warningRisk: Licenses

Scanned:

itextsharp.xmlworker

latest

This DEPRECATED tool parses (X)HTML snippets and the associated CSS and converts them to PDF. It is replaced by iText pdfHTML addon https://www.nuget.org/packages/itext.pdfhtml/ and iText Community: https://www.nuget.org/packages/itext/

License: unknown

Published:

See on NuGet

SAFE Assessment

Compliance

Licenses

2 copyleft licensed components

Secrets

No sensitive information found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues6 vulnerabilities0 malware0 behaviors13 dependencies1 contributors8 versions25

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Copyleft licenses in particular impose substantial restrictions on the licensee. They typically require that any derived works, and even software code that merely interacts with copyleft code, be licensed under the same license. Since copyleft licenses are commonly applied to open source code, their inclusion requires that the entire software package becomes open sourced. For commercial applications, this is typically undesirable. Therefore, the inclusion of copyleft code is commonly avoided or even prohibited by the organization policy.

Prevalence in NuGet community

0 packages

found in

Top 100

6 packages

found in

Top 1k

82 packages

found in

Top 10k

9.71k packages

in community

Next steps

Confirm that the software package includes a copyleft component.

Investigate if the software publisher provides this component under a non-copyleft license.

Consider replacing the software component with an alternative that offers a license compatible with commercial use.

Problem

Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.

Prevalence in NuGet community

0 packages

found in

Top 100

12 packages

found in

Top 1k

222 packages

found in

Top 10k

15.19k packages

in community

Next steps

Confirm that the software package references a component or a dependency with a restrictive license.

Consider replacing the software component with an alternative that offers a license compatible with organization policy.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Open source communities depend on the work of thousands of software developers that volunteer their time to maintain software components. Software developers build up the reputation of their open source projects by developing in public. Modern source code repositories have many social features that allow software developers to handle bug reports, have discussions with their users, and convey reaching significant project milestones. It is uncommon to find open source projects that omit linking their component to a publicly accessible source code repository.

Prevalence in NuGet community

99 packages

found in

Top 100

723 packages

found in

Top 1k

6007 packages

found in

Top 10k

575.57k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in NuGet community

0 packages

found in

Top 100

2 packages

found in

Top 1k

64 packages

found in

Top 10k

3.84k packages

in community

Next steps

Confirm that the software component references a copyleft dependency.

Investigate if the software publisher provides this dependency under a non-copyleft license.

Consider replacing the software dependency with an alternative that offers a license compatible with commercial use.

Problem

Digital signatures are applied to applications, packages and documents as a cryptographically secured authenticity record. Signatures verify the origin and the integrity of the object they apply to. The integrity validation relies on the cryptographic strength of the encryption and the hash verification algorithm. If either of the two is considered weak by current standards, there is a chance the signed object could be maliciously modified, without triggering the integrity failure check.

Prevalence in NuGet community

100 packages

found in

Top 100

899 packages

found in

Top 1k

8997 packages

found in

Top 10k

755.66k packages

in community

Next steps

Create signatures with strong ECC key-length of at least 224 bits, or RSA key-length of at least 2048 bits, and use SHA256 as the hashing algorithm. While encryption key-length upgrade does require you to obtain a new certificate, the hashing algorithm can freely be selected during signing.

With Microsoft SignTool, you can specify the hashing algorithm using the /fd SHA256 parameter.

Problem

Digital signatures are applied to applications, packages and documents as a cryptographically secured authenticity record. Signatures are made using digital certificates, which can either be purchased from certificate authorities or be self-issued. When a certificate is purchased from a certificate authority, the subject that requests it goes through an identity validation process. Depending on the certificate type, those checks can be basic or extended. Confirming the subject identity is a multi-step process, and the requesting subject can be mapped to its legal entity name only through extended validation of submitted documents. Extended identity validation typically costs more, and it takes longer for a certificate to be issued when this process is correctly followed.

Prevalence in NuGet community

100 packages

found in

Top 100

898 packages

found in

Top 1k

8984 packages

found in

Top 10k

754.38k packages

in community

Next steps

Consider the benefits of acquiring extended validation certificates. Operating systems tend to be more trusting of software packages signed in this way. Certain security warnings and prompts might also be automatically suppressed. This reduces the number of support tickets for organizations that opt to use extended validation certificates.

itextsharp.xmlworker

SAFE Assessment

Compliance

Security

Threats

Did you know...

SQ12101Detected presence of software components distributed with copyleft licenses.Causes risk: copyleft licensed componentslicenses

Problem

Prevalence in NuGet community

Next steps

SQ12405Detected presence of licenses that place restrictions on software distribution.Causes risk: software distribution restrictionslicenses

Problem

Prevalence in NuGet community

Next steps

TH30112Detected presence of software components without a declared source code repository.hunting

Problem

Prevalence in NuGet community

Next steps

SQ12102Detected presence of software dependencies distributed with copyleft licenses.Causes risk: copyleft licensed componentslicenses

Problem

Prevalence in NuGet community

Next steps

SQ20119Detected digital signatures that rely on a weak digest algorithm for integrity validation.signatures

Problem

Prevalence in NuGet community

Next steps

SQ20121Detected digital signatures that have not been performed with an extended validation certificate.signatures

Problem

Prevalence in NuGet community

Next steps