T08 · Insecure Dependencies
Warning
- Location
- oil_price_monitor.py:18
- Finding
- Unsafe sibling-module resolution permits local dependency confusion<![CDATA[ ## Vulnerability Details **File Location**: `oil_price_monitor.py:18-29`; `__init__.py:8-24` **Vulnerability Type**: Local dependency confusion through unsafe `sys.path` modification **Risk Level**: Medium ### Vulnerable Code `oil_price_monitor.py:18-29`: ```python # 添加技能路径支持 workspace_skills = Path(__file__).parent.parent chinese_workdays_path = workspace_skills / 'chinese-workdays' if chinese_workdays_path.exists() and str(chinese_workdays_path) not in sys.path: sys.path.insert(0, str(chinese_workdays_path)) try: from chinese_workdays import ChineseWorkdays except ImportError as e: print("❌ 错误: 需要 chinese-workdays 技能支持") print(f" 详细错误: {e}") sys.exit(1) ``` `__init__.py:8-24`: ```python import sys from pathlib import Path # 添加 chinese-workdays 到路径 workspace_skills = Path(__file__).parent.parent if workspace_skills not in sys.path: sys.path.insert(0, str(workspace_skills)) try: from chinese_workdays import ChineseWorkdays except ImportError: # 如果在技能目录内运行，尝试相对导入 try: sys.path.insert(0, str(Path(__file__).parent.parent / 'chinese-workdays')) from chinese_workdays import ChineseWorkdays except ImportError: ChineseWorkdays = None ``` ### Technical Analysis The package prepends directories outside its own package boundary to Python's module search path and then imports `chinese_workdays` by an unverified module name. In `__init__.py`, the entire parent skills directory is trusted; in `oil_price_monitor.py`, an adjacent `chinese-workdays` directory is trusted. Python executes top-level module code during import. Consequently, a malicious `chinese_workdays.py` file or `chinese_workdays` package placed in a higher-precedence trusted directory can execute arbitrary Python code before the monitor begins its intended work. The implementation does not verify the resolved module path, package publisher, version, signature, or file digest. This does not independently grant access to an ...[truncated 1553 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Package `chinese-workdays` as a normal, reviewed Python dependency and import it without modifying `sys.path`. 2. Pin the dependency to an exact reviewed version and use hashes or signed artifacts in the deployment lock file. 3. Remove the insertion of the broad parent skills directory from `__init__.py`. 4. If cross-skill loading is unavoidable: - Resolve the expected dependency directory with `Path.resolve()`. - Reject symbolic links and paths outside a designated trusted root. - Verify the dependency files against approved cryptographic hashes. - Load the module from an exact verified file rather than performing a name-based search. - Ensure the skills directory is not writable by less-trusted users or processes. 5. After import, verify that `Path(chinese_workdays.__file__).resolve()` is located under the approved dependency directory. ]]>