<![CDATA[T03
Error
- Location
scripts/check_compatibility.py:388- Finding
<![CDATA[Untrusted remote package code is installed and executed without isolation]]>
- Content
View full analysis
Tuple[bool, str, str]: """Run a shell command and return success status, stdout, stderr.""" try: result = subprocess.run( cmd, capture_output=True, text=True, timeout=timeout, cwd=cwd, env={**os.environ, "PIP_NO_CACHE_DIR": "1"} ) ``` ```python # Create temporary virtual environment pip_cmd = [sys.executable, "-m", "pip", "install", "--target", venv_path, package_name] success, stdout, stderr = run_command(pip_cmd, timeout=300) ``` ```python # Run pytest with verbose output and result reporting # Use --import-mode=importlib to avoid importing from source directory success, stdout, stderr = run_command( [sys.executable, "-m", "pytest", str(test_file), "-v", "--tb=short", "--import-mode=importlib"], timeout=120, # 2 minutes per test file cwd="/tmp" # Run from /tmp to avoid importing from source ) ``` ### Technical Analysis The checker installs user-selected packages and executes tests obtained from downloaded package source. Both operations can execute arbitrary third-party code: - `pip install` may invoke PEP 517 build backends, build-system dependencies, native compilers, or legacy setup hooks. - Pytest imports test modules and package modules during collection and execution. - `--target` changes the installation destination but does not create a security boundary. - Running from `/tmp` and using `--import-mode=importlib` do not restrict filesystem, process, or network access. - `run_command` copies the complete host environment through `env={**o ...[truncated 1821 chars]- Remediation
View remediation