Angular应用中node模块间接依赖（qs/load-utils）漏洞排查求助

安全扫描检测到qs、load-utils存在漏洞问题，但这两个依赖并未出现在项目的package.json文件中，推测属于间接依赖。需要了解如何检查项目中的间接依赖，以及确定这两个依赖是由哪个直接依赖引入的。

项目的package.json内容如下：

{"name": "infy-02","version": "0.0.0","scripts": {"ng": "ng","start": "node app.js","build": "ng build --base-href /finnacle-payment/ ","test": "ng test","lint": "ng lint","e2e": "ng e2e"},"private": true,"dependencies": {"@angular/animations": "~8.2.14","@angular/cdk": "~8.2.3","@angular/common": "~8.2.14","@angular/compiler": "~8.2.14","@angular/core": "~8.2.14","@angular/forms": "~8.2.14","@angular/platform-browser": "~8.2.14","@angular/platform-browser-dynamic": "~8.2.14","@angular/router": "~8.2.14","@fortawesome/angular-fontawesome": "^0.5.0","@fortawesome/fontawesome-svg-core": "^1.2.26","@fortawesome/free-solid-svg-icons": "^5.12.0","@grapecity/wijmo.all": "5.20203.748","@grapecity/wijmo.angular2.all": "5.20203.748","ansi-html": "0.0.9","body-parser": "^1.19.0","bootstrap": "^4.5.3","classlist.js": "^1.1.20150312","cookie-parser": "^1.4.4","dd-trace": "2.5.0","engine.io": "4.1.2","express": "^4.17.1","express-session": "^1.17.0","hammerjs": "^2.0.8","helmet": "^3.21.2","ini": "1.3.6","jquery": "3.5.1","jsonwebtoken": "^8.5.1","knex": "^0.20.11","minimatch": "3.0.6","morgan": "^1.9.1","node-forge": "1.0.0","passport": "^0.4.1","passport-github": "^1.1.0","passport-github2": "^0.1.12","passport-oauth2": "^1.5.0","passport-openidconnect": "0.0.2","rxjs": "~6.4.0","socket.io-parser": "3.3.2","tslib": "^1.10.0","wijmo": "5.20203.748","winston": "^3.2.1","xmlhttprequest-ssl": "1.6.3","zone.js": "~0.9.1"},"devDependencies": {"@angular-devkit/build-angular": "~0.803.19","@angular/cli": "~8.3.19","@angular/compiler-cli": "~8.2.14","@angular/language-service": "~8.2.14","@types/node": "~8.9.4","@types/jasmine": "~3.3.8","@types/jasminewd2": "~2.0.3","codelyzer": "^5.0.0","jasmine-core": "~3.4.0","jasmine-spec-reporter": "~4.2.1","karma": "~4.1.0","karma-chrome-launcher": "~2.1.1","karma-coverage-istanbul-reporter": "~2.0.1","karma-jasmine": "~2.0.1","karma-jasmine-html-reporter": "^1.4.0","protractor": "~5.4.0","ts-node": "~7.0.0","tslint": "~5.15.0","typescript": "~3.5.3"}}

1. 使用npm命令定位依赖链 #

在项目根目录下执行以下命令，直接查看目标依赖的完整引入路径：

• 查找qs的依赖链：

  npm ls qs
  

• 查找load-utils的依赖链：

  npm ls load-utils
  

命令输出会展示层级关系，比如express > qs，就说明qs是由express作为直接依赖引入的。

2. 查看锁文件（package-lock.json） #

项目根目录的package-lock.json会记录所有依赖的详细层级关系，直接在文件中搜索qs或load-utils，找到对应的from和requires字段，即可明确是哪个父依赖引入了它们。

3. 针对当前项目的预判分析 #

• qs通常被express、body-parser这类HTTP处理相关的直接依赖引入，你的项目包含这两个依赖，大概率是它们其中之一引入了qs。
• load-utils多与前端构建工具相关，项目中的@angular-devkit/build-angular或@angular/cli这类构建依赖，很可能是引入它的源头。

内容的提问来源于stack exchange，提问作者rashmi