T08 · Insecure Dependencies
Warning
- Location
requirements.txt:4- Finding
Unpinned Dependencies and Unsafe Automatic Package Installation
- Content
View full analysis
bool: # ... install_cmd = dep.get('install_cmd') if not install_cmd: print(f"[INFO] No auto-install command for {dependency}") return False print(f"[INFO] Installing {dependency}...") print(f" Command: {install_cmd}") try: result = subprocess.run( install_cmd.split(), capture_output=True, text=True, timeout=120 ) ``` ### Technical Analysis All third-party packages are specified without exact versions or integrity hashes. The built-in installer consequently asks the active `pip` executable to resolve the latest package versions and their transitive dependencies from its configured package index. Although the package names match the documented OCR functionality and the installer does not use a shell, the effective code installed can change without any modification to this Skill. Python ...[truncated 1619 chars]- Remediation
View remediation
paddlepaddle== pytesseract== pillow== opencv-python== numpy== ``` 2. Generate a lockfile that also constrains transitive dependencies. 3. Require package hashes, for example through a hash-locked requirements file and: ```bash python -m pip install --require-hashes -r requirements.lock ``` 4. Replace `pip` from `PATH` with the interpreter-associated invocation: ```python subprocess.run( [sys.executable, "-m", "pip", "install", "--require-hashes", "-r", str(lockfile)], check=True, capture_output=True, text=True, timeout=120 ) ``` 5. Disable automatic dependency installation by default. Provide the exact proposed command and require explicit user confirmation. 6. Document and enforce an approved HTTPS package index. 7. Scan locked dependencies for known vulnerabilities and update them through a controlled review process. 8. Correct the security policy so its dependency-pinning claims accurately reflect the implementation. ]]>