JGe356144 (Community Member) asked a question.
Does VeraCode SCA scan report library vulnerability that are only used by libraries in devDependencies?
The VeraCode SCA scan reported "Prototype pollution" vulnerability of ajv npm library (Version: 6.10.2). However, this library is only used by sass-loader and @vue/cli-plugin-babel. Both of them are in devDependencies. My understanding is the libraries used in devDependencies would not be compiled into the PROD code. They are only used in DEV time. Does VeraCode SCA scan report library vulnerability that are only used by libraries in devDependencies?
.png){kind=logo}
Hi @JGe356144 (Community Member) ,
Veracode Software Composition Analysis ignores dependencies marked in the package-lock.json with "dev": true.
If you find that it is reporting vulnerabilities on devDependencies please verify you are including package-lock.json, as mentioned in the packaging guide for JavaScript:
NPM
Include npm-shrinkwrap.json, package-lock.json, or a node_modules directory in the root of your ZIP archive.
Note: If you include a node_modules directory without either npm-shrinkwrap.json or package-lock.json, your results may include development dependencies.
Thank you,
Boy Baukema
We are using npm-shrinkwrap.json file recommended in VeraCode SCA analysis results. I am a bit confused about the SCA scan results. For example, the scan reports "Regular Expression Denial Of Service" vulnerability in acorn version 5.7.4. However, the acorn 5.7.4 in my npm-shrinkwrap.json file has dev: true flag:
"dependencies": {
"acorn": {
"version": "5.7.4",
"resolved": "https://registry.npmjs.org/acorn/-/acorn-5.7.4.tgz",
"integrity": "sha512-1D++VG7BhrtvQpNbBzovKNc1FLGGEE/oGe7b9xJm/RFHMBeUaUGpluV9RLjZa47YFdPcDAenEYuq9pQPcMdLJg==",
"dev": true
},
The dependency graph for acorn is:
@vue/cli-plugin-unit-jest 4.5.13 -> jest 24.9.0 -> jest-cli 24.9.0 -> jest-config 24.9.0 -> jest-environment-jsdom 24.9.0 -> jsdom 11.12.0 -> acorn 5.7.4
Anything I am missing here?
Thanks,
Jason
Hi Jason,
That look correct.
I would recommend you contact our technical support team for further review.
Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
In that case please provide a link to your SCA results and a link to this community post.
Thank you,
Boy Baukema
Another example is ejs library. The dependency graph is:
@vue/cli-service 4.5.13 -> webpack-bundle-analyzer 3.9.0 -> ejs 2.7.4
It is definitely the dev dependency. Also, the latest version of @vue/cli-service is 4.5.13. In this case, how would we upgrade the ejs library version? I tried manually change the ejs version to higher version in npm-shrinkwrap.json, remove the node_modules and run npm install. After that, the ejs version is changed by npm install to original version 2.7.4.
Are you using Yarn?
This may be helpful: https://stackoverflow.com/a/48524488/4512
Unfortunately, without more details of the application it is difficult to say.
I would recommend you contact our technical support team for further review.
Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
In that case please provide a link to your SCA results and a link to this community post.
Thank you,
Boy Baukema
It turns out by default, VeraCode SCA scan includes the libraries in devDependencies. In order to exclude them, you need to set scope flag (We are using PowerShell script for agent based SCA scan):
$Env:SRCCLR_NPM_SCOPE="production"
Following is the PowerShell script that performs SCA scan:
git checkout -b $(Build.SourceBranchName)
$Env:SRCCLR_USE_DOTNET_EXEC="MSBUILD"
$Env:SRCCLR_SKIP_DOTNET_RESTORE="true"
$Env:SRCCLR_SCAN_COLLECTORS="npm"
$Env:SRCCLR_NPM_SCOPE="production"
$Env:SRCCLR_API_TOKEN="$(Agent_Key)"
Set-ExecutionPolicy AllSigned -Scope Process -Force
E:\Veracode\srcclr\srcclr-3.5.0\bin\srcclr scan "$(Project_Location)" --debug