dependency-scanning

リポジトリの原文

見出し、例、コード、表、リンク、参照画像を含む原文を表示しています。

Dependency Scanning on Mobile

Instructions

Most reported mobile CVEs live in dependencies — third-party SDKs, networking libs, image loaders, JSON parsers. A weekly cadence beats a one-off audit.

1. Inventory First

You can't scan what you can't see. Produce an SBOM per build:

Android: CycloneDX Gradle plugin (org.cyclonedx.bom) produces bom.json.
iOS: cyclonedx-cocoapods / cyclonedx-swift for SwiftPM.
Flutter: cyclonedx_dart or parse pubspec.lock.
React Native: @cyclonedx/cdxgen handles npm + native.

Archive the SBOM with the release artifact. You will want it the day a new CVE drops.

2. Gradle / Android

gradle-versions-plugin flags outdated direct dependencies:

kotlin

// build.gradle.kts
plugins { id("com.github.ben-manes.versions") version "0.51.0" }

// Run: ./gradlew dependencyUpdates -Drevision=release

For CVEs, OWASP Dependency-Check or Snyk:

kotlin

plugins { id("org.owasp.dependencycheck") version "11.1.0" }
dependencyCheck {
    failBuildOnCVSS = 7.0f // fail on high / critical
    suppressionFile = "config/owasp-suppressions.xml"
}

3. CocoaPods / SwiftPM

pod outdated for CocoaPods outdated check.
bundler-audit / custom script hitting the GitHub Security Advisory DB for CVEs.
SwiftPM: Xcode 14+ shows a "Package Dependencies" pane; integrate Snyk / Socket for deeper checks.
Carthage: dying, migrate.

4. Flutter / pub.dev

dart pub outdated on every PR.
Monitor pubspec.lock in review — large transitive changes often hide breaking updates.
pana scores each package on health / maintenance; good signal for low-maintenance abandons.

5. React Native / npm

npm audit / pnpm audit / yarn npm audit on every install.
Pin via a lockfile (package-lock.json / pnpm-lock.yaml). Never "^"-float sensitive deps in production.
Watch for postinstall scripts from dependencies — supply-chain attacks increasingly target these.
socket.dev or snyk provides behavioral analysis (network access, file writes from a JS package).

6. GitHub Dependabot

Enable across platforms:

yaml

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: gradle
    directory: "/"
    schedule: { interval: weekly }
    groups:
      non-major: { update-types: [minor, patch] }
  - package-ecosystem: cocoapods
    directory: "/ios"
    schedule: { interval: weekly }
  - package-ecosystem: pub
    directory: "/"
    schedule: { interval: weekly }
  - package-ecosystem: npm
    directory: "/"
    schedule: { interval: weekly }
  - package-ecosystem: github-actions
    directory: "/"
    schedule: { interval: weekly }

Group non-major updates so you get one PR a week, not fifty.

7. Triage Policy

Not every HIGH CVE is exploitable in your app. Have a documented triage policy:

CVSS ≥ 9 or actively exploited in the wild → patch within 7 days, release out-of-band if needed.
CVSS 7–9 → patch within 30 days.
CVSS < 7 → next scheduled release.
Not applicable (e.g., CVE in a code path you don't use) → document suppression with link to reasoning, review quarterly.

8. Transitive Dependency Attacks

The 2021–2024 wave of typosquat / account-takeover attacks on npm, PyPI, and RubyGems applies to mobile too. Defenses:

Lockfile + integrity hashes (--frozen-lockfile, pod install --deployment).
Block CI from installing from non-registry sources unless whitelisted.
Review diffs on major dep bumps — not just semver; read the changelog.

9. Native Libraries (AAR / .framework / .xcframework)

Binary SDKs are a black box. Mitigations:

Prefer SDKs that publish source.
Pin versions by checksum (sha256 in lockfile where supported).
On major vendor upgrades, run the APK / IPA through MobSF to check for new permissions / classes.

10. Kotlin / Swift Version Churn

Bumping Kotlin or Swift often cascades into every dependency. Plan for this in the Gradle / Xcode upgrade issues — not every PR.

Checklist

[ ] An SBOM is generated per release build and archived with the artifact.
[ ] OWASP Dependency-Check (or Snyk) fails the build on unsuppressed high/critical CVEs.
[ ] gradle-versions / pod outdated / dart pub outdated / npm audit run on every PR.
[ ] Dependabot is enabled for every ecosystem in the repo.
[ ] Lockfiles are committed and CI uses --frozen-lockfile or equivalent.
[ ] A triage policy with SLAs by CVSS is documented and followed.
[ ] Binary SDKs are pinned by checksum where supported and re-scanned on upgrade.
[ ] Suppression entries link to a rationale and have a review date.