T08 · Insecure Dependencies
- Location
scripts/setup.sh:42- Finding
Dependency installation lacks cryptographic integrity verification
- Content
View full analysis
Vulnerability Details
File Location:
scripts/setup.sh, lines 42-65; dependency declarations inrequirements.txt, lines 3-5
Vulnerability Type: Supply-chain integrity weakness
Risk Level: MediumVulnerable Code
bash if [ -n "$VENV_DIR" ]; then echo " 创建虚拟环境: $VENV_DIR" python3 -m venv "$VENV_DIR" # shellcheck disable=SC1091 source "$VENV_DIR/bin/activate" echo " 虚拟环境中安装依赖..." python3 -m pip install -r requirements.txt echo " 完成(venv: $VENV_DIR)。后续使用: source $VENV_DIR/bin/activate" exit 0 fi if [ -n "${VIRTUAL_ENV:-}" ] || [ -f ".venv/bin/activate" ]; then echo " 检测到虚拟环境,直接安装..." if [ -n "${VIRTUAL_ENV:-}" ]; then "$PIP_CMD" install -r requirements.txt else # shellcheck disable=SC1091 source .venv/bin/activate python3 -m pip install -r requirements.txt fi echo " 完成。" exit 0 fi if "$PIP_CMD" install -r requirements.txt 2>/tmp/vocab_pip_err.txt; then echo " 依赖安装完成。" else if grep -qi "externally-managed-environment" /tmp/vocab_pip_err.txt; then if [ "$ALLOW_GLOBAL" -eq 1 ]; then echo " 用户显式确认(--allow-global),绕过 PEP 668 安装到系统 Python..." "$PIP_CMD" install --break-system-packages -r requirements.txtThe installed dependencies are version-pinned but not hash-pinned:
text pillow==11.3.0 fonttools==4.63.0 qrcode[pil]==8.2Technical Analysis
Exact version pins provide reproducibility only if the retrieved artifacts are trustworthy. They do not authenticate package contents. Every installation path invokes
pip installwithout--require-hashes, and the project does not provide expected hashes for wheels or source distributions.Pip uses the index and mirror configuration of the invoking environment. If an upstream repository, configured mirror, DNS/network path, or local pip configuration is comp ...[truncated 1841 chars]
- Remediation
View remediation
Remediation Suggestions
- Generate a fully resolved lock file containing SHA-256 hashes for every permitted wheel or source artifact.
- Install with hash enforcement, for example:
bash python3 -m pip install --require-hashes -r requirements.lock - Restrict installation to an explicitly documented trusted index and avoid adding untrusted extra indexes.
- Prefer platform-specific, pre-reviewed wheels and prohibit unexpected source builds where practical, such as with
--only-binary=:all:. - Retain virtual environments as the default and consider removing the
--allow-globalpath entirely. - Perform dependency vulnerability and provenance checks whenever locked artifacts are updated.