T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:9
- Finding
- Invalid dependency hashes combined with ineffective installation verification<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:9-49`; `verify_install.sh:29-39` **Vulnerability Type**: Supply-chain integrity control failure **Risk Level**: Medium ### Vulnerable Code `requirements.txt:9-13`: ```text yfinance==0.2.40 \ --hash=sha256:2be58b9e7c69e6d92a61f1e0b8c8df7b3d4c8f77f59f0b7e5b33f1c6e50e6b6f requests==2.31.0 \ --hash=sha256:942c5a758f98d844f6e0e4f3d1c7e1c7a6e9f8c1f1a8e8c8d8e8f8a8b8c8d8e8 beautifulsoup4==4.12.3 \ ``` Additional suspicious hash entries at `requirements.txt:30-37`: ```text pandas==2.2.0 \ --hash=sha256:1187589f2c6a0f3c7a52c9c1e8dc7f2f8e7f5f5d5e6f5e5c5d5a5b5c5d5e5f5a numpy==1.26.3 \ --hash=sha256:697f3f8c8e1a8d1f4c1e8b6c3d1e1f5d5e5c5d5a5b5c5d5e5f5a5b5c5d5e5f5a ``` `verify_install.sh:29-39`: ```bash # Check 2: Verify requirements.txt echo "2. Verifying requirements.txt..." if [ -f requirements.txt ]; then echo -e "${GREEN} ✓ requirements.txt found${NC}" DEP_COUNT=$(grep -c "==" requirements.txt || echo 0) if [ "$DEP_COUNT" -gt 0 ]; then echo -e "${GREEN} ✓ Contains $DEP_COUNT pinned dependencies${NC}" else echo -e "${YELLOW} ⚠ No pinned dependencies found${NC}" WARNINGS=$((WARNINGS + 1)) fi ``` ### Technical Analysis The manifest supplies SHA-256 values that appear synthetic and do not provide a trustworthy binding to the intended PyPI artifacts. Several values contain conspicuous repeating patterns. Because hashes are present in the requirements file, pip's hash-checking behavior can reject distributions whose actual digest does not match the declared value. The bundled verification script does not validate any digest, download a candidate distribution, run dependency resolution, or invoke pip in hash-verification mode. It only counts lines containing `==`. Consequently, it can report that verification passed even when the requirements cannot be installed or the declared integrity metadata is invalid. This contradicts the pr ...[truncated 1660 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Regenerate hashes from trusted PyPI artifacts using a reproducible workflow such as: ```bash pip-compile --generate-hashes requirements.in ``` Alternatively, download each approved artifact and calculate its digest with `pip hash`. 2. Include valid hashes for every permitted wheel and source distribution needed on supported platforms. 3. Enforce verification explicitly: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Update `verify_install.sh` so it performs dependency resolution and fails on invalid hashes: ```bash python3 -m pip install \ --require-hashes \ --dry-run \ -r requirements.txt ``` 5. Make warnings affect the verifier's exit status when an integrity check fails. Do not print `VERIFICATION PASSED` based only on file presence and pin counts. 6. Test the locked manifest in clean virtual environments for every supported Python version and platform. 7. Recommend virtual-environment installation consistently and avoid suggesting privileged or global pip installation. 8. Correct documentation claims about dependency integrity and platform independence. In particular, packages such as NumPy, pandas, and lxml commonly use platform-specific compiled distributions. ]]>