Open source library security rating
An open source library rating is generated for an open source library based on dependencies of the library, vulnerabilities of the library, an age of the library, a popularity of the library, a history of the library, or any suitable combination thereof. The rating of a specific version of a library may be generated based on a base score for all versions of the library and a version score for the specific version of the library. An authorization system receives a request from a developer to add a library to a software application. In response, the authorization system accesses a rating for the library. Based on the rating, the authorization system approves the request, denies the request, or recommends an alternative library.
1. A method comprising:
receiving, via a network, a request to add a version of an open source library to an application;
accessing a database to obtain first data comprising a first score that applies to all of a plurality of versions of the open source library, the requested version being one of the plurality of versions, the first score being based on a duration of time elapsed since a vulnerable release of the open source library;
accessing the database to obtain second data comprising a second score that is specific to the requested version of the open source library;
generating, by one or more processors, a rating for the requested version of the open source library based on the first score and the second score; and
based on the rating, communicating, via the network, an approval of the request.
2. The method of claim 1 , further comprising:
accessing the database to obtain third data comprising a third score that is based on a dependency of the requested version of the open source library on a second open source library; and
wherein the generating of the rating is further based on the third score.
3. The method of claim 1 , further comprising:
requesting, via the network, fourth data representing a published time and severity of each known vulnerability of the requested version of the open source library;
receiving, in response to the request, the fourth data;
determining, based on the published time of each of the known vulnerabilities of the requested version of the open source library and a release time of the requested version of the open source library, a duration of time for each of the known vulnerabilities of the requested version of the open source library;
generating the second score based on the durations of time for the known vulnerabilities of the requested version of the open source library; and
storing the second score in the database.
4. The method of claim 3 , wherein:
the generating of the second score comprises applying weights to the severities of the known vulnerabilities of the requested version of the open source library, such that vulnerabilities with shorter durations affect the second score more than vulnerabilities with longer durations.
5. The method of claim 3 , wherein:
the generating of the second score comprises applying weights to the severities of the known vulnerabilities of the requested version of the open source library, such that vulnerabilities with higher severities affect the second score more than vulnerabilities with lower severities.
6. The method of claim 1 , wherein:
the generating of the rating for the open source library is further based on a number of libraries that depend on the open source library.
7. The method of claim 6 , wherein:
a lower number of libraries that depend on the requested version of the open source library has a greater effect on the rating than a higher number of libraries that depend on the requested version of the open source library.
8. The method of claim 1 , wherein:
the generating of the rating for the requested version of the open source library is further based on an age of the requested version of the open source library.
9. The method of claim 8 , wherein:
a greater age has a greater effect on the rating than a lesser age.
10. A system comprising:
a memory that stores instructions; and
one or more processors configured by the instructions to perform operations comprising:
receiving, via a network, a request to add a version of an open source library to an application;
accessing a database to obtain first data comprising a first score that applies to all of a plurality of versions of the open source library, the requested version being one of the plurality of versions, the first score being based on a duration of time elapsed since a vulnerable release of the open source library;
accessing the database to obtain second data comprising a second score that is specific to the requested version of the open source library;
generating a rating for the requested version of the open source library based on the first score and the second score; and
based on the rating, communicating, via the network, an approval of the request.
11. The system of claim 10 , wherein the operations further comprise:
accessing the database to obtain third data comprising a third score that is based on a dependency of the requested version of the open source library on a second open source library; and
wherein the generating of the rating is further based on the third score.
12. The system of claim 10 , wherein the operations further comprise:
requesting, via the network, fourth data representing a published time and severity of each known vulnerability of the requested version of the open source library;
receiving, in response to the request, the fourth data;
determining, based on the published time of each of the known vulnerabilities of the requested version of the open source library and a release time of the requested version of the open source library, a duration of time for each of the known vulnerabilities of the requested version of the open source library;
generating the second score based on the durations of time for the known vulnerabilities of the requested version of the open source library; and
storing the second score in the database.
13. The system of claim 12 , wherein:
the generating of the second score comprises applying weights to the severities of the known vulnerabilities of the requested version of the open source library, such that vulnerabilities with shorter durations affect the second score more than vulnerabilities with longer durations.
14. The system of claim 12 , wherein:
the generating of the second score comprises applying weights to the severities of the known vulnerabilities of the requested version of the open source library, such that vulnerabilities with higher severities affect the second score more than vulnerabilities with lower severities.
15. The system of claim 10 , wherein:
the generating of the rating for the open source library is further based on a number of libraries that depend on the open source library.
16. The system of claim 15 , wherein:
a lower number of libraries that depend on the requested version of the open source library has a greater effect on the rating than a higher number of libraries that depend on the requested version of the open source library.
17. A non-transitory computer-readable medium that stores instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving, via a network, a request to add a version of an open source library to an application;
accessing a database to obtain first data comprising a first score that applies to all of a plurality of versions of the open source library, the requested version being one of the plurality of versions, the first score being based on a duration of time elapsed since a vulnerable release of the open source library;
accessing the database to obtain second data comprising a second score that is specific to the requested version of the open source library;
generating a rating for the requested version of the open source library based on the first score and the second score; and
based on the rating, communicating, via the network, an approval of the request.
18. The non-transitory computer-readable medium of claim 17 , wherein the operations further comprise:
accessing the database to obtain third data comprising a third score that is based on a dependency of the requested version of the open source library on a second open source library; and wherein
the generating of the rating is further based on the third score.
19. The non-transitory computer-readable medium of claim 17 , wherein the operations further comprise:
requesting, via the network, fourth data representing a published time and severity of each known vulnerability of the requested version of the open source library;
receiving, in response to the request, the fourth data;
determining, based on the published time of each of the known vulnerabilities of the requested version of the open source library and a release time of the requested version of the open source library, a duration of time for each of the known vulnerabilities of the requested version of the open source library;
generating the second score based on the durations of time for the known vulnerabilities of the requested version of the open source library; and
storing the second score in the database.
20. The non-transitory computer-readable medium of claim 19 , wherein:
the generating of the second score comprises applying weights to the severities of the known vulnerabilities of the requested version of the open source library, such that vulnerabilities with shorter durations affect the second score more than vulnerabilities with longer durations.