T08 · Insecure Dependencies
- Location
scripts/parse_tender.py:24- Finding
Unpinned Third-Party Dependency Installation Guidance
- Content
View full analysis
Vulnerability Details
File Location:
scripts/parse_tender.py, lines 19–37; vulnerable installation guidance appears specifically at lines 24 and 36
Vulnerability Type: T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
python def parse_pdf(file_path): """Parse a PDF file.""" try: import PyPDF2 with open(file_path, 'rb') as f: reader = PyPDF2.PdfReader(f) text = "" for page in reader.pages: text += page.extract_text() + "\n" return text except ImportError: print("Error: PyPDF2 is not installed. Run: pip install PyPDF2") sys.exit(1) def parse_docx(file_path): """Parse a DOCX file.""" try: from docx import Document doc = Document(file_path) text = "\n".join([paragraph.text for paragraph in doc.paragraphs]) return text except ImportError: print("Error: python-docx is not installed. Run: pip install python-docx") sys.exit(1)The displayed snippet is an English translation of the localized messages in the audited source; the package names and installation commands are unchanged.
Technical Analysis
When either document-parsing dependency is unavailable, the script instructs the user to install it directly from the package index without specifying a version or validating package hashes:
pip install PyPDF2pip install python-docx
These commands resolve whichever release the configured Python package index currently supplies. Consequently, the installed code is not tied to the version that was reviewed or tested with this project. A compromised upstream release, compromised package-index account, malicious package-index mirror, or unsafe local pip configuration could introduce attacker-controlled installation or runtime code.
The referenced package names are consistent with the imports, and the project does not specify an untrusted repository or app ...[truncated 1759 chars]
- Remediation
View remediation
Remediation Suggestions
-
Add a reviewed dependency manifest containing exact versions, for example:
text PyPDF2==<reviewed-version> python-docx==<reviewed-version> -
Generate and verify cryptographic hashes for all direct and transitive dependencies. Install them with a command such as:
bash python3 -m pip install --require-hashes -r requirements.txt -
Replace the generic installation messages with instructions that reference the repository-controlled dependency file:
python print("Required dependencies are missing. Install the reviewed dependencies with: " "python3 -m pip install --require-hashes -r requirements.txt") -
Use a dedicated virtual environment with only the permissions required to read input documents and write intended output files.
-
Review dependency updates before changing pinned versions, and use dependency vulnerability and provenance checks in continuous integration.
-
Prefer a trusted, explicitly configured package index or internal artifact repository. Ensure fallback to arbitrary or untrusted mirrors is disabled.
-