Metadata

ID: dart-security/no-http-url

Language: Dart

Severity: Warning

Category: Security

CWE: 319

Related CWEs:

• 1428

Description

A string literal starting with http:// transmits data in cleartext, exposing it to eavesdropping and man-in-the-middle attacks. Replace http:// with https:// to enforce TLS-encrypted transport for all network communication, including API endpoints, webhooks, and any third-party service URLs referenced in the code.

Non-Compliant Code Examples

void main() {
  final apiUrl = 'http://api.example.com/data';
  final webhookUrl = "http://hooks.example.com/event";
}

Compliant Code Examples

void main() {
  final url = 'https://api.example.com/data';
  final webhook = "https://hooks.example.com/event";
  final local1 = 'http://localhost:8080/api';
  final local2 = 'http://127.0.0.1/health';
  final local3 = 'http://[::1]/test';
  final logMsg = 'Log message http://api.example.com/data';
}

Seamless integrations. Try Datadog Code Security

Datadog Code Security