T08 · Insecure Dependencies
Error
- Location
- pyproject.toml:10
- Finding
- Unpinned and Unverifiable SDK Dependency Handles Financial Credentials and Real-Money Operations<![CDATA[ ## Vulnerability Details **File Location**: `pyproject.toml:10-13`; related installation and import behavior in `docs/getting-started/installation.md:12-23` and `docs/gen_client_reference.py:15-41` **Vulnerability Type**: Supply-chain dependency risk **Risk Level**: High ### Evidence `pyproject.toml:10-13` declares a dependency using an open-ended lower bound: ```toml [project] name = "peerberry-sdk" version = "2.0.0" authors = [ { name = "FortressQuant" } ] dependencies = [ "cloudscraper>=1.2" ] ``` `docs/getting-started/installation.md:12-23` directs users to install mutable packages from PyPI without an exact version or hash: ```markdown ## Standard Install (PyPI) ```bash pip install peerberry-sdk ``` Use this for normal application usage when you do not need optional two-factor helpers. ## Install With OTP Support ```bash pip install "peerberry-sdk[otp]" ``` ``` `docs/gen_client_reference.py:15-41` expects a local `src` directory but imports `peerberry_sdk` even when that source tree is unavailable: ```python PROJECT_ROOT = Path(__file__).resolve().parents[1] SOURCE_ROOT = PROJECT_ROOT / 'src' OUTPUT_PATH = 'api/client.md' if str(SOURCE_ROOT) not in sys.path: sys.path.insert(0, str(SOURCE_ROOT)) # Allow running this generator even when optional runtime deps are not installed. if 'cloudscraper' not in sys.modules: try: import cloudscraper # noqa: F401 except ModuleNotFoundError: class _NoopSession: headers = {} def request(self, *args, **kwargs): raise RuntimeError('Noop session cannot perform requests.') def get(self, *args, **kwargs): raise RuntimeError('Noop session cannot perform requests.') sys.modules['cloudscraper'] = types.SimpleNamespace( create_scraper=lambda browser: _NoopSession(), ) from peerberry_sdk.client import PeerberryClient from peerberry_sdk.config import AuthConfig, LifecycleConfi ...[truncated 3492 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the complete `src/peerberry_sdk` implementation in the reviewed artifact so authentication, transport, redaction, token storage, and purchase behavior can be audited. 2. Pin runtime and documentation dependencies to exact, reviewed versions rather than open ranges. 3. Generate a lock file and install with hash verification, such as `pip install --require-hashes -r requirements.lock`. 4. Publish and verify package provenance, release signatures, source-to-wheel reproducibility, and trusted publisher configuration. 5. Change documentation generators to verify that `PROJECT_ROOT / "src" / "peerberry_sdk"` exists and fail closed if it does not. 6. Avoid falling back to an arbitrary globally installed `peerberry_sdk` package during documentation generation. Load the expected local source from a validated path or run generation in a locked, isolated environment. 7. Build documentation and run the SDK under a least-privileged account without unrelated credentials, write access, or unrestricted network access. 8. Keep real-money operations disabled by default with `DRY_RUN`, hard order and aggregate-spend limits, explicit confirmation, balance checks, and server-side safeguards. 9. Document that credentials and TOTP seeds should come from a protected secret manager or environment injection mechanism rather than source files, shell history, or copied scripts. 10. Add automated release checks that reject missing package source, unpinned dependencies, unexpected package ownership changes, and dependency artifacts whose hashes differ from the reviewed lock file. ]]>