Introduction of a supply chain attack

changing this in a program that has no deps:

subprocess.run(
["ls], cwd=build_temp, check=True
)

to a security module and a requirements.txt requirement with no ---hash

means that we have strictly made things less secure.

i think

if there no variables used in the subprocess call, then probably, it's better not to introduce a new dependency
anytime when adding to requirements.txt, include the --hash sha256:... command, to make it harder to attack

@earonesty

Hi @earonesty thanks so much for your feedback.

First of all, correct me if I'm wrong, but I'm assuming this change was introduced by @pixeebot? If so, and if it was in a public repository, would you mind sharing a link to the PR?

To address your specific comments:

Yes you are correct that in this case, with a hard-coded command, it looks like there's not as much value in adding this hardening layer. This change is actually implemented here: https://github.com/pixee/codemodder-python/blob/main/src/core_codemods/process_creation_sandbox.py. I will open an issue on https://github.com/pixee/codemodder-python to suggest that we should try harder to detect this case.
Your idea about adding a specific --hash for requirements.txt is a good one. I'm not entirely sure whether this is possible for dependencies expressed in setup.py or pyproject.toml but it bears more research

Closing this issue since the items raised here are really related to the behavior of https://github.com/pixee/codemodder-python. Please see the linked issues and join the discussion there.

Thanks again for your feedback.

Navigation Menu

Repository navigation

Introduction of a supply chain attack #10

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Introduction of a supply chain attack #10

Description

Activity

drdavella commented on Feb 13, 2024

drdavella commented on Feb 14, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions