T08 · Insecure Dependencies
Note
- Location
- scripts/docx_gen.py:156
- Finding
- Unpinned Third-Party Python Dependency Installation Instructions## Vulnerability Details **File Locations**: - `scripts/docx_gen.py:156-158` - `scripts/xlsx_tool.py:161-163` - `scripts/inspect_doc.py:132-134` **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Low ### Vulnerable Code `scripts/docx_gen.py:156-158` ```python if not _DOCX_OK: print("[Error] Missing third-party library python-docx; install it first:") print(" pip install python-docx") ``` `scripts/xlsx_tool.py:161-163` ```python if not _OPENPYXL_OK: print("[Error] Missing third-party library openpyxl; install it first:") print(" pip install openpyxl") ``` `scripts/inspect_doc.py:132-134` ```python if not _DOCX_OK: print("[Error] Missing third-party library python-docx; install it first:") print(" pip install python-docx") ``` ### Technical Analysis The scripts instruct users to install `python-docx` and `openpyxl` without specifying reviewed versions, package hashes, an authenticated package source, or a dependency lock file. Consequently, pip resolves mutable package releases from whatever index is configured in the user's environment. The package names are legitimate and there is no evidence that this project intentionally introduces a malicious dependency. The scripts also do not perform installation automatically. Nevertheless, the instructions create a supply-chain trust boundary that is neither reproducible nor cryptographically verified. A compromised upstream release, package repository, dependency of either package, or attacker-controlled pip mirror could supply malicious package content. Python package installation and subsequent import can execute package-controlled code with the privileges of the invoking user. ### Attack Path 1. A user invokes one of the scripts in an environment where the required package is unavailable. 2. The script displays an instruction to run an unpinned `pip install` command. 3. The user executes that command. 4. Pip resolves the c ...[truncated 1275 chars]
- Remediation
- ## Remediation Suggestions 1. Create a reviewed dependency file that pins exact versions: ```text python-docx==REVIEWED_VERSION openpyxl==REVIEWED_VERSION ``` 2. Generate and verify SHA-256 hashes for every direct and transitive dependency, then require hash validation during installation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-file workflow, such as `pip-tools`, to produce deterministic transitive dependency versions. 4. Update runtime guidance to direct users to the reviewed dependency file rather than installing unconstrained package names: ```python print("Install the reviewed dependencies with:") print(" python -m pip install --require-hashes -r requirements.txt") ``` 5. Recommend installation in a dedicated virtual environment with ordinary user privileges. Do not recommend administrator or root installation. 6. Document the expected package index and advise users to verify pip configuration before installation. In controlled deployments, use an authenticated internal mirror containing reviewed artifacts. 7. Add automated dependency scanning and periodic review of pinned versions so security updates can be adopted without reverting to unconstrained installations.