T08 · Insecure Dependencies
- Location
requirements.txt:4- Finding
Unpinned and Unhashed Third-Party Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
requirements.txt:1-9; installation command atREADME.md:17-23
Vulnerability Type: Supply-chain risk caused by open-ended dependency constraints and missing integrity hashes
Risk Level: MediumVulnerable Code
requirements.txt:1-9:text # Heartbeat Scanner Dependencies # RDF processing rdflib>=6.0.0 # SHACL validation pyshacl>=1.3.0 # No other dependencies - uses Python standard libraryREADME.md:17-23:markdown ## Installation ```bash pip install -r requirements.txtRequirements:
pyshacl,rdflibtext ### Technical Analysis The dependency specifications only define minimum versions and have no upper bounds, exact version pins, lock file, or cryptographic hashes. Consequently, each installation may resolve to different package versions, including future releases that were not reviewed with this project. Python packages can execute package-controlled code during installation and when imported. The scanner imports both dependencies in `heartbeat_scanner.py`: ```python from pyshacl import validate import rdflibThis does not establish that the currently published packages are malicious. The weakness is that the project does not guarantee that users install the same reviewed artifacts. If a dependency release or its distribution channel is compromised, the installation instructions can expose users to attacker-controlled code.
Attack Path
- An attacker compromises a permitted future release of
rdfliborpyshacl, or the corresponding package distribution account or artifact. - The malicious release still satisfies
rdflib>=6.0.0orpyshacl>=1.3.0. - A user follows the documented command
pip install -r requirements.txt. - The package resolver selects and installs the compromised release because no exact version or expected hash is enforced.
- Attacker-controlled code executes during p ...[truncated 589 chars]
- An attacker compromises a permitted future release of
- Remediation
View remediation
Remediation Suggestions
-
Replace open-ended constraints with exact versions that have been reviewed and tested, for example:
text rdflib==REVIEWED_VERSION pyshacl==REVIEWED_VERSION -
Generate a fully resolved lock file containing transitive dependencies and cryptographic hashes, for example with:
bash pip-compile --generate-hashes requirements.in -
Require hash verification during installation:
bash python -m pip install --require-hashes -r requirements.txt -
Review and update pinned versions through a controlled dependency-update process. Run automated vulnerability and license scans before accepting each update.
-
Install the project in an isolated virtual environment under a non-privileged account. Avoid system-wide or administrator-level package installation.
-
Use a trusted package index or an internally controlled package mirror, and retain reviewed artifacts to support reproducible builds.
-