Transport Layer Security (TLS) provides a secure channel between systems communicating over the internet by encrypting the data sent between them.
TLS can be used with http and git URI schemes to build secure https and git+https channels
respectively.
These secure protocols are essential for the confidentiality and the integrity of the communication performed when supply chain operations are
performed, such as dart pub get, flutter pub get, dart pub upgrade, etc.
In the pubspec.yaml file, which is a file used by several Dart/Flutter commands,
there’s a possibility to specify URIs in various attributes: homepage, repository, issue_tracker, dependency repositories, etc.
It is important that secure schemes are used in all these URIs. The protocol used in the https scheme provide an additional layer of
security by encrypting the transferred data and verifying the server’s identity.
It is generally recommended not to use http or git URIs that will be used by Dart/Flutter commands to gather external
data during any stage of the application build.
What is the potential impact
Man-in-the-middle (MitM) attacks
An attacker can intercept the communication between the client and server, allowing them to modify the data being transmitted.
Supply chain attacks
Without the verification provided by HTTPS certificates, attackers could redirect package requests to malicious servers that mimic legitimate
package repositories.
For example, an attacker could inject malicious code into a Dart package being downloaded, which could compromise the security of the application
being built.
This can cause further security breaches inside the organization, but will also affect clients if the malicious code gets added to any products, as
a part of a production dependency or as code generated by a tampered development dependency.
Distributing code that (unintentionally) contains backdoors or malware can lead to widespread security vulnerabilities, reputational damage, and
potential legal liabilities.
Credetials exposure
Sensitive information, such as API keys or user credentials used to interact with the remote repository of Dart/Flutter packages, could be exposed
during transmission. This could lead to unauthorized access to the application or its data.
