T08 · Insecure Dependencies
Error
- Location
- scripts/code_to_diagram.js:503
- Finding
- Automatic Execution of an Unpinned npm Package Through npx<![CDATA[ ## Vulnerability Details **File Location**: `scripts/code_to_diagram.js:503-546` **Vulnerability Type**: Unpinned dependency retrieval and execution **Risk Level**: High ### Vulnerable Code ```js function renderWithMmdc(inputMmdPath, pngPath, args) { let mmdc = resolveMmdc() let useNpx = false if (!mmdc) { console.log('⚙️ 未直接找到 mmdc，将通过 npx 调用 @mermaid-js/mermaid-cli …') useNpx = true } else { console.log(`🔧 使用官方渲染器 mmdc：${mmdc}`) } const theme = THEMES[args.theme] if (!theme) { console.error(`❌ 未知主题：${args.theme}`) console.error(` 可用主题：${AVAILABLE_THEMES.join(', ')}`) process.exit(1) } const mermaidConfig = buildMermaidConfig(theme, args) const configFile = path.join(os.tmpdir(), `code_to_diagram_mermaid_config_${Date.now()}.json`) fs.writeFileSync(configFile, JSON.stringify(mermaidConfig, null, 2)) const puppeteerCfg = writePuppeteerConfig() const chineseFontCss = writeChineseFontCss(args.font) const bgColor = args.transparent ? 'transparent' : (args.bg || theme.bg) const mmdcArgs = [ ...(useNpx ? ['mmdc'] : []), '-i', inputMmdPath, '-o', pngPath, '-c', configFile, '-b', bgColor, '-w', String(args.width), '-H', String(args.height), '-s', String(args.scale), '-p', puppeteerCfg, '-C', chineseFontCss, ] const cmd = useNpx ? 'npx' : mmdc const result = spawnSync(cmd, mmdcArgs, { stdio: 'inherit', shell: false }) ``` ### Technical Analysis When a local or global `mmdc` executable cannot be found, the renderer automatically invokes: ```bash npx mmdc ... ``` This command does not use `--no-install`, an exact version, a verified integrity value, or the explicitly documented package name `@mermaid-js/mermaid-cli`. Depending on the npm/npx version and local cache state, `npx` may retrieve and execute the package currently resolved under the unscoped name `mmdc`. The status message claims that the official scoped Mermaid CLI package will be us ...[truncated 1895 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic package downloading from the normal rendering path. 2. Require a preinstalled and explicitly trusted Mermaid CLI executable. 3. If a local npm dependency is supported, declare an exact version of `@mermaid-js/mermaid-cli` in `package.json`, preserve its integrity in `package-lock.json`, and execute only `node_modules/.bin/mmdc`. 4. Use `npx --no-install mmdc` if npx is retained solely as a launcher for an already installed dependency. 5. If runtime downloading is unavoidable: - Require explicit user confirmation. - Use the exact scoped package and a pinned version. - Validate the registry and package integrity. - Disable lifecycle scripts where operationally possible. - Run installation and rendering in an isolated, unprivileged container. 6. Make logs accurately identify the command and package that will actually be executed. 7. Fail closed when the trusted renderer is unavailable rather than silently changing to a network-capable execution path. ]]>