Do third party drupal modules pose a security risk?

Question

This may very well be a stupid question but there is no avoiding it now. Unfortunately myself and many others succumbed to the temptation of skipping learning ubercart in lieu of obtaining a seemingly quick and easy 3rd party module for commerce.

Today drupal alerted me to an update for this 3rd party module but deleting it is not picked up by the refreshed module list, it simply vanishes and then when you try installing new version it remains stuck in checked position so that no new version can be installed and no uninstall can ever take place.

Of course the creator of this module has disappeared off the planet leaving myself and many others with less money in our pockets and red faced and some very angry with no support.

All of us say it is the first paid drupal module we've ever acquired because it did seem such a very good idea and easy to implement and the young man who made it was extremely helpful and professional at first.

It is still working on my site albeit unable to be updated but strange companies like soso.com in China have infiltrated this creator's site and are being listed in user's list of domains including mine so is this not a most terrible security risk for anyone using it with rest of the well maintained open source drupal?

update: the owner of these modules has actually returned and is back to usual professional good self. :) all's well that ends well.

Answer 1

Well, have you deleted that module without disabling & uninstalling it first? Some of your effects seems to be that way. Anyway, automatically updating a module from 3rd-party server is only as secure as his server. If you did it, and source server was compromised, you should consider yours compromised, too. Only safe way? Revert from backups to the last snapshot you are reasonably sure to be safe, and then do not update that module (possibly uninstalling it as soon as feasible).

Answer 2

Do third party drupal modules pose a security risk?

Well if you use them, then yes, of course. You're inviting unknown code in to your codebase.

If you haven't sought contractual guarantees from the author of the module as to its fit-for-purpose and security, then it's your responsibility to perform the necessary security reviews, and declare it ready or not for a production site.

Broadly speaking, any piece of code, whether it be custom, contrib or from core itself, potentially introduces risk to your application. The difference with contrib/core code is that you can make some assumptions as to the level of security testing that has taken place, and perhaps view those as less of a risk because of that testing.

But there have been plenty of security holes found in core and contrib modules (some pretty major ones) in the last couple of years, so you need to be on the ball with your own security testing and standards.

None of this is really specific to Drupal by the way; auditing foreign code in any project, in any language/framework, is an absolute must.