dependency-check / dependency-check/DependencyCheck

Detect outdated JavaScript libraries on a CDN

Open
#4,711 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**

I'm auditing an application that uses an insecure version of JQuery. It loads this from a CDN (and uses SRI) - but Dependency Checker doesn't spot it.

**Describe the solution you'd like**

Dependency Checker identifies URLs on a list of common CDN domains and audits the external reference. This might cause some false positives (e.g. URLs within comments) but that would be ok for my purposes.

**Describe alternatives you've considered**

Burp Professional does detect these and I combine the results from Burp with Dependency Checker.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.