T08 · Insecure Dependencies
Error
- Location
.- Finding
Unpinned third-party packages are downloaded and executed
- Content
View full analysis
/dev/null; then echo "📦 Installing pyyaml..." python3 -m pip install --user pyyaml --quiet 2>/dev/null || { echo "❌ pyyaml is required but could not be installed. Install manually: pip install pyyaml" exit 1 } fi ``` `scripts/validate-contract.sh:59-65`: ```bash if command -v npx &>/dev/null && [[ -f "$CONTRACTS/api-spec.yaml" ]]; then echo "OpenAPI Validation:" if npx --yes @redocly/cli lint "$CONTRACTS/api-spec.yaml" --skip-rule no-unused-components 2>/dev/null; then echo " ✅ OpenAPI spec is valid" else echo " ⚠️ OpenAPI validation had warnings/errors (non-blocking)" fi ``` `scripts/setup-guardrails.sh:352-359`: ```yaml - uses: golangci/golangci-lint-action@v6 with: version: latest ``` `scripts/setup-guardrails.sh:369-377`: ```yaml - uses: actions/setup-python@v5 with: python-version: "3.12" - run: pip install ruff - run: ruff check . - run: ruff format --check . ``` `scripts/setup-guardrails.sh:463-470`: ```yaml aegis-go-lint: stage: aegis-lint image: golang:1.22 script: - go vet ./... - test -z "$(gofmt -l .)" - go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest - golangci-lint run ./... ``` `scripts/setup-guardrails.sh:511-516`: ```yaml aegis-python-lint: stage: aegis-lint image: python:3.12 script: - pip install ruff - ruff check . - ruff format --check ...[truncated 1773 chars]- Remediation
View remediation
... npx --yes @redocly/cli@ ... python3 -m pip install --require-hashes -r requirements-tools.txt go install github.com/golangci/golangci-lint/cmd/golangci-lint@ ``` 2. Declare Node.js tools in `devDependencies`, commit the lockfile, and execute them after `npm ci` or `pnpm install --frozen-lockfile`. 3. Declare Python tooling in a locked requirements file with package hashes rather than installing packages automatically from the generator. 4. Replace `version: latest` with a reviewed fixed version. 5. Pin GitHub Actions to immutable commit SHAs where feasible. 6. Separate dependency installation from validation so validation does not silently retrieve executable code. 7. Restrict CI token permissions and do not expose secrets to validation jobs that do not require them. ]]>