Open source library security rating
An open source library rating is generated for an open source library based on dependencies of the library, vulnerabilities of the library, an age of the library, a popularity of the library, a history of the library, or any suitable combination thereof. The rating of a specific version of a library may be generated based on a base score for all versions of the library and a version score for the specific version of the library. An authorization system receives a request from a developer to add a library to a software application. In response, the authorization system accesses a rating for the library. Based on the rating, the authorization system approves the request, denies the request, or recommends an alternative library.
1. A system comprising:
a memory that stores instructions; and
one or more processors configured by the instructions to perform operations comprising:
receiving, via a network, a request for a version of a first library;
accessing a database to obtain first data comprising a first score that applies to all of a plurality of versions of the first library, the requested version being one of the plurality of versions;
accessing second data comprising a second score that is based on a dependency of the requested version of the first library on a second library;
generating a rating for the requested version of the first library based on the first score and the second score; and
based on the rating, communicating, via the network, an approval of the request.
2. The system of claim 1 , wherein the operations further comprise:
requesting, via the network, fourth data representing a published time and severity of each known vulnerability of the requested version of the first library;
receiving, in response to the request, the fourth data;
determining, based on the published time of each known vulnerability of the requested version of the first library and a release time of the requested version of the first library, a duration of time for each known vulnerability of the requested version of the first library;
generating the second score based on the durations of time for the known vulnerabilities of the requested version of the first library; and
storing the second score in the database.
3. The system of claim 2 , wherein:
the generating of the second score comprises applying weights to the severity of each known vulnerability of the requested version of the first library, such that vulnerabilities with shorter durations affect the second score more than vulnerabilities with longer durations.
4. The system of claim 2 , wherein:
the generating of the second score comprises applying weights to the severity of each known vulnerability of the requested version of the first library, such that vulnerabilities with higher severities affect the second score more than vulnerabilities with lower severities.
5. The system of claim 2 , wherein the first score is further based on a popularity of the first library.
6. The system of claim 5 , wherein a lower number of libraries that depend on the requested version of the first library has a greater effect on the rating than a higher number of libraries that depend on the requested version of the first library.
7. A non-transitory computer-readable medium that stores instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving, via a network, a request for a version of a first library;
accessing a database to obtain first data comprising a first score that applies to all of a plurality of versions of the first library, the requested version being one of the plurality of versions;
accessing second data comprising a second score that is based on a dependency of the requested version of the first library on a second library;
generating a rating for the requested version of the first library based on the first score and the second score; and
based on the rating, communicating, via the network, an approval of the request.
8. The non-transitory computer-readable medium of claim 7 , wherein the operations further comprise:
requesting, via the network, fourth data representing a published time and severity of each known vulnerability of the requested version of the first library;
receiving, in response to the request, the fourth data;
determining, based on the published time of each known vulnerability of the requested version of the first library and a release time of the requested version of the first library, a duration of time for each known vulnerability of the requested version of the first library;
generating the second score based on the durations of time for the known vulnerabilities of the requested version of the first library; and
storing the second score in the database.
9. The non-transitory computer-readable medium of claim 8 , wherein:
the generating of the second score comprises applying weights to the severity of each known vulnerability of the requested version of the first library, such that vulnerabilities with shorter durations affect the second score more than vulnerabilities with longer durations.
10. The non-transitory computer-readable medium of claim 8 , wherein:
the generating of the second score comprises applying weights to the severity of each known vulnerability of the requested version of the first library, such that vulnerabilities with higher severities affect the second score more than vulnerabilities with lower severities.
11. The non-transitory computer-readable medium of claim 7 , wherein the first score is further based on a popularity of the first library.
12. The non-transitory computer-readable medium of claim 11 , wherein a lower number of libraries that depend on the requested version of the first library has a greater effect on the rating than a higher number of libraries that depend on the requested version of the first library.
13. A method comprising:
receiving, via a network, a request for a version of a first library;
accessing a database to obtain first data comprising a first score that applies to all of a plurality of versions of the first library, the requested version being one of the plurality of versions;
accessing second data comprising a second score that is based on a dependency of the requested version of the first library on a second library;
generating, by one or more processors, a rating for the requested version of the first library based on the first score and the second score; and
based on the rating, communicating, via the network, an approval of the request.
14. The method of claim 13 , further comprising:
requesting, via the network, fourth data representing a published time and severity of each known vulnerability of the requested version of the first library;
receiving, in response to the request, the fourth data;
determining, based on the published time of each known vulnerability of the requested version of the first library and a release time of the requested version of the first library, a duration of time for each known vulnerability of the requested version of the first library;
generating the second score based on the durations of time for the known vulnerabilities of the requested version of the first library; and
storing the second score in the database.
15. The method of claim 14 , wherein:
the generating of the second score comprises applying weights to the severity of each known vulnerability of the requested version of the first library, such that vulnerabilities with shorter durations affect the second score more than vulnerabilities with longer durations.
16. The method of claim 14 , wherein:
the generating of the second score comprises applying weights to the severity of each known vulnerability of the requested version of the first library, such that vulnerabilities with higher severities affect the second score more than vulnerabilities with lower severities.
17. The method of claim 13 , wherein the first score is further based on a popularity of the first library.
18. The method of claim 17 , wherein a lower number of libraries that depend on the requested version of the first library has a greater effect on the rating than a higher number of libraries that depend on the requested version of the first library.
19. The method of claim 13 , wherein the generating of the rating for the requested version of the first library is further based on an age of the requested version of the first library.
20. The method of claim 19 , wherein a greater age has a greater effect on the rating than a lesser age.