Skip to content

Latest commit

 

History

History
34 lines (27 loc) · 4.03 KB

threat-modeling.md

File metadata and controls

34 lines (27 loc) · 4.03 KB

Threat Model Analysis for thoughtbot/bourbon

Threat: Malicious Code Injection via Compromised Release

  • Threat: Malicious Code Injection via Compromised Release

    • Description: An attacker gains control of the Bourbon project's publishing credentials (e.g., on npm) or compromises a maintainer's account. They publish a new version of Bourbon that includes malicious Sass code. This code could be obfuscated to avoid detection. When developers update to this compromised version and compile their Sass, the malicious code is included in the application's CSS. The attacker could use CSS injection techniques, such as manipulating the content property, to inject JavaScript, or use advanced CSS selectors to target and modify specific elements for malicious purposes.
    • Impact:
      • Cross-Site Scripting (XSS): Execution of arbitrary JavaScript in the context of the user's browser, leading to session hijacking, data theft, or defacement.
      • Data Exfiltration: Sensitive data could be extracted through CSS-based techniques (though complex and less likely).
      • Denial of Service (DoS): The injected CSS could cause browser crashes or severe performance degradation.
      • Defacement: The application's visual appearance could be altered.
    • Bourbon Component Affected: The entire Bourbon library itself (any mixin, function, or add-on could be modified). The attack targets the package as a whole.
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Use Package Lockfiles: Always use package-lock.json (npm) or yarn.lock to ensure you install the exact same versions of Bourbon and its dependencies every time.
      • Verify Package Integrity: Use tools like npm audit or yarn audit to check for known vulnerabilities before installing or updating.
      • Pin to Specific Commit Hash: For the highest level of security, pin Bourbon to a specific commit hash in your package.json (e.g., "bourbon": "github:thoughtbot/bourbon#a1b2c3d4..."). This requires manual updates but guarantees you're using a specific, known-good state of the code.
      • Monitor Bourbon's Repository: Subscribe to notifications from Bourbon's GitHub repository to be alerted to security advisories or suspicious activity.
      • Content Security Policy (CSP): Implement a strict CSP, particularly the style-src directive, to limit the origins from which CSS can be loaded and to restrict inline styles. This can mitigate the impact of injected CSS.
      • Subresource Integrity (SRI) (If applicable): If you are loading Bourbon from a CDN and it supports SRI, use SRI tags to verify the integrity of the downloaded file. However, this is less relevant if you are compiling Bourbon into your own CSS.

Threat: Supply Chain Attack on Bourbon Dependencies

  • Threat: Supply Chain Attack on Bourbon Dependencies

    • Description: Bourbon itself has very few dependencies, but if one of those dependencies is compromised, an attacker could inject malicious code that would be pulled in when Bourbon is installed. The attacker targets a less-secure or less-maintained dependency of Bourbon.
    • Impact: Similar to the compromised release threat (XSS, data exfiltration, DoS, defacement).
    • Bourbon Component Affected: Indirectly affects Bourbon through a compromised dependency. The specific Bourbon component affected would depend on which dependency is compromised and how it's used.
    • Risk Severity: High
    • Mitigation Strategies:
      • Same as "Malicious Code Injection via Compromised Release," with a strong emphasis on auditing all dependencies, including those of Bourbon. Use npm audit or yarn audit regularly.
      • Investigate Bourbon's Dependencies: Manually review Bourbon's package.json file to understand its dependencies and their security posture.