rules-dart

RISK: Overriding badCertificateCallback to return true disables TLS certificate validation, making the app vulnerable to man-in-the-middle attacks (CVE class: improper certificate validation, CWE-295). FIX: Remove the callback override and fix the underlying certificate issue; for development use a trusted local CA.

Cleartext HTTP transmits data without encryption. Use HTTPS for all production network calls. Android and iOS enforce HTTPS by default in production.

dart:mirrors enables runtime reflection and is not available in Flutter production builds (tree-shaking incompatible). It also significantly increases binary size. Use code generation (build_runner) instead.

The ! (null assertion) operator throws a Null check operator used on a null value exception. Use ?. for safe access or ?? for defaults rather than forcing non-null.

Hardcoded secrets in Dart/Flutter are compiled into the app binary and extractable with tools like apktool. Use --dart-define for build-time secrets or fetch from a secure backend.

RISK: dart:math Random() uses a predictable PRNG seeded from the system clock, making it unsuitable for generating tokens, session IDs, or nonces. FIX: Use Random.secure() which delegates to the OS cryptographically secure random source.

SharedPreferences stores data in plaintext. Use flutter_secure_storage for passwords, tokens, and other sensitive values — it uses Keychain on iOS and EncryptedSharedPreferences on Android.

RISK: Constructing a File() path directly from user-supplied input enables path traversal (CWE-22) — an attacker can read or overwrite arbitrary files outside the intended directory by supplying '../' sequences. FIX: Validate and sanitize the path with p.normalize() and check that it starts with the expected base directory before use.

Running sh/bash with user-provided arguments enables command injection. Pass commands as explicit argument lists without shell involvement.

String interpolation in SQLite rawQuery enables SQL injection. Use parameterized queries: db.rawQuery('SELECT * FROM t WHERE id = ?', [id])