T08 · Insecure Dependencies
Warning
- Location
- setup.sh:29
- Finding
- Unpinned Dependencies Installed into the System Python Environment<![CDATA[ ## Vulnerability Details **File Location**: `setup.sh:29-38` **Vulnerability Type**: Unsafe and unpinned dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash python3 -m pip install --upgrade pip -q --break-system-packages python3 -m pip install playwright beautifulsoup4 requests pandas numpy thefuzz -q --break-system-packages echo "✅ Python 依赖安装完成" # Install Playwright browsers echo "" echo "3️⃣ 安装 Playwright 浏览器..." echo " 这将下载 Chromium 浏览器（约 170MB）" echo "" python3 -m playwright install chromium --with-deps 2>/dev/null || python3 -m playwright install chromium ``` ### Technical Analysis The setup script installs mutable, unpinned packages directly into the host Python environment. It also upgrades `pip` and uses `--break-system-packages`, which bypasses protections intended to prevent package managers from modifying distribution-managed Python installations. Because no exact versions or package hashes are specified, the artifacts installed at setup time can differ from those reviewed during this audit. A compromised upstream release, dependency account, package index, or transitive dependency could consequently introduce attacker-controlled installation or runtime code. The Playwright installation also downloads a Chromium build. Its `--with-deps` option may invoke the operating system package manager to install additional dependencies, potentially requesting elevated privileges. Installing browser and OS components is materially broader than installing the minimum application dependencies in an isolated environment. This is a supply-chain exposure rather than evidence that any currently named dependency is malicious. ### Attack Path 1. An attacker compromises an upstream package, maintainer account, transitive dependency, package index response, or browser distribution artifact. 2. The attacker publishes a malicious release under a dependency name used by the setup script. 3. A user runs `setup.sh`. 4. The script ...[truncated 1410 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create and use a project-specific virtual environment instead of modifying the system Python installation: ```bash python3 -m venv .venv . .venv/bin/activate python -m pip install --upgrade pip ``` 2. Remove `--break-system-packages` from all installation commands. 3. Pin every direct and transitive dependency to reviewed versions in a lock file. 4. Generate and enforce cryptographic hashes, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 5. Pin the Playwright package and browser revision to tested versions. Verify downloaded artifacts through trusted package sources and available integrity controls. 6. Separate browser and operating system dependency installation from normal skill setup. Clearly disclose that this optional step may require elevated privileges and require explicit user confirmation. 7. Run installation and scraping under a dedicated, unprivileged account or container with access limited to the required project and session directories. 8. Add dependency scanning and update review to the release process. Regenerate the lock file only after reviewing new direct and transitive dependency versions. ]]>