Maven project - Do I have a vulnerability in a dependency that is not deployed to production?

Viewed 37

Let's say I have a project structure that looks like the one below (comprised of multiple sub-modules, each with its own pom file):

Project Structure

Let's say the only module that gets deployed to production (as a WAR file) is web-service. Inside this WAR file (I can peek into the contents using something like 7zip), there is a WEB-INF/lib/ directory containing all dependencies that will be deployed to production. Is it at all possible for the application to be vulnerable to dependencies declared in the other pom files that aren't what's deployed to production (let's say the WAR file does not contain a vulnerable dependency that is declared in the other modules' pom files - is the application still vulnerable?).

1 Answers

The short answer is no. I have deployed .ear in production enviroments which contains Maven dependencies and the process has been success. I recomend you to use tools to scan code vulnerabilities like Fortify or Black Dog.

Related