When Dependencies Depend: A Large-Scale Study on Conditional Dependencies and Their Security Implications in C/C++

Abstract

Third-party libraries (TPLs) are a major source of software supply chain risk. Yet accurately managing them remains difficult in C/C++, where dependency inclusion is often encoded directly in build scripts rather than using standard package managers. A particularly overlooked challenge is conditional dependencies, i.e., TPLs included only under specific build configurations. C/C++ projects commonly express such conditions through fine-grained CMake logic involving platform checks and user-defined configuration variables, making them difficult for existing Software Composition Analysis (SCA) tools to reason about. To investigate this problem, we conduct a large-scale empirical study of 2K real-world C/C++ projects. We develop Condor, a static analysis approach that parses CMake build files to extract conditional dependencies together with their inclusion logic. Our results show that conditional dependencies are pervasive: among projects with at least one detected TPL, 84.33% contain at least one conditional dependency, and on average 53.77% of declared TPLs are conditionally included. We further find that 87.86% of conditional dependencies are governed by user-defined variables, revealing a C/C++-specific landscape of dependency variability that is difficult for existing SCA tools to capture. Finally, our evaluation of four popular SCA tools shows that up to 48.33% of reported vulnerable dependencies are conditionally included. The applicability of these reports therefore depends on the target build configuration. These findings highlight a key limitation of current SCA practice and motivate configuration-aware vulnerability analysis for C/C++ projects.