T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependency and Unverified Runtime Model Retrieval## Vulnerability Details **File Location**: `requirements.txt:1` **Related Locations**: `rapidocr_minimal.py:9, 18`; `models/README.md:45-47`; `README.md:9` **Vulnerability Type**: Supply-chain exposure through an unpinned dependency and unverified runtime artifacts **Risk Level**: Medium ### Vulnerable Code ```text rapidocr-onnxruntime>=1.2.3 ``` The dependency is imported and initialized as follows: ```python from rapidocr_onnxruntime import RapidOCR class RapidOCRSkill: def __init__(self): # Use the default configuration. Models are downloaded on first use. self.ocr = RapidOCR() ``` The documented pre-download procedure invokes the same dependency directly: ```bash python -c "from rapidocr_onnxruntime import RapidOCR; RapidOCR()" ``` ### Technical Analysis The version constraint `>=1.2.3` permits installation of any future release of `rapidocr-onnxruntime`. The project includes neither a lockfile nor package hashes, so installations are not reproducible and cannot ensure that the audited dependency version is the one ultimately executed. The package is imported at module load time and initialized through `RapidOCR()`. Consequently, code supplied by the installed package executes within the Python process and inherits the process's privileges and access to OCR input files. The project documentation further states that the dependency obtains OCR models automatically on first invocation. However, the project does not pin exact model revisions or provide expected cryptographic checksums or signatures. Although no malicious behavior was found in the Skill's own source code, trust is delegated to mutable external package and model distribution channels. This finding does not establish that the current dependency or models are malicious. It identifies an avoidable supply-chain weakness that could become exploitable if a future package release, package repository account, distribution endpoint, or artifact is compromised. ### Attac ...[truncated 1755 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the open-ended version constraint with an exact, reviewed version: ```text rapidocr-onnxruntime==<reviewed-version> ``` 2. Generate a hash-locked dependency file and require hash verification during installation: ```bash pip install --require-hashes -r requirements.txt ``` 3. Pin all transitive dependencies through a reproducible lockfile generated from a controlled environment. 4. Record the exact expected model versions, canonical download URLs, file sizes, and SHA-256 hashes. 5. Verify every downloaded model against a trusted cryptographic digest before loading it. Reject missing, mismatched, or unexpectedly redirected artifacts. 6. Prefer reviewed, locally provisioned model files for sensitive or offline deployments. Disable automatic downloads where the dependency supports that configuration. 7. Install dependencies from a trusted, access-controlled package mirror and incorporate dependency provenance, vulnerability, and integrity checks into CI. 8. Run OCR under a dedicated, least-privileged account or sandbox with access restricted to required input files and model directories. Deny unnecessary outbound network access after approved artifacts have been provisioned. 9. Review dependency updates explicitly rather than accepting future releases automatically.