Looking at how many sites use vulnerable JavaScript libraries
1–10 of 53 posts
Re: Looking at how many sites use vulnerable JavaScript libraries
#2Even if we have better tooling to make updating dependencies easy, there's still the fact that there's a lot of applications in production that are not maintained. If there are no maintainers there will be no updates..
Re: Looking at how many sites use vulnerable JavaScript libraries
#3One might even say that 100% of 333,410 sites use vulnerable javascript libraries
Re: Looking at how many sites use vulnerable JavaScript libraries
#4We run nsp on our production services in CI before merge. The number of false positives I have tracked down is infinitely higher than the number of vouln's found. I literally mean this, we have never seen one disclosure which resulted in a viable attack on our production services.
For example, recently a bunch of ReDOS voulns were reported in popular libraries. None of which were in code paths hit by our configurations.
So needless to say, I think this is a sensationalist headline.
Re: Looking at how many sites use vulnerable JavaScript libraries
#5We run nsp on our production services in CI before merge. The number of false positives I have tracked down is infinitely higher than the number of vouln's found. I literally mean this, we have never seen one disclosure which resulted in a viable attack on our production services. For example, recently a bunch of ReDOS voulns were reported in popular libraries. None of which were in code paths hit by our configuratio…
NOTE: I am NOT saying we have had no security voulns. Just that the snyk and nsp disclosures on packages do not mean that those applications are vulnerable.
Re: Looking at how many sites use vulnerable JavaScript libraries
#6One might even say that 100% of 333,410 sites use vulnerable javascript libraries
Those means different things.
Their wording means "we checked X sites and 77% of them met some criteria", which can be extrapolated to higher values of X (assuming the proper statistical care is taken, etc).
Your wording implies the same, but that's not good because you can't extrapolate to a larger X. You chose the sites after knowing they already met the criteria, and that changes the meaning.
Re: Looking at how many sites use vulnerable JavaScript libraries
#7> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability.
Does that even matter? No Front-End JS Library should actually make your backend vulnerable.
Re: Looking at how many sites use vulnerable JavaScript libraries
#8If it's an automated scan, I'd be skeptical. Currently dealing with some overzealous security folks who put adherence to their scan tool over common sense, and insist that we lock down Oracle PL/SQL vulnerabilities in an application that doesn't use any flavor of SQL...
Re: Looking at how many sites use vulnerable JavaScript libraries
#9> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. Does that even matter? No Front-End JS Library should actually make your backend vulnerable.
An XSS issue could make your users' data vulnerable.
Re: Looking at how many sites use vulnerable JavaScript libraries
#10> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. Does that even matter? No Front-End JS Library should actually make your backend vulnerable.
An XSS issue could make your users' data vulnerable.
is still only an issue if you pass untrusted data to your js code.