Sentry-dart: Usage of unencrypted HTTP protocol

[babulpatel1309]

_Platform:_

• [x] Dart
• [x] Flutter Android or iOS
• [ ] Flutter Web

_IDE:_

• [ ] VSCode
• [x] IntelliJ/AS
• [ ] XCode
• [ ] Other, which one?

_split-debug-info and obfuscate (Flutter Android or iOS) or CanvasKit (Flutter Web):_

• [ ] Enabled
• [x] Disabled

_Platform installed with:_

• [x] pub.dev
• [ ] GitHub

Output of the command flutter doctor -v below:

The output goes here...

The version of the SDK (See pubspec.lock):
4.0.1

---

I have the following issue:

Hello guys,
I'm working on one app related to investments which is having requirements of security testing. Well, tester has submitted the security report using two different tools

1. MOBSF: https://mobsf.github.io/docs/#/requirements
2. ImmuniWeb: https://www.immuniweb.com/

Both reports looks almost identical and having common errors and warnings related to sentry. I've search related to those security details and couldn't found any good source to deal with the report.
Can anyone help me to resolve to get a good score in security testing. Here are some snaps from the report.

Steps to reproduce:

• Integrated latest library

Actual result:

• It should bypass security test

Expected result:

• Showing unecrypted error.

[marandaneto]

hey @babulpatel1309 thanks for reporting.

regarding https://cwe.mitre.org/data/definitions/319.html if you are using a https DSN to set up Sentry, it's not an issue at all, the connection class is actually HttpsURLConnection and not HttpURLConnection, as we support both cases, we have to use the parent class, see:

https://github.com/getsentry/sentry-java/blob/81594398ee623b40eb9df1a847dbe21d9e4c25ef/sentry/src/main/java/io/sentry/transport/HttpConnection.java

both are pretty much the same, see the Java impl. https://docs.oracle.com/javase/7/docs/api/javax/net/ssl/HttpsURLConnection.html

I don't think we can do anything about that, it's already using SSL features, just be sure to use a https DSN

[bruno-garcia]

Also worth noting the new DSN's from sentry o123.ingest.sentry.io don't support plain http.

[babulpatel1309]

@marandaneto thanks for your prompt response. Well, I'm using https DSN in the application. It just that the security testing tool was capturing the HTTP class and was marking it as vulnerability.

[marandaneto]

@marandaneto thanks for your prompt response. Well, I'm using https DSN in the application. It just that the security testing tool was capturing the HTTP class and was marking it as vulnerability.

@babulpatel1309 yep, I know, it's not the 1st issue like this, these tools are pretty good but it's known for false positives, happy to clear this up.