T08 · Insecure Dependencies
Warning
- Location
- scripts/feishu_send.py:15
- Finding
- Automatic Installation of an Unpinned Python Dependency<![CDATA[ ## Vulnerability Details **File Location**: `scripts/feishu_send.py:15-30, 61-65, 111`; `scripts/feishu_send_ascii.py:15-30, 61-65, 111` **Vulnerability Type**: Unsafe runtime dependency installation **Risk Level**: Medium ### Vulnerable Code ```python PYTHON_DEPS = ['requests'] def check_python_package(package): try: __import__(package) return True except ImportError: return False def install_python_package(package): print(f'正在安装 Python 依赖: {package}...') try: subprocess.check_call( [sys.executable, '-m', 'pip', 'install', package], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL ) print(f'{package} 安装成功') return True except subprocess.CalledProcessError: print(f'{package} 安装失败，请手动执行: pip install {package}') return False ``` ```python if missing_python: print(f'检测到缺失的 Python 依赖: {", ".join(missing_python)}') if auto_install: for pkg in missing_python: install_python_package(pkg) ``` ```python if not check_environment(): print('环境检测未通过，请先安装缺失的依赖') sys.exit(1) ``` ### Technical Analysis Both sender scripts automatically invoke `pip install requests` when the dependency is absent. The package has no pinned version, locked transitive dependency set, or hash verification. The installation also relies on the active pip index and configuration, which may have been changed to use an untrusted mirror or proxy. Python package installation can execute package build and installation logic. Consequently, installing an unverified package is a code-execution operation rather than a simple data download. Suppressing standard output and standard error further reduces visibility into the selected package version, source, and installation behavior. Runtime package installation is not required for the core function of uploading a file to Feishu. Dependencies should be installed as a separate, ex ...[truncated 1287 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic package installation from runtime code. 2. Declare dependencies in a dedicated requirements or project configuration file. 3. Pin `requests` and its transitive dependencies to reviewed versions. 4. Use a lock file and require package hashes, such as `pip install --require-hashes`. 5. Restrict installation to an approved package index and validate pip configuration in deployment environments. 6. Perform dependency installation during a controlled build or administrator-approved setup phase. 7. Do not suppress installation output in deployment logs; retain enough information to audit the resolved versions and sources. 8. Run the Skill in a minimally privileged virtual environment or container. ]]>