T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned and Unverified Third-Party Dependencies and Browser Binaries
- Content
View full analysis
=1.40.0 ``` `install.sh:43-55` ```bash source venv/bin/activate pip install --upgrade pip pip install playwright # 安装浏览器 echo "" echo "🌐 正在安装 Playwright 浏览器..." playwright install chromium # 安装 Node.js 依赖（如果有 Node.js） if command -v npm &> /dev/null; then echo "" echo "📦 正在安装 Node.js 依赖..." npm install fi ``` `install_playwright_docker.py:7-8` ```python PLAYWRIGHT_VERSION = os.environ.get("PW_VERSION", "1.50.0") IMAGE_TAG = f"mcr.microsoft.com/playwright/python:v{PLAYWRIGHT_VERSION}-noble" ``` `install_playwright_docker.py:17-25` ```python def mode_official() -> None: run(["docker", "pull", IMAGE_TAG]) dockerfile = f"""FROM {IMAGE_TAG} WORKDIR /app COPY requirements.txt /app/requirements.txt RUN pip install --no-cache-dir -r /app/requirements.txt CMD [\"python\", \"--version\"] """.strip() ``` `install_playwright_docker.py:30-34` ```python env = os.environ.copy() env.setdefault("PLAYWRIGHT_DOWNLOAD_HOST", "https://npmmirror.com/mirrors/playwright") env.setdefault("PLAYWRIGHT_CHROMIUM_DOWNLOAD_HOST", "https://cdn.npmmirror.com/binaries/chrome-for-testing") venv_python = Path("venv/bin/python") venv_pip = Path("venv/bin/pip") ``` The corresponding installation calls are: ```python run([str(venv_pip), "install", "-r", "requirements.txt"], env=env) run([str(venv_python), "-m", "playwright", "install", "chromium"], env=env) ``` `SKILL.md:36-41` ```bash cd npm install ``` ```bash npx playwright install chromium ``` ### Technical Analysis The Python dependency permits any Playwright r ...[truncated 3487 chars]- Remediation
View remediation
``` 2. Generate a fully resolved lock file containing cryptographic hashes for Playwright and all transitive Python dependencies. Install with hash enforcement, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Remove the implicit `pip install --upgrade pip` operation from normal installation. If a specific pip release is required, pin and verify it explicitly. 4. Keep the Playwright package version and browser revision synchronized. Verify downloaded browser archives using vendor-published checksums or signatures before execution. 5. Prefer official Playwright distribution endpoints. If third-party mirrors are operationally required: - Document them as an explicit trust dependency. - Pin expected artifact hashes. - Require an explicit user option instead of enabling them by default. - Use strict TLS validation and monitor mirror integrity. 6. Pin the Playwright Docker image by immutable digest: ```dockerfile FROM mcr.microsoft.com/playwright/python:v-noble@sha256: ``` 7. Remove `npm install` and `npx playwright install chromium` from the instructions unless Node dependencies are genuinely required. If they are required, add a reviewed `package.json` and lock file, use exact package versions, and install with: ```bash npm ci ``` 8. Avoid dynamic `npx` package retrieval. Invoke a project-local, lock-file-managed executable instead. 9. Run installation as an unprivileged user and avoid granting the installer unnecessary host mounts, credentials, or privileged Docker access. ]]>