T08 · Insecure Dependencies
Error
- Location
scripts/install.sh:184- Finding
Downloaded installer can execute without successful integrity verification
- Content
View full analysis
/dev/null; then curl -fsSL -O "${installer_url}" elif command -v wget &> /dev/null; then wget -q "${installer_url}" else log_error "未找到 curl 或 wget，请手动下载安装器" exit 1 fi # 添加执行权限（非 Windows） if [ "$os" != "windows" ]; then chmod +x "${installer_name}" fi log_info "安装器下载完成，正在校验完整性..." # SHA256 完整性校验 local platform_key="${os}-${arch}" local expected_checksum expected_checksum="$(get_checksum "$platform_key")" if [ -n "$expected_checksum" ]; then local actual_checksum="" if command -v sha256sum &> /dev/null; then actual_checksum=$(sha256sum "${installer_name}" | awk '{print $1}') elif command -v shasum &> /dev/null; then actual_checksum=$(shasum -a 256 "${installer_name}" | awk '{print $1}') else log_warn "未找到 sha256sum/shasum 工具，跳过完整性校验" fi if [ -n "$actual_checksum" ]; then if [ "$actual_checksum" != "$expected_checksum" ]; then log_error "SHA256 校验失败！文件可能被篡改" log_error " 期望: ${expected_checksum}" log_error " 实际: ${actual_checksum}" rm -f "${installer_name}" exit 1 fi log_info "SHA256 校验通过" fi else log_warn "当前平台 ${platform_key} 无预置校验值，跳过完整性校验" fi ``` ```bash echo "" echo -e "${YELLOW}即将执行已下载的安装器：${NC}" echo " 路径: ./${installer_name}" echo " 来源: ${installer_url}" echo " SHA256: 已校验通过" echo "" echo "该安装器将向系统写入 bdpan CLI 二进制（通常位于 ~/.local/bin）。" if [ "$force" = "yes" ]; then log_warn "检测到 --yes/--force，跳过最终确认（非交互模式）。" else read -p "是否现在执行安装器？[y/N] " -n 1 -r echo if [[ ! $REPLY =~ ^[Yy]$ ]]; then log_info "已取消执行。安装器文件保留在当前目录：./${installer_name}" log_info "您可以先审查内容，或稍后手动执行：./${installer_name}" exit 0 fi fi # 执行安装器（非交互模式） ./${ins ...[truncated 2037 chars]- Remediation
View remediation
/dev/null 2>&1; then actual_checksum=$(sha256sum "$installer_path" | awk '{print $1}') elif command -v shasum >/dev/null 2>&1; then actual_checksum=$(shasum -a 256 "$installer_path" | awk '{print $1}') else log_error "No SHA-256 verification tool is available; refusing to execute." exit 1 fi [ -n "$expected_checksum" ] || { log_error "No pinned checksum exists for this platform; refusing to execute." exit 1 } [ "$actual_checksum" = "$expected_checksum" ] || exit 1 ``` ]]>