Rashin Tsarin Raba Sigar da Rudani na Dogaro

A fannin haɓaka software, muna dogara ne akan namu da kuma na ɓangare na uku ko kayan tarihi. Gudanar da Dogara mai sassauƙa yana da mahimmanci ga software na zamani. Manajan fakiti kamar NPM, Maven, pip or NuGet galibi ana amfani da su don ƙayyade abubuwan da suka dogara da software. An tsara waɗannan kayan aikin ne da la'akari da sauƙi da sauƙin amfani, ba tsaro ba.

Matsalar

Matsalar ita ce sassauci da sauƙin amfani ga masu haɓaka software suna kiran mugayen mutane, waɗanda ke ganin dogaro da software a matsayin abin sha'awa ga kasuwancinsu. Sakamakon: miyagun mutane sun bi duk hanyoyin kai hari da aka nuna a nan. Tushe: "Tarin Wuka na Backstabber: Bita kan Hare-haren Sarrafa Manhajar Buɗaɗɗiya"

A cikin wannan rubutun za mu mayar da hankali kan amfani da sanarwar sigar buɗewa, a ma'anar cewa sigar da aka sauke ba a gyara ta ba amma dole ne ta kasance cikin wani yanki. A lokacin ginawa, mafi girman sigar da ke akwai wacce ta dace da kewayon sigar da aka ƙayyade ana zaɓar ta kuma zazzage ta / shigar da ita ta mai sarrafa fakitin.

Bari mu kwatanta bayyanannun sanarwa a cikin sanarwar dogaro ga masu sarrafa fakiti daban-daban:

• • NPM: fakamari.json

{

 

   ...

   "dogara": {
      ...
      "ya yarda": ">=1.3.8",
      "lodash": "~4.16.0",
      ...
   },
   ...
}

Za a shigar da mafi girman sigar da ke akwai wadda ba ta ƙasa da 1.3.8 ba don fakitin karɓa, da kuma mafi girman sabuntawar 'faci' don lodash a cikin kewayon 4.16.x.

• • Maven: fansa.xml

...

...

     gama-gari-io
     gama-gari-io
     SAKI

...

...

Za a ƙara fitowar ƙarshe da ake da ita don fayil ɗin commons-io (jar file) a matsayin dogaro.

• • Pip: saita.py

...
saitin(
    ...
    install_requires=['peppercorn', 'launchpadlib'],
    ...
)
...

Irin waɗannan tsare-tsaren sigar buɗewa suna da kyau da mara kyau. Nau'in da ke da kyau shi ne sabbin sigar yawanci ya ƙunshi gyare-gyaren aiki da inganci, gyaran kwari, da facin tsaro, waɗanda ake haɓakawa ta atomatik. Lura cewa ga yawancin ayyukan gaske, ba a mayar da gyare-gyare zuwa ƙananan fitarwa na baya ba, sai dai wataƙila don raunin tsaro mai haɗari. Sigar buɗewa kuma tana da kyau don amfani a cikin ɗakunan karatu, don rage adadin sigar da ake buƙatar shigarwa lokacin da aka warware duk abubuwan da suka dogara da su.

Amma jerin sigar buɗewa suna da mummunan sakamako. Ba ku san ainihin waɗanne sigar za a shigar a lokacin ginawa ba, kuma ginawa ba za a iya maimaitawa ba. Kuma akwai kuma duhu gefe da sigar buɗewa. Idan wani mummunan mutum ya sami damar buga wani ɓangaren ɓarna a cikin ma'ajiyar jama'a tare da babban sigar da ta dace da yankin buɗewar ku, ginin ku na gaba zai haɗa da ɓangaren ɓarna, wataƙila ma aiwatar da malware a cikin rubutun shigarwa wanda za a iya aiwatar da shi ta atomatik. Rufe nauyin harin fasaha ce.

Wannan shi ake kira da Rashin Sigar Pinning fitowar.

Mugayen masu aikata laifuka koyaushe suna ƙoƙarin sanya nau'ikan ɓarna na shahararrun fakitin buɗe tushen. Suna iya samun damar shiga maɓallan ma'ajiyar fakiti a cikin ɓoye sirri; galibi suna amfani da injiniyan zamantakewa ko ɓoye dogaro da mugunta a cikin wani abu mai amfani da alama mai amfani. pull requestHar ma wasu marubuta kaɗan da kansu wata rana sun yanke shawarar cewa duniya ba ta da adalci kuma suka ci zarafin abokan cinikinsu protestware a cikin fakitin nasu!

Yanzu ka yi tunanin kana aiki ne ga wata ƙungiya da ke amfani da abubuwan ciki da kuma waɗanda ba su da tushe.
Idan wani mummunan ɗan wasa ya san sunan irin waɗannan abubuwan ciki, zai iya/ta iya buga wani ɓangare mai suna iri ɗaya a cikin ma'ajiyar jama'a. Manajan fakiti da yawa suna fara samun abubuwan da jama'a ke amfani da su, kuma idan an zaɓi sigar da kyau kuma sigar da aka ayyana a matsayin abin dogaro a buɗe take, to wannan batu an sanya mata suna! Ruɗani game da Dogaro.

Bari mu nuna misali. A ce a cikin aikin NPM ɗinmu muna da dogaro da wani ɓangare na sirri:

• • NPM: fakamari.json

{
  "suna": "aikin-aikina",

 

  ...
  "dogara": {

    ...
    "na-private-dep": ">=1.0.0",

    ...

   }

   ...

}

 

Mai kai harin zai iya ƙirƙirar babban sigar my-private-dep (kamar 99.0.0) kuma ya buga shi a cikin ma'ajiyar npm ta jama'a, tare da asusunsa na bogi (mai kai harin ba ya buƙatar yin komai da ƙungiyara). Manajan kunshin NPM zai shigar da dogaro mai cutarwa, sau da yawa tare da sakamako mai ban tsoro.

Maganin

Domin guje wa waɗannan matsaloli a tsarin gina manhajarmu, ya kamata mu bi ƙa'idodi masu tsauri kan yadda za mu ayyana nau'ikan kayan aiki, waɗanda suka dogara da fasahar da aka yi amfani da ita. Abu mafi mahimmanci shi ne cewa takamaiman sigar fakiti, da zarar an buga ta a cikin ma'ajiyar bayanai, ya kamata ta kasance ba ta canzawa (don guje wa karyewar masu dogaro, ba kawai don dalilan tsaro ba).

Manufar gabaɗaya ita ce a gyara (fil) sigar, koyaushe yana duba cewa sigogin da aka gyara na sassan (gami da DUKKAN abubuwan da suka dogara da su na wucin gadi) ba su da malware, kuma wannan yana yiwuwa godiya ga fayilolin kullewa wanda manajojin fakiti da yawa ke bayarwa. Bari mu ga yadda pinning sigar ke aiki ga manajojin fakiti daban-daban. Akwai ciniki mai sauƙi tsakanin sabuntawa akai-akai na sigar don gyara raunin da aka sani da kuma sigar rabawa don guje wa ginawa marasa tabbas da kuma yiwuwar hare-haren sarkar samar da kayayyaki.

• • NPM:
    Manajan kunshin npm ko zare suna amfani da fayilolin kulle daban-daban (npm-shrinkwrap.json / package-lock.json ko yarn.lock, bi da bi) waɗanda ke lissafa sigogin da aka gyara don duk abubuwan da suka dogara, kai tsaye da kuma kaikaice. Ya kamata fayilolin kulle su kasance ƙarƙashin ikon sigar, in ba haka ba sauran masu haɓakawa / nodes na ginawa na iya ƙarewa da sigogi daban-daban. Guji shigar da npm sai dai idan lokacin haɓakawa kuna buƙatar sabunta abubuwan da suka dogara (misali don shigar da gyare-gyaren tsaro). Yi amfani da mafi ƙayyadaddun npm ci (Tsabtace Shigarwa) gabaɗaya, don haka mai sarrafa kunshin zai yi amfani da fayil ɗin kulle ko ya ƙare da kuskure idan babu fayil ɗin kullewa, ko kuma bai dace da package.json ba. Idan an duba sigogin da aka lissafa don malware, fayil ɗin kulle yana tabbatar da cewa babu wani mummunan abu da zai faru a lokacin ginawa.

    Ga abubuwan da ke cikin ciki, ana ba da shawarar ƙirƙirar Tsarin NPM ƙungiyar ce ke kula da ita (kamar @myorg), kuma tana amfani da wannan damar a cikin dogaro (kamar @myorg/my-private-dep), wanda zai iya samun ganuwa ta sirri kawai. Wannan toshewa yana toshewa. rikicewar dogaro hare-hare, kamar yadda memba na ƙungiyar da ke da damar rubutu kawai zai iya buga fakiti a ƙarƙashin irin wannan ikon.

• • Maven:
    Maven / Gradle ba su da fayilolin makulli (amma duba wannan labarin StackOverflow).

    Ba a amfani da jeri na sigar tare da Maven/Gradle kamar yadda ake amfani da shi tare da sauran yanayin halittu. Kawai a guji kewayon sigar da kuma nau'ikan da suka fi shahara a baya ko kuma waɗanda suka fi shahara. Ya kamata a duba nau'ikan da ba a kaikaice ba. Sifofin Maven Plugin kayan aiki ne mai kyau don sarrafa sigar.

    Lura cewa Maven koyaushe yana da ra'ayin tsarin ƙungiya (ɓangaren rukuni na dogaro), kuma ruɗani na dogaro da kai ba shi da matsala kwata-kwata ga wannan yanayin.

• • Pip:
    A cikin Python akwai kayan aiki daban-daban don sarrafa fayilolin makulli:

    - pipenv, wanda ke samar da fayil ɗin kulle Pipfile.lock.
    - shayari, wanda ke haifar da poetic.lock.
    - daskare pip, umarnin da ke samar da requirements.txt wanda ke aiki azaman fayil ɗin kullewa. Duba idan duk abubuwan dogaro suna amfani da sigogin da aka gyara tare da mai aiki ==. Sannan pip install -r requirements.txt yana amfani da abubuwan dogaro da aka gyara.

Tuna cewa fayilolin makulli da ke sama ya kamata su kasance ƙarƙashin ikon sigar, kuma umarnin ginawa da aka zaɓa ya kamata ya yi amfani da fayil ɗin makulli.

Ma'ajiyar fakitin da aka saba amfani da ita tare da pip (PyPI) ba ta da wuraren sanya suna, kuma tana da saurin kamuwa da hare-haren rikicewar dogaro. Gujewa ruɗani game da dogaro da kai a cikin tsarin python ba abu ne mai sauƙi ba, kuma wasu marubuta sun ba da shawarar amfani da ma'ajiyar ciki don zama wakili ga dogaro da jama'a da aka samo daga PyPI, amma ɗaukar dogaro na sirri da farko daga ma'ajiyar ciki (-index-url ya kamata ya nuna ma'ajiyar ciki, ba PyPI ba, kuma ya kamata a cire -extra-index-url).

Wasu hare-hare na gaske

Harin Getcookies: Jarumin dustin87 ya ƙara dogaro kai tsaye ga sanannen fakitin mai aikawa na npm zuwa wani fakitin mugunta mai ƙofar baya ta RCE (gCOMMANDhDATAi):

JSON.stringify(req.headers).replace(/g([a-f0-9]{4})h((?:[a-f0-9]{2})+)i/gi, (o, p, v) => {})

Duk da cewa an cire shi daga aiki (babu masu bita!), mailparser har yanzu yana karɓar kusan saukewa 64,000 a kowane mako. Wannan lamari ne na kusan kai hari, domin RCE ba ta yi aiki a zahiri bacised.

An buga NPM wannan matsayi tare da cikakkun bayanai game da harin getcookies.

Ruɗani game da Dogaro:

Alex Birsan ya gano matsalar rikicewar dogaro a shekarar 2021 kuma ya buga wani rubutu mai taken "Yadda Na Kutse Cikin Apple, Microsoft Da Wasu Kamfanoni Da Dama".

Ka tuna cewa don npm ya kamata a ajiye tsarin ƙungiyar kamar @myorg, kuma ya kamata a gyara fakitin ciki don amfani da tsarin.

Tare da pip, rajistar jama'a ta gama gari ta PyPI ba ta da scopes/namespaces. Kowace fakitin sirri na iya samun squat na fakitin jama'a tare da suna iri ɗaya da fakitin ciki, amma babu komai, kuma wataƙila yana haifar da kuskure lokacin amfani da shi, don haka za a iya gano shi idan an samo shi ba da gangan ba.

Node-ipc:

Mai kunshin, lokacin da yaƙin Rasha da Ukraine ya fara, ya saka lambar mugunta don cire fayiloli bazuwar, lokacin da aka shigar da su a rukunin yanar gizon Rasha da Belarus. Fayil ɗin ssl-geospec.js yana yin irin wannan bambancin yanki:

Abin sha'awa, wasu fakitin sun yi amfani da sigar buɗewa don dogaro da node-ipc, kamar tsarin Vue.js mai shahara, kuma masu kula da shi sun sami roƙon gaggawa don haɗa dogaro da node-ipc akan sigar aminci.

wannan rubutun ya ƙunshi ƙarin bayani akan wannan ɓarna, wanda ya wuce mataki na sauran Masu zanga-zanga al'amurra.

Ƙarshen Magana

Buɗaɗɗun sigar ya kamata faufau ana amfani da su a cikin ayyukan software masu haɗin gwiwa. Suna sa ginawa ba za a iya sake samarwa ba, kuma masu kai hari na iya amfani da su kuma su sami damar shigar da malware ta hanyar kai hari ga bishiyoyin dogaro kamar rikicewar dogaro da aka ambata a baya.

Kuskuren tsari kamar Buɗaɗɗen sigar, rashin haɗa sigar, ko abubuwan ciki da ba a iya gano su ba ya kamata a guji hakan. Abu na farko shi ne a gano irin waɗannan matsalolin, wataƙila ma a toshe ginin idan aka same su, sannan a daidaita tsarin aiki.

Gano kurakurai da rashin daidaito a cikin abubuwan da ake dogara da su ta atomatik, bayar da rahoton abubuwan da ake zargi da dogaro waɗanda za su iya zama masu rauni ga takamaiman hare-haren sarkar samar da kayayyaki kamar rikicewar dogaro, duk tare da kayan aikin gyara masu aiki, yana ɗaya daga cikin manyan manufofin Dandalin Xygeni.