T08 · Insecure Dependencies
- Location
scripts/analyze.py:31- Finding
Automatic Runtime Installation of Unpinned Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
scripts/analyze.py:31-38
Vulnerability Type: Unpinned runtime dependency installation from a mutable package repository
Risk Level: MediumVulnerable Code
python def _ensure(pkg, import_name=None): try: __import__(import_name or pkg) except ImportError: print(f" [安装] 正在安装 {pkg} ...") os.system(f"pip3 install {pkg} --break-system-packages -q 2>/dev/null") _ensure("python-docx", "docx") _ensure("openpyxl") _ensure("pdfplumber")Technical Analysis
When an imported library is unavailable, the script invokes
pip3to download and install the corresponding package automatically. The package versions and artifact hashes are not pinned, so the code installed during any given execution can differ from the code that was originally audited.Python package installation can execute package build logic and subsequently imports the installed libraries. Consequently, compromise of an upstream package release, transitive dependency, configured package index, or package-delivery path could introduce attacker-controlled code.
The use of
--break-system-packagesbypasses protections intended to prevent modification of an externally managed system Python environment. Redirecting standard error to/dev/nullalso conceals installation diagnostics that could reveal repository, certificate, resolution, or build failures.The package names are fixed literals rather than user-controlled values. Therefore, the reviewed code does not expose a direct shell-command injection path through the
pkgargument during its normal execution.Attack Path
- A required library is absent from the Python environment.
- The user runs
scripts/analyze.py. _ensure()constructs and executes an externalpip3 installcommand.pip3resolves the unpinned package and its transitive dependencies from the active package-index configuration.- An attacker controlling a package re ...[truncated 943 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic dependency installation from application runtime. If a dependency is unavailable, terminate with a clear message and explicit setup instructions.
- Declare dependencies in a lock file with exact versions and cryptographic hashes, such as a hash-locked
requirements.txt. - Install dependencies during a separate, controlled setup step inside a dedicated virtual environment.
- Use a trusted, explicitly configured package index and require TLS verification.
- Audit and pin transitive dependencies, not only the three direct dependencies.
- Remove
--break-system-packagesto avoid modifying an externally managed system Python installation. - Do not suppress installation errors. Preserve actionable diagnostics while ensuring logs do not expose credentials embedded in repository URLs.
- In higher-assurance environments, install from pre-reviewed internal wheels or a controlled artifact repository and verify package signatures or hashes before installation.
A safer runtime pattern is:
python def _require(pkg, import_name=None): try: __import__(import_name or pkg) except ImportError as exc: raise SystemExit( f"Missing dependency: {pkg}. " "Install the audited, pinned dependencies in a virtual environment." ) from exc _require("python-docx", "docx") _require("openpyxl") _require("pdfplumber")