Web Application Security, 2nd Edition

Chapter 35. Securing Third-Party Dependencies

In Chapter 6, we investigated ways of identifying third-party dependencies in a first-party web application. In Chapter 17, we analyzed various ways that third-party dependencies are integrated in a first-party web application. Based on the integration, we were able to identify potential attack vectors and discuss ways of exploiting such integrations.

Because Part III is all about defensive techniques to stifle hackers, this chapter is all about protecting your application from vulnerabilities that could arise when integrating with third-party dependencies.

Evaluating Dependency Trees

One of the most important things to keep in mind when considering third-party dependencies is that many of them have their own dependencies. Sometimes these are called fourth-party dependencies.

Manually evaluating a single third-party dependency that lacks fourth-party dependencies is doable. Manual code-level evaluation of third-party dependencies is ideal in many cases.

Unfortunately, manual code reviews don’t scale particularly well. In many cases it would be impossible to comprehensively review a third-party dependency that relied on fourth-party dependencies, especially if those fourth-party dependencies contain their own dependencies, and so on.

Third-party dependencies, their dependencies, the dependencies of those dependencies, etc., make up what is known as a dependency tree (see Figure 35-1). Using the npm ls command in an npm-powered project, ...