Managing Software Dependency Risks in Web Applications

<p>Web applications commonly rely on third-party software dependencies to reduce development time. This thesis examines how vulnerabilities in a dependency chain propagate to compromise an application. It analyzes two vulnerable Markdown libraries from the npm and Composer dependency ecosystems, both of which are used for managing packages in applications developed with JavaScript and PHP. The analysis demonstrates how each library’s sanitizing functions—intended for removing unsafe user input when transforming Markdown text to HTML—are defeated to achieve a cross-site scripting exploit and take control of the application. The paper discusses potential business impacts of a compromise, underscoring the need for security improvements, and it presents strategies for mitigating dependency related vulnerabilities. These solutions focus on package management tools available to developers, and they advocate implementing emerging security standards as part of the development life cycle.</p>

Name thesis:degree_name

Master of Science – Cyber Security

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

College of Science and Mathematics

Year dc:date.available

2025

Author dc:creator

• Scott, Christopher Alan

Contributors dc:contributor

• Christopher Ivancic
• Pushkar Ogale
• Nikki Shoemaker

• dependency chain
• information security
• risk management
• supply chain
• vulnerability management
• web application development
• Cybersecurity

Repository record dc:identifier

https://scholarworks.sfasu.edu/etds/610

OAI identifier oai:identifier

oai:scholarworks.sfasu.edu:etds-1644