rules-flutter

FlatButton was removed in Flutter 2.0. Replace with TextButton (and TextButton.styleFrom() for theming). FlatButton is no longer maintained and will cause build failures with current Flutter SDK versions.

dart:ffi provides C interop with no memory safety guarantees — CWE-119. Incorrect pointer arithmetic, null dereferences, or wrong type casts in FFI code cause undefined behaviour and crashes. Isolate FFI calls in a dedicated wrapper class, validate all pointer values before use, and prefer higher-level packages (e.g., package:ffi) that handle lifetime management.

Hardcoded API key or secret in Dart source — CWE-798. Secrets embedded in Dart source are visible in the compiled APK/IPA through simple string extraction. Store secrets server-side or retrieve them at runtime from a secure backend; use flutter_dotenv or similar for local development only (with .env in .gitignore).

Android manifest enables cleartext (HTTP) network traffic — CWE-319. This allows unencrypted HTTP requests to any host, bypassing Android's Network Security Config restrictions. Remove this attribute or restrict it to a specific domain allowlist in res/xml/network_security_config.xml.

Plaintext HTTP request to a non-localhost host — CWE-319. HTTP transmits authentication tokens and user data in the clear. Use Uri.https() for all production endpoints. For development emulators, localhost/10.0.2.2 (Android emulator loopback) is acceptable.

Sensitive data stored in SharedPreferences — CWE-312. SharedPreferences is unencrypted on both Android and iOS and is accessible to other apps on rooted devices. Use flutter_secure_storage (backed by Android Keystore / iOS Keychain) for any token, password, or key material.

Dynamic file path construction with user-controlled input — CWE-22. Building a File() path by concatenating request parameters allows '../' traversal to access files outside the intended directory. Validate the resolved path starts within the expected base directory using p.normalize and p.isWithin from package:path.