0

I was wondering if any can simplify the source maps vulnerability?. I've googled this vulnerability but can't get my head around this. Could anyone please help me to understand this issue and how do I investigate and find the issue?. All I know it's normally a '.map' file, is it correct and normally can be done by adding .map at the end of the js extension? Something like example.js.map. Not sure how to tell the difference between minified and unminify code?

Improve this question

2 Answers 2

Reset to default
1

JavaScript or similar languages may be transpiled, minified or "packed" before deployment to a test system.

On such systems, when JavaScript errors occur, it is valuable to be able to identify where in the original source code these errors belong. It's not really useful to see "Error in bundle.js:1", because that really doesn't mean anything for you.

This is where source maps come in: They allow you to "map" packed code back to original source code. While this is a handy feature for your developers, it also makes the job of an attacker easier, but telling him exactly which JavaScript frameworks in which version you are using.

What does that mean for me? Should I be worried?

All in all, it's not a huge issue. It's similar to having verbose error messages enabled. It won't enable an attacker to suddenly take over your server, but you're helping an attacker, when you really don't need to.

If your vulnerability scanner reported this on an internal testing system, then feel free to ignore this vulnerability as a false positive. If your scanner reported this on a production system, consider removing the source map on the production system.

Improve this answer
-1

If your vulnerability scanner is telling you that the existence of a source map is a vulnerability, you should start shopping for a new scanner, one from a company that doesn't believe in security through obscurity. A well-written Web app stays secure even if the attacker has a copy of all of the source code. If you're required to fix all findings from this scanner for some dumb bureaucratic reason, then the "fix" is to delete the .map files, but keep in mind that this will significantly impede debuggability for zero real increase in security.

Improve this answer
1
  • I disagree. You shouldn't rely on security through obscurity, but it can be a layer in the defences. There is no reason to have these files available in production and they make an attackers job considerably easier. If everyone else decides not to include them and you decide to include them then an attacker may choose to target you over the others because you're an easier target
    – Grezzo
    Jun 13, 2022 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .