Q
Detector Library
Kotlin detectors (23/23)
Insecure cookieCookie Without Http Only FlagImproper AuthenticationCryptographic key generatorWeak pseudorandom number generationPath traversalCross-site scriptingReusing Nonce and key in encryptionCode InjectionServer-side request forgeryCross-site request forgeryLog injectionHardcoded credentialsEnabling and overriding debug featureNull Pointer DereferenceInsecure hashingMissing encryption of sensitive dataImproper verification of IntentInsecure connection using unencrypted protocolOS Command InjectionInsecure Bean ValidationSQL injectionIncorrect Type Conversion
Insecure connection using unencrypted protocol High
Connections that use insecure protocols transmit data in cleartext. This introduces a risk of exposing sensitive data to third parties.
Detector ID
kotlin/insecure-connection@v1.0
Category
Noncompliant example
1// Noncompliant: Using clear-text protocols such as `ftp` which is insecure
2fun noncompliant() {
3 val ftpClient = FTPClient(); // Sensitive
4}
Compliant example
1// Compliant: Using clear-text protocols such as `ftps` which is secure
2fun compliant() {
3 val ftpsClient = FTPSClient(true);
4}