Forum Discussion
Vulnerability scanning for PowerBI visuals
Visuals are certified as of when they were submitted and reviewed. Nothing changes from the published visual side of things if something changes with the rules or vulnerabilities get discovered in npm packages. Provided that npm returns no warning about vulnerabilities in any required packages, this is regarded as OK. Certified visuals are not removed if certification rules change retrospectively or package vulnerabilities are discovered.
However, if I, as a visual author, want to submit an update to my visual, I have to address the rule changes and ensure my libraries are patched accordingly. It's routine for any author who updates their visuals regularly, as certification will fail for the update (and the last reviewed version remains in AppSource in perpetuity until the author submits a compliant update).
I've never personally been contacted about package vulnerabilities in one of my published visuals, so I can assume that either (a) this doesn't happen or (b) I haven't been subjected to a significant enough incident to be contacted.
Thanks dm-p for your quick reply, your answer was very helpful.
So, as far as I understood a new 0-day vulnerability (despite the CVSS score is) in an npm package could potentially never be fixed and the visual will still maintain the "certified" status exposing the users to potential risks.
Does that sound correct?
Thanks again for the help.
Possibly. All I can say is that I haven't been requested to submit a new version of my visuals due to such an issue (and I've been submitting visuals to AppSource for ~5 years). So, as far as my experience of the process goes, a visual would remain in the store unless a new version were to be submitted, so it might be possible that a vulnerable package could be present in an older visual that has not been updated in a long time.
If you want something official, it would be best to contact Microsoft for their policy on how this is managed if such an event occurs. The custom visuals team doesn't actively monitor the forums, so you'd be better off contacting them at [email protected] to see if you can get confirmation about this.