Description

This vulnerability detector identifies insecure gRPC server connections in Dart applications. When gRPC servers are configured without proper security settings, they may communicate over unencrypted channels, exposing sensitive data to potential interception and man-in-the-middle attacks.

Detection Strategy

• A vulnerability is reported when analyzing Dart source code files that import the 'package:grpc/grpc.dart' library

• The detector specifically looks for gRPC server method calls that use 'serve' functionality on a server receiver object

• A security issue is flagged when these server method calls are missing required security configuration arguments that would enable encrypted connections

• Test files are excluded from analysis to avoid false positives in development environments

Vulnerable code example

import 'package:grpc/grpc.dart';

class GreeterService extends Service {
  @override
  String get $name => 'helloworld.Greeter';
}

// VULNERABLE: gRPC server serves without TLS encryption...

✅ Secure code example

import 'package:grpc/grpc.dart';

class GreeterService extends Service {
  @override
  String get $name => 'helloworld.Greeter';
}

// SECURE: gRPC server serves with TLS encryption...