Skip to content

DART-247 Modify rule S4830: Add Dart language #4978

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 20, 2025
Merged

DART-247 Modify rule S4830: Add Dart language #4978

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3b51ef3
DART-247 Modify rule S4830: Add Dart language
antonioaversa Apr 29, 2025
9c5fb10
Code review: improve how to fix section
antonioaversa Apr 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/header_names/allowed_framework_names.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,3 +168,5 @@
* Helm
// Kotlin
Jetpack Compose
// Dart/Flutter
dart:io library
26 changes: 26 additions & 0 deletions rules/S4830/dart/how-to-fix-it/dart-io-library.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
== How to fix it in dart:io library

=== Code examples

include::../../common/fix/code-rationale.adoc[]

:cert_method_name: badCertificateCallback

include::../../common/fix/code-rationale-override.adoc[]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This part could be improved:

Suggested change
include::../../common/fix/code-rationale.adoc[]
:cert_method_name: badCertificateCallback
include::../../common/fix/code-rationale-override.adoc[]
The certificate validation gets disabled by implementing a `badCertificateCallback` that always return `true`. It is highly recommended to use the original implementation and to avoid any bypass.

Copy link
Contributor Author

@antonioaversa antonioaversa Apr 30, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed, "empty" is not exact as the callback actually has a return true, at very least, in the case of Dart.

Unlike in the suggestion above, I have kept the include::../../common/fix/code-rationale.adoc[] (The following code contains examples of disabled certificate validation.), since it still applies to Dart as to any other language, and also to keep the languages as aligned as possible.


==== Noncompliant code example

[source,dart]
----
class MyHttpOverrides extends HttpOverrides {
@override
HttpClient createHttpClient(context) {
return super.createHttpClient(context)
..badCertificateCallback = (cert, String host, int port) => true; // Noncompliant
}
}
----

=== How does this work?

include::../../common/fix/validation.adoc[]
41 changes: 41 additions & 0 deletions rules/S4830/dart/metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{
"securityStandards": {
"CWE": [
295
],
"OWASP": [
"A6",
"A3"
],
"OWASP Mobile": [
"M3"
],
"OWASP Mobile Top 10 2024": [
"M5"
],
"MASVS": [
"MSTG-NETWORK-3"
],
"OWASP Top 10 2021": [
"A2",
"A5",
"A7"
],
"PCI DSS 3.2": [
"4.1",
"6.5.4",
"6.5.10"
],
"PCI DSS 4.0": [
"4.2.1",
"6.2.4"
],
"ASVS 4.0": [
"1.9.2",
"9.2.1"
],
"STIG ASD_V5R3": [
"V-222550"
]
}
}
33 changes: 33 additions & 0 deletions rules/S4830/dart/rule.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
include::../summary.adoc[]

== Why is this an issue?

include::../rationale.adoc[]

include::../impact.adoc[]

// How to fix it section

include::how-to-fix-it/dart-io-library.adoc[]

== Resources

include::../common/resources/standards-mobile.adoc[]

* https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]

endif::env-github,rspecator-view[]