T08 · Insecure Dependencies
Warning
- Location
scripts/crop.py:34- Finding
Unpinned Python Dependencies and Unverified Remote Model Artifact
- Content
View full analysis
Path: if MODEL_PATH.exists(): return MODEL_PATH MODEL_PATH.parent.mkdir(parents=True, exist_ok=True) print(f"Downloading face landmarker model -> {MODEL_PATH}") import urllib.request urllib.request.urlretrieve(MODEL_URL, MODEL_PATH) return MODEL_PATH ``` ### Technical Analysis The documented installation command does not pin dependency versions or verify package hashes. Consequently, the exact versions and contents installed for `mediapipe`, `opencv-python`, and `numpy` depend on the package index state at installation time. Python packages may execute installation or imported runtime code with the privileges of the invoking user. The script also downloads a MediaPipe model over HTTPS and immediately treats the resulting file as trusted. HTTPS protects the connection in transit under normal conditions, but the script does not verify an expected cryptographic digest or signature. It also trusts any existing file at `MODEL_PATH` without validating its integrity. A compromised distribution endpoint, altered upstream artifact, or locally re ...[truncated 2472 chars]- Remediation
View remediation
\ --hash=sha256: opencv-python== \ --hash=sha256: numpy== \ --hash=sha256: ``` Install them using hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 2. Generate and review hashes separately for each supported platform and Python version. Use a controlled package index or mirror where practical. 3. Record an expected SHA-256 digest for `face_landmarker.task`. Download the model to a temporary file, calculate its digest, reject any mismatch, and atomically rename it into the cache only after successful verification. 4. Validate cached model files on every use rather than trusting existence alone. Remove and securely replace a cache entry whose digest does not match. 5. Apply restrictive permissions to the model directory and file so that unrelated local users cannot replace the cached artifact. 6. Add download timeouts, size limits, and cleanup on failure to reduce denial-of-service and partial-file risks. 7. Consider packaging the reviewed model with the skill when licensing and distribution constraints permit. If remote retrieval remains necessary, publish the expected digest in version-controlled source code or verify a trusted digital signature. ]]>