T08 · Insecure Dependencies
Warning
- Location
scripts/utils/dependencies.py:13- Finding
Automatic Installation of Unpinned Python Dependencies at CLI Startup
- Content
View full analysis
Vulnerability Details
File Location:
scripts/convert.py:17-29;scripts/utils/dependencies.py:13-68
Vulnerability Type: Automatic installation of unpinned third-party packages
Risk Level: MediumVulnerable Code
python # scripts/convert.py:17-29 # 检查并安装依赖 from utils import ( check_and_install_dependencies, get_file_list, print_info, print_error, print_feature_status ) success, missing = check_and_install_dependencies() if not success: print_error(f"Failed to install dependencies: {', '.join(missing)}") sys.exit(1)python # scripts/utils/dependencies.py:13-68 def check_and_install_dependencies() -> Tuple[bool, List[str]]: """ 检查并自动安装缺失的依赖 Returns: (是否全部安装成功, 缺失的依赖列表) """ # 核心依赖（必需） required = { 'python-docx': 'docx', # Word 文档处理 'pdfplumber': 'pdfplumber', # PDF 文本提取 'Pillow': 'PIL', # 图片处理 'tqdm': 'tqdm', # 进度条 'requests': 'requests', # HTTP 请求（网页抓取） 'beautifulsoup4': 'bs4', # HTML 解析 'openpyxl': 'openpyxl', # Excel 处理 } # 可选依赖（按功能分组） optional = { # 文档转换 'pypandoc': 'pypandoc', # Markdown → Word（高质量） 'docx2pdf': 'docx2pdf', # Word → PDF（Windows + MS Word） # 数据处理 'pandas': 'pandas', # Excel 高级处理 # 图片处理 'imageio': 'imageio', # 图片 IO } missing = [] installed = [] # 检查必需依赖 for package, module in required.items(): try: __import__(module) except ImportError: missing.append(package) # 自动安装缺失的必需依赖 if missing: print(f"[INFO] 检测到缺失依赖: {', '.join(missing)}") for package in missing: ...[truncated 2858 chars]- Remediation
View remediation
Remediation Suggestions
- Remove automatic package installation from module imports and normal CLI execution.
- Declare dependencies in
pyproject.toml, a locked requirements file, or another standard package manifest. - Pin reviewed package versions and use cryptographic hashes, such as pip's
--require-hashesmode. - Require users to perform an explicit installation step before invoking the converter.
- Install dependencies in a dedicated virtual environment or isolated container instead of modifying the active interpreter.
- Preserve pip output and installation errors so users can verify package sources and artifacts.
- Configure a trusted package index explicitly in controlled deployments.
- If automatic setup is essential, require explicit user confirmation and expose it as a separate command such as
convert.py setup; do not run it for--help,--status, or conversion commands. - Run dependency auditing and vulnerability scanning against the locked dependency set as part of release validation.