Framework and Libraries
Ready-made building blocks the application is written with.
What It Is
A framework is a set of ready-made building blocks that developers write an application with. It handles common jobs such as matching web addresses to code, page templates, database access and sign-in. Django, Ruby on Rails, Laravel, Spring, Express and ASP.NET are frameworks. A library is a smaller piece the application calls for one job, such as Log4j for writing logs.
A framework is not a runtime. Django is written in Python and needs the Python runtime to run, and Laravel needs PHP in the same way. Frameworks for different languages are rivals, and picking one also picks the runtime beneath it.
Framework and library code usually ships inside each application, so there is often no single copy on the server to patch. Each one is a dependency of the app, outside code the app is built with. Fixing a flaw means updating that dependency in every app that carries it, then rebuilding and redeploying each app.
- App
- Framework
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
On This Layer
These are the technologies on the Framework and Libraries layer that this topic covers. Open one to see what it runs on, how to spot it and what a flaw in it reaches.
- ASP.NETMicrosoft's framework for building web apps on .NET.
LaravelA popular PHP web framework.
ExpressA minimal web framework for Node.js.
SpringThe dominant web framework for Java.
DjangoA batteries-included web framework for Python.
Ruby on RailsA web framework for Ruby that favours convention.
Log4jA logging library used across the Java world.
How Far a Flaw Reaches
A flaw in a framework or library reaches every application built with it, whatever each app's own code does. Log4Shell reached so far because Log4j sat deep inside a great many Java applications, and many teams first had to search their builds to learn whether they used it.