIV() {
    final iv = Uint8List(16);...