T08 · Insecure Dependencies
Warning
- Location
scripts/download_fonts.sh:13- Finding
Unverified Mutable Font Downloads Are Persistently Installed
- Content
View full analysis
Vulnerability Details
File Location:
scripts/download_fonts.sh:13-16, 20-41;scripts/install_fonts.sh:7, 24-32
Vulnerability Type: Unverified third-party binary dependency retrieval
Risk Level: MediumVulnerable Code
From
scripts/download_fonts.sh:bash download() { local url="$1" local output="$2" echo "[INFO] Downloading ${output}" curl -fsSL "${url}" -o "${FONT_DIR}/${output}" }bash download_noto_cjk_minimal() { download "https://raw.githubusercontent.com/notofonts/noto-cjk/main/Serif/SubsetOTF/SC/NotoSerifSC-Bold.otf" "NotoSerifSC-Bold.otf" download "https://raw.githubusercontent.com/notofonts/noto-cjk/main/Serif/SubsetOTF/SC/NotoSerifSC-Regular.otf" "NotoSerifSC-Regular.otf" download "https://raw.githubusercontent.com/notofonts/noto-cjk/main/Sans/SubsetOTF/SC/NotoSansSC-Bold.otf" "NotoSansSC-Bold.otf" download "https://raw.githubusercontent.com/notofonts/noto-cjk/main/Sans/SubsetOTF/SC/NotoSansSC-Regular.otf" "NotoSansSC-Regular.otf" } download_noto_cjk_all() { download_noto_cjk_minimal download "https://raw.githubusercontent.com/notofonts/noto-cjk/main/Serif/SubsetOTF/SC/NotoSerifSC-Medium.otf" "NotoSerifSC-Medium.otf" download "https://raw.githubusercontent.com/notofonts/noto-cjk/main/Sans/SubsetOTF/SC/NotoSansSC-Medium.otf" "NotoSansSC-Medium.otf" } download_fandol_minimal() { download "https://tug.ctan.org/fonts/fandol/FandolFang-Regular.otf" "FandolFang-Regular.otf" download "https://tug.ctan.org/fonts/fandol/FandolSong-Regular.otf" "FandolSong-Regular.otf" } download_fandol_all() { download_fandol_minimal download "https://tug.ctan.org/fonts/fandol/FandolHei-Regular.otf" "FandolHei-Regular.otf" download "https://tug.ctan.org/fonts/fandol/FandolHei-Bold.otf" "FandolHei-Bold.otf" download "https://tug.ctan.org/fonts/fandol/FandolSong-Bold.otf" "FandolSong-Bold.otf" }From
scripts/install_fonts.sh:bash TARGET_DIR="${HOME}/.local/share/fonts/official-document-draftin ...[truncated 2962 chars]- Remediation
View remediation
Remediation Suggestions
- Pin GitHub downloads to an immutable reviewed commit hash or a versioned release rather than the mutable
mainbranch. - Pin CTAN artifacts to a stable, versioned source where possible.
- Maintain trusted SHA-256 or stronger hashes for every supported artifact and verify each download before installation.
- Prefer signed release artifacts and validate upstream signatures when the publishers provide them.
- Download to a securely created temporary file, validate it, and atomically rename it only after all checks pass.
- Validate the expected file type, font structure, filename, and reasonable minimum and maximum file size before installation.
- Delete temporary or invalid files and abort the operation if any verification fails.
- Make
install_fonts.shaccept only a manifest of verified files rather than every file matching a font extension inassets/fonts. - Record installed versions and provide an uninstall or rollback command.
- Document that fonts are persistent user-level components and should only be installed after integrity verification.
A checksum-based download function could follow this pattern:
bash download_verified() { local url="$1" local output="$2" local expected_sha256="$3" local temporary temporary="$(mktemp "${FONT_DIR}/.${output}.XXXXXX")" trap 'rm -f "${temporary}"' RETURN curl --fail --show-error --location \ --proto '=https' --tlsv1.2 \ "${url}" -o "${temporary}" printf '%s %s\n' "${expected_sha256}" "${temporary}" | sha256sum --check - mv -f "${temporary}" "${FONT_DIR}/${output}" trap - RETURN }The checksum values must be obtained independently from reviewed, immutable upstream releases and stored in a version-controlled manifest.
- Pin GitHub downloads to an immutable reviewed commit hash or a versioned release rather than the mutable