Zennoxa Shield
Rules / Dart
SHIELD-DART-005

Insecure certificate validation bypass

criticalDartCWE-295CVSS 9.1

What it detects

A badCertificateCallback returning true disables TLS validation and enables man-in-the-middle attacks.

How to fix

Never unconditionally trust certificates; validate the chain and host properly.

Vulnerable — Shield flags thistls_client.dart
import 'dart:io';

HttpClient buildClient() {
  final client = HttpClient();
  // Accept every certificate, even invalid ones
  client.badCertificateCallback = (cert, host, port) => true;
  return client;
}
Fixed — scans cleantls_client.dart
import 'dart:io';

HttpClient buildClient() {
  // Rely on the platform trust store; never override certificate checks.
  final client = HttpClient(context: SecurityContext.defaultContext);
  return client;
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-005, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-005: Insecure certificate validation bypass — Zennoxa Shield