November 2016 Summaries

The EJS (Embedded JavaScript Templates) package, a popular JavaScript templating engine, contains a high-severity Remote Code Execution vulnerability that can be exploited by mixing in data and options into a single object, allowing an attacker to inject malicious code. This vulnerability was disclosed on November 27th and fixed within one day through the release of version 2.5.3, which blacklists the `root` option to prevent it from being included with user data. To fix this issue, users can update their EJS package to the latest version using tools like Snyk or by manually updating their dependencies. The vulnerability highlights the importance of proper configuration and sanitization when using templating engines to avoid security risks.

A brief history of modularity` by Ashley Williams highlights the importance of modularization in software development, citing its benefits such as reuse of common code, separation of concerns, and easier documentation and testing. However, it also acknowledges the challenges and costs associated with modularization, including increased complexity and the need to evaluate dependencies for security and maintainability. The talk emphasizes that modularization is not just about writing reusable code, but also about creating disposable software that can be easily deleted or modified without affecting other parts of the system. Williams argues that modularization requires a nuanced approach, taking into account the time-based element of change management in software development, where strategies may need to be reassessed over time to determine their effectiveness.

Snyk has announced its support for Ruby, allowing users to test their GitHub repositories for vulnerable gems with a single click, and automatically generating pull requests to address issues. The service is free for open-source projects and provides continuous monitoring to prevent adding new vulnerabilities as code evolves. Snyk's Ruby integration is currently limited to Bundler-managed applications with Gemfile.lock files in the repository root, but the company plans to expand its support to gem libraries and other use cases in the future.

The Serverless Snyk plugin is a plugin for the Serverless framework that helps prevent vulnerable packages in applications, using Snyk's vulnerability scanning and patching capabilities. It seamlessly integrates into the deployment process, automatically scanning for known vulnerabilities, applying patches and upgrades, and monitoring dependencies for proactive alerting of new vulnerabilities on each deploy. The plugin can be easily installed by running npm install serverless-snyk --save, and its configuration is handled through a serverless.yml file. With the plugin, developers can focus on building their application while having automated security protection against known vulnerabilities in their dependencies.