MsBuild task to warn about insecure NuGet libraries
C#
Switch branches/tags
Nothing to show
Clone or download
Pull request Compare This branch is 30 commits ahead, 4 commits behind eoftedal:master.
eoftedal Merge pull request #17 from DudeSolutions/master
fix mustash.js to point to correct nuget id
Latest commit 7f52761 Apr 7, 2017

README.md

OWASP SafeNuGet

OWASP SafeNuGet is an MsBuild task to warn about insecure NuGet libraries: https://nuget.org/packages/SafeNuGet/

Use of libraries with known vulnerabilities is a big problem. So big in fact it has now made it to the OWASP Top 10 2013. It's under A9 Using Known Vulnerable Components.

Installation

  1. Install the NuGet package
  2. Build

Configuring

You can configure OWASP SafeNuGet by editing the packages/SafeNuGet.1.0.9/build/SafeNuGet.targets (replace the version number with the one you have installed).

Settings:

  • CacheTimeInMinutes - how long the list of vulnerabilities should be kept before being refreshed from github
  • DontBreakBuild - (from 1.0.9) - If set to true, will not break build even though vulnerable package is found

Want to contribute?

Great! If you want to contribute to the list of unsafe libraries, please create a pull request, register it as an issue or email me at erlend.oftedal@owasp.org.

Code contributions are also very welcome. Fork and create a pull request.

Experience an issue?

Register it here at github: issues