For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/dart-security/disabled-certificate-validation.md. A documentation index is available at /llms.txt.

Do not disable TLS certificate validation

This product is not supported for your selected Datadog site. ().

Metadata

ID: dart-security/disabled-certificate-validation

Language: Dart

Severity: Error

Category: Security

CWE: 295

Related CWEs:

Description

Setting HttpClient.badCertificateCallback to a function that always returns true disables TLS certificate validation entirely. Any server, including a malicious one performing a man in the middle attack, can intercept traffic undetected.

Remove the override or implement proper validation that rejects untrusted, expired, or self-signed certificates.

Non-Compliant Code Examples

import 'dart:io';

void main() {
  final client = HttpClient();
  client.badCertificateCallback = (X509Certificate cert, String host, int port) => true;
}

import 'dart:io';

void createInsecureClient() {
  final client = HttpClient();
  client.badCertificateCallback = (X509Certificate cert, String host, int port) {
    return true;
  };
}

Compliant Code Examples

import 'dart:io';

void main() {
  final client = HttpClient();
  client.badCertificateCallback = (X509Certificate cert, String host, int port) {
    return cert.subject.contains('example.com') && !cert.endValidity.isBefore(DateTime.now());
  };
}

import 'dart:io';

void main() async {
  final client = HttpClient();
  final request = await client.getUrl(Uri.parse('https://example.com'));
  final response = await request.close();
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Security

Datadog Code Security