Description

Detects insecure HTTP network requests in Swift applications that don't use HTTPS encryption. This exposes sensitive data to potential man-in-the-middle attacks since HTTP traffic can be intercepted and read. The vulnerability occurs when using Alamofire or Foundation frameworks to make unencrypted network calls.

Detection Strategy

• Check if Alamofire or Foundation frameworks are imported in the Swift source code

• Identify network request declarations using vulnerable configurations (e.g., using 'http://' URLs or allowing insecure connections)

• Look for variable declarations and expressions that configure network requests without proper TLS/SSL security

• Flag any detected network requests that don't enforce HTTPS-only communications

Vulnerable code example

import Foundation
import Alamofire

class NetworkManager {
    func makeInsecureRequests() {
        // VULNERABLE: Using HTTP instead of HTTPS exposes data to network attacks
        let insecureURL = URL(string: "http://api.example.com/data")!
        ...

✅ Secure code example

import Foundation
import Alamofire

class NetworkManager {
    func makeSecureRequests() {
        // SAFE: Using HTTPS ensures data is encrypted in transit
        let secureURL = URL(string: "https://api.example.com/data")!
        ...