Lior Amsalem

Open source is a very big part of my daily work, in a start or as solo entrepreneur. I relay on other people’s hard work and code to speed up my work and innovate faster and create faster. However picking the right open source could be a risky decision, in some cases it could very much be a security, info sec risky decision. If we pick something that might look open source but in reality it’s not, it might be missing source code on open git repository and have no more than one engineer developing that project, it could hold a high risk at that one engineer to push whatever code they wish for.

In below examples(right now one, but i’ll add more over time) I’ll try and show you bad examples of open source code, projects and communities that i might try and avoid using. Or even open source code that has implementation of code that is questionable, the first example might ring a bell for some of you, so let’s take a look.

Example 1

Let’s take a look at this country flag NPM package, at first sight it looks good with ince amount of downloads per week, however, once we go throgught that metric, which is a good metric (because it means there’s higher chance that this package has more eyes on it rather a package with few downloads) it’s just not enough.

No Github Community
First things first, there’s a link to github repo however that link is to another project, there’s also no link to a github repo or bitbucket or other git repo whatever, so the process of development of that project is a bit hidden. and it means that there’s no eyes on the source code and might not even have eyes on the process of the development of the project, it means there’s no feedback and discussion on technical implementation on probably all the development, ideas and security verification go through one person.

Implementation
We can still take a look at the code implementation of the project, because we download the package to our node_moduels folder and also, thankfully NPM site allow us to allow take a look at the code and source code. The first thing that jump to my eyes when I look into the project “node moduels” or “dist” folder is the fact it has no flags in it! it doesn’t contain SVG or GIF or JPG of flags! so how the flags are loaded? they are loaded as such:

  if (svg) {
    const flagUrl = `${cdnUrl}${countryCode.toLowerCase()}.${cdnSuffix}`;

    return (
      <img
        {...props}
        src={flagUrl}
        style={{
          display: 'inline-block',
          width: '1em',
          height: '1em',
          verticalAlign: 'middle',
          ...style,
        }}

The code above load the flags in a dynamic manner, and it might means that we load an 3rd party package to our company project and this approach or the years can be further develop to load other things! or we might the risk that the dynamic image we load (which is an SVG) will load something else from that 3rd party external source! We have no static control of the source of that images, content, file content of SVG – as far as we know, anything can be loaded from that external source.

Example 2

Soon…