84 lines
2.0 KiB
Plaintext
84 lines
2.0 KiB
Plaintext
When installing dependencies, package managers like ``++npm++`` will
|
|
automatically execute shell scripts distributed along with the source code.
|
|
Post-install scripts, for example, are a common way to execute malicious code
|
|
at install time whenever a package is compromised.
|
|
|
|
|
|
== Ask Yourself Whether
|
|
|
|
* The execution of dependency installation scripts is required for the application to function correctly.
|
|
|
|
There is a risk if you answered no to the question.
|
|
|
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
Execution of third-party scripts should be disabled if not strictly necessary
|
|
for dependencies to work correctly.
|
|
Doing this will reduce the attack surface and block a well-known supply chain
|
|
attack vector.
|
|
|
|
Commands that are subject to this issue are: `npm install`, `yarn install` and `yarn`
|
|
(`yarn` without an explicit command will execute `install`).
|
|
|
|
|
|
== Sensitive Code Example
|
|
|
|
[source,docker,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
FROM node:latest
|
|
|
|
# Sensitive
|
|
RUN npm install
|
|
----
|
|
|
|
[source,docker,diff-id=2,diff-type=noncompliant]
|
|
----
|
|
FROM node:latest
|
|
|
|
# Sensitive
|
|
RUN yarn install
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
[source,docker,diff-id=1,diff-type=compliant]
|
|
----
|
|
FROM node:latest
|
|
|
|
RUN npm install --ignore-scripts
|
|
----
|
|
|
|
[source,docker,diff-id=2,diff-type=compliant]
|
|
----
|
|
FROM node:latest
|
|
|
|
RUN yarn install --ignore-scripts
|
|
----
|
|
|
|
== See
|
|
|
|
* CWE - https://cwe.mitre.org/data/definitions/506[CWE-506 - Embedded Malicious Code]
|
|
* CWE - https://cwe.mitre.org/data/definitions/829[CWE-829 - Inclusion of Functionality from Untrusted Control Sphere]
|
|
* https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes/[ESLint blog] - Postmortem for Malicious Packages Published on July 12th, 2018
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
* Omitting `--ignore-scripts` can lead to the execution of shell scripts. Make sure it is safe here.
|
|
|
|
=== Highlighting
|
|
|
|
Highlight the command and the subcommand if the latter is present.
|
|
|
|
'''
|
|
|
|
endif::env-github,rspecator-view[]
|
|
|