Description

This vulnerability detector identifies SMTP connections that are not encrypted in Dart applications. Unencrypted SMTP connections transmit authentication credentials and email content in plain text, making them vulnerable to man-in-the-middle attacks and credential theft.

Detection Strategy

• Identifies imports of SMTP server functionality from mailer packages in Dart code

• Locates method calls or expressions that create SMTP server connections

• Analyzes the connection configuration to determine if encryption (SSL/TLS) is disabled or not specified

• Reports vulnerabilities when SMTP connections are configured without proper encryption protocols

Vulnerable code example

import 'package:mailer/mailer.dart';

Future<void> sendMail() async {
  // VULNERABLE: allowInsecure enables cleartext communication
  final server = SmtpServer('smtp.example.com', allowInsecure: true);
  await send(Message(), server);
}

✅ Secure code example

import 'package:mailer/mailer.dart';

Future<void> sendMail() async {
  // SAFE: allowInsecure omitted - enforces STARTTLS and aborts on insecure channels
  final server = SmtpServer('smtp.example.com');
  await send(Message(), server);
}