Skip to main content

Improper dependency pinning

Need​

Proper dependency management and version control

Context​

  • Usage of Dart 2.12.0 for developing cross-platform applications
  • Usage of Shelf for managing and organizing data in a Node.js application
  • Usage of shelf_router for creating a router middleware in Shelf framework
  • Usage of shelf_static for serving static files with Shelf framework
  • Usage of http_parser for parsing HTTP messages
  • Usage of mongo_dart for interacting with MongoDB in Dart

Description​

Non compliant code​

// pubspec.yaml

name: my_app
description: A simple backend application

environment:
  sdk: '>=2.12.0 <3.0.0'

dependencies:
  shelf: any
  shelf_router: any
  shelf_static: any
  http_parser: any
  mongo_dart: any

The pubspec.yaml file is where you define the dependencies for your Dart package. In this case, the application is using the Shelf framework and some other libraries to build a backend application.

The problem here is that the dependencies are pinned to any version. This means that the application does not make explicit the whole dependency tree it requires (direct and indirect third-party libraries) and their respective version.

This can lead to several issues:

  • The application might break if one of the dependencies publishes a new version with breaking changes, and the application automatically updates to it.
  • It might also make the application vulnerable to attacks if a dependency has a security issue in a specific version, and the application is automatically updated to it.
  • It can make it hard to reproduce bugs, as the application might work in one environment but not in another one, due to differences in the versions of the dependencies.

To fix this vulnerability, you should always pin your dependencies to a specific version or a range of versions that you know work with your application. This way, you can make sure that your application will not break due to updates in the dependencies, and you can also make sure that you are not using versions of dependencies that have known security issues.

Steps​

  • Identify the latest stable versions of each dependency your application uses.
  • Replace 'any' with the specific version number for each dependency in your pubspec.yaml file. This will ensure that your application always uses a specific version of each dependency, rather than any version that happens to be available.
  • Run 'pub get' to fetch the specified versions of your dependencies.
  • Test your application thoroughly to ensure that it works as expected with the specified versions of its dependencies.
  • Regularly review and update your dependencies to their latest stable versions to benefit from bug fixes, performance improvements, and new features.

Compliant code​

// pubspec.yaml

name: my_app
description: A simple backend application

environment:
  sdk: '>=2.12.0 <3.0.0'

dependencies:
  shelf: ^1.1.5
  shelf_router: ^1.0.0
  shelf_static: ^1.0.0
  http_parser: ^4.0.0
  mongo_dart: ^0.7.1

The original code had a vulnerability due to improper dependency pinning. The dependencies were set to 'any', which means the application could use any version of the dependencies that are available. This could lead to potential issues if a dependency is updated with breaking changes, or if a version of a dependency has a security vulnerability.

The fixed code specifies the exact versions of the dependencies to use. This is done by replacing 'any' with the specific version number for each dependency in the pubspec.yaml file. The caret (^) symbol before the version number means that the application can use any version that is compatible with the specified version, according to semantic versioning rules.

After updating the dependencies, you should run 'pub get' to fetch the specified versions of your dependencies. Then, test your application thoroughly to ensure that it works as expected with the specified versions of its dependencies.

Remember to regularly review and update your dependencies to their latest stable versions to benefit from bug fixes, performance improvements, and new features. However, always test your application after updating dependencies to ensure everything still works as expected.

References​

Last updated on