The detection for insecure transport DS137138 returns false positives

This is regarding the message for insecure transport (HTTP)

https://github.com/Microsoft/DevSkim/blob/master/guidance/DS137138.md

This seems to come for any use of the word http, which might be too broad.

For example, in the popular JavaScript framework Angular (v2+), there’s a class call Http, which is an Http(s) AJAX client (a wrapper for browser AJAX / fetch functionality).

You’d inject this client in your code in a way a bit like this:

import { Injectable } from '@angular/core';
import { Http } from '@angular/http';

@Injectable()
export class SomeService {
    constructor(private http: Http) {
        // ...
    }
}

however, DevSkim does not like this. It shows the following message for the constructor line above

[Devskim: Finding DS137138]
Insecure URL
Severity: [Moderate]

An HTTP-based URL without TLS was detected.

Fix Guidance: Update to an HTTPS-based URL if possible.

More Info:
https://github.com/Microsoft/DevSkim/blob/master/guidance/DS137138.md

In this case, the constructor line is not creating a URL though. The statement An HTTP-based URL without TLS was detected is incorrect.

Would it make sense to check for http: instead of http here?

[joshbw]

Good catch - the suggestion of including the : makes a lot of sense, and this is a pretty easy change.

[molyviatisl]

I am using DevSkim (version 0.3.1) and have the same issue. I am using VS2017 15.9.4. When will the fix be in the VS Marketplace?