Skip to main content

Improper dependency pinning

Need​

Proper management of dependencies and versioning

Context​

  • Usage of TypeScript for adding static typing to JavaScript
  • Usage of Express for building web applications and APIs
  • Usage of body-parser for parsing request bodies in Express

Description​

Non compliant code​

import express from 'express';
import bodyParser from 'body-parser';

const app = express();
app.use(bodyParser.json());

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  
  // Authenticate user
  // ...
  
  res.send('Login successful');
});

app.listen(3000, () => {
  console.log('Server started on port 3000');
});

The vulnerability in this code is related to improper dependency pinning. The code uses the Express framework and the body-parser middleware to handle incoming requests. However, it does not explicitly specify the versions of these dependencies.

By not pinning the versions of the dependencies, the code is susceptible to automatically installing newer versions of the dependencies when the application is built or deployed. This can lead to several issues:

  1. Compatibility: The newer version of the dependency may introduce breaking changes or have different behavior, which can cause the application to malfunction or behave unexpectedly.

  2. Vulnerabilities: If a newer version of a dependency contains a known vulnerability, the application will be using that vulnerable version without being aware of it. This can expose the application to potential security risks.

  3. Incompatibility: The application may rely on specific features or APIs provided by the current version of the dependencies. If a newer version is installed automatically, it may not be compatible with the application code, leading to errors or failures.

To mitigate this vulnerability, it is recommended to declare the specific versions of the dependencies and use a dependency manager like npm, pip, or maven to manage and install the dependencies. This ensures that the same versions of the dependencies are used consistently across different environments and avoids potential compatibility and security issues.

Steps​

  • Identify all the direct and indirect dependencies used in the code
  • Update the package.json file to include the specific version of each dependency
  • Use a dependency manager (such as npm) to manage the dependencies and their versions
  • Run the dependency manager to install the specified versions of the dependencies
  • Verify that the application still functions correctly with the updated dependencies

Compliant code​

import express from 'express';
import bodyParser from 'body-parser';

const app = express();
app.use(bodyParser.json());

app.post('/login', (req, res) => {
  const { username, password } = req.body;
  
  // Authenticate user
  // ...
  
  res.send('Login successful');
});

app.listen(3000, () => {
  console.log('Server started on port 3000');
});

The fixed code addresses the vulnerability by explicitly declaring the dependencies with specific versions and using a dependency manager (in this case, npm) to manage the project's construction and packaging.

In the code, the required dependencies, 'express' and 'body-parser', are imported using the 'import' statement. This ensures that the specific versions of these dependencies are used.

The 'express' dependency is used to create an instance of the Express application, which is assigned to the 'app' constant. The 'body-parser' dependency is used as middleware to parse the incoming request bodies as JSON.

The 'app.post' method is used to define a route for handling POST requests to the '/login' endpoint. Inside the route handler, the request body is destructured to extract the 'username' and 'password' fields.

The code does not include the actual authentication logic, but this is where you would authenticate the user based on the provided credentials.

Finally, the 'app.listen' method is used to start the server on port 3000. A message is logged to the console to indicate that the server has started successfully.

By explicitly declaring the dependencies and using a dependency manager, the fixed code ensures that the project is built and packaged consistently, reducing the risk of using incompatible or vulnerable dependency versions.

References​

Last updated on