T08 · Insecure Dependencies
Warning
- Location
- scripts/scaffold_adapter.py:184
- Finding
- Generated Projects Install Dependencies Before Enforcing a Reviewed Lockfile<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scaffold_adapter.py:184-195` and `scripts/scaffold_adapter.py:240-244` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code The generated `pyproject.toml` uses mutable dependency ranges: ```python def _pyproject(package: str) -> str: project = package.replace("_", "-") runtime_dependency = f"game-learning-runtime~={PYTHON_API_COMPATIBLE_RELEASE}.0" return f'''[build-system] requires = ["editables>=0.5", "hatchling>=1.27"] build-backend = "hatchling.build" [project] name = "{project}" version = "0.1.0" requires-python = ">=3.10" dependencies = [ "{runtime_dependency}", ] [dependency-groups] dev = ["editables>=0.5", "hatchling>=1.27", "mypy>=1.15", "pytest>=8.3", "ruff>=0.11"] ``` The generated setup procedure resolves and installs those dependencies before checking the lock state: ```python def _justfile() -> str: windows_shell = ( 'set windows-shell := ["powershell.exe", "-NoLogo", "-NoProfile", ' '"-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command"]' ) return f"""set shell := ["bash", "-eu", "-o", "pipefail", "-c"] {windows_shell} export UV_PROJECT_ENVIRONMENT := ".venv-glr" default: check setup: vx uv sync --python 3.12.13 --all-groups --no-install-project vx uv sync --python 3.12.13 --all-groups --no-build-isolation lock-check: vx uv lock --check ``` ### Technical Analysis The scaffold does not emit a pre-reviewed `uv.lock`, while the generated dependency declarations permit multiple future versions through compatible-release and lower-bound constraints. The `setup` target invokes `uv sync`, which may resolve and download the currently available versions matching those constraints. The lock validation occurs only afterward through the separate `lock-check` target. Consequently, the first installation is not constrained by a previously reviewed immutable dependency graph. This crea ...[truncated 1841 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Generate and distribute a reviewed `uv.lock` with every scaffolded project. 2. Pin direct and build-system dependencies to exact reviewed versions rather than open lower-bound ranges. 3. Run lock validation before any dependency installation. 4. Replace the generated setup commands with frozen synchronization, for example: ```make lock-check: vx uv lock --check setup: lock-check vx uv sync --frozen --python 3.12.13 --all-groups --no-install-project vx uv sync --frozen --python 3.12.13 --all-groups --no-build-isolation ``` 5. Configure an explicit, approved Python package index and disable untrusted supplemental indexes to reduce dependency-confusion exposure. 6. Review and update the lockfile through a controlled dependency-update process with provenance verification, vulnerability scanning, and test execution. 7. Where supported, require artifact hashes and reject packages whose hashes do not match the reviewed lock data. 8. Perform initial dependency installation in a sandboxed environment without developer credentials or access to sensitive repositories. ]]>