T08 · Insecure Dependencies
Error
- Location
- scripts/generate_excel.py:24
- Finding
- Automatic Installation of an Unpinned Runtime Dependency## Vulnerability Details **File Location**: `scripts/generate_excel.py`, lines 24-32 **Vulnerability Type**: Supply-chain exposure through automatic dependency installation **Risk Level**: High ### Code Evidence ```python try: import openpyxl from openpyxl.styles import Font, PatternFill, Alignment, Border, Side from openpyxl.utils import get_column_letter except ImportError: print("缺少 openpyxl，正在安装...") import subprocess subprocess.check_call([sys.executable, "-m", "pip", "install", "openpyxl", "-q"]) import openpyxl from openpyxl.styles import Font, PatternFill, Alignment, Border, Side from openpyxl.utils import get_column_letter ``` ### Technical Analysis If `openpyxl` cannot be imported, the script automatically invokes pip and installs the package at runtime. The installation does not specify an exact version, verify package hashes, enforce a trusted package index, or require explicit operator approval. Python package installation can execute package-controlled build and installation logic. Consequently, the effective code executed by the Skill is not limited to the reviewed repository. It also depends on whichever package and version the configured pip index returns at execution time. The risk can become exploitable if: - The configured package index or package mirror is compromised. - Local pip configuration redirects requests to an attacker-controlled index. - DNS, proxy, or repository infrastructure is compromised. - A future dependency release is malicious or compromised. - The script is executed in an environment where Python package resolution has been modified. ### Attack Path 1. An attacker compromises or influences the Python package source used by the execution environment. 2. The attacker causes the supplied `openpyxl` package or one of its dependencies to contain malicious installation or import-time code. 3. A user invokes Excel generation ...[truncated 952 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all automatic package installation from runtime application code. 2. Declare `openpyxl` in a project dependency manifest and lock it to a reviewed version. 3. Use a lock file or requirements file with cryptographic hashes, for example pip's `--require-hashes` option. 4. Install dependencies during a controlled deployment or build phase rather than during report generation. 5. Configure an approved package repository and prevent untrusted local pip configuration from overriding it. 6. If the dependency is unavailable, terminate safely with a clear installation instruction instead of invoking pip automatically. 7. Run the script in a least-privileged, network-restricted environment to reduce the impact of a compromised dependency. 8. Add dependency vulnerability and provenance checks to the release process.