Secure Dependency Management in Python

Welcome to the next step in our journey to creating secure web applications! In previous lessons, we explored Subresource Integrity (SRI) and secure CORS configuration in FastAPI . Now, we'll dive into the world of secure dependency management for Python applications. This process is crucial in the software development lifecycle, ensuring that the external packages your software relies on are secure from potential threats. Let's explore how we can achieve this through various practices and tools specific to the Python ecosystem. 🚀

The Risk of External Dependencies in Python

As we've seen in the example of SRI implementation in the first unit, security issues can arise not just from our own application code, but also from the external components and dependencies our app relies on. This is why it's essential to regularly check and manage these dependencies for vulnerabilities. Tools like pip list --outdated, pip-audit, and safety help you identify outdated or vulnerable packages in your Python project. Additionally, Software Composition Analysis (SCA) tools can automatically scan your dependencies for known security issues, providing another layer of protection. By integrating these practices into your workflow, you can proactively address risks introduced by third-party packages and maintain a more secure application.

Exploiting Outdated Python Packages

To understand the importance of secure dependency management, let's first look at how outdated packages can be exploited. Imagine a scenario in which an application relies on an outdated Python package with known vulnerabilities. An attacker could exploit these vulnerabilities to gain unauthorized access or execute malicious code. Shell # Example of exploiting an outdated package # Assume 'vulnerable-package' has a known vulnerability in version 1.0.0 pip install vulnerable-package==1.0.0 # Attacker uses the vulnerability to execute malicious code python exploit.py # Example of exploiting an outdated package # Assume 'vulnerable-package' has a known vulnerability in version 1.0.0 pip install vulnerable-package==1.0.0 # Attacker uses the vulnerability to execute malicious code python exploit.py In this example, the attacker installs a specific version of a package known to have vulnerabilities. By exploiting these vulnerabilities, they can execute malicious code, potentially compromising the entire application. This highlights the critical need to keep packages up to date to prevent such attacks.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Shell

# Example of exploiting an outdated package
# Assume 'vulnerable-package' has a known vulnerability in version 1.0.0
pip install vulnerable-package==1.0.0
# Attacker uses the vulnerability to execute malicious code
python exploit.py

Python

import subprocess
import json

def check_outdated_packages():
    """Check for outdated packages using pip list --outdated"""
    try:
        result = subprocess.run(['pip', 'list', '--outdated', '--format=json'], 
                              capture_output=True, text=True, check=True)
        outdated = json.loads(result.stdout)
        
        if outdated:
            print("Outdated packages found:")
            for package in outdated:
                print(f"- {package['name']}: {package['version']} -> {package['latest_version']}")
        else:
            print("All packages are up to date!")
            
    except subprocess.CalledProcessError as e:
        print(f"Error checking outdated packages: {e}")

import subprocess
import json

def check_outdated_packages():
    """Check for outdated packages using pip list --outdated"""
    try:
        result = subprocess.run(['pip', 'list', '--outdated', '--format=json'], 
                              capture_output=True, text=True, check=True)
        outdated = json.loads(result.stdout)
        
        if outdated:
            print("Outdated packages found:")
            for package in outdated:
                print(f"- {package['name']}: {package['version']} -> {package['latest_version']}")
        else:
            print("All packages are up to date!")
            
    except subprocess.CalledProcessError as e:
        print(f"Error checking outdated packages: {e}")

JSON

[
  {
    "name": "requests",
    "version": "2.25.1",
    "latest_version": "2.31.0",
    "latest_filetype": "wheel"
  },
  {
    "name": "fastapi",
    "version": "0.68.0", 
    "latest_version": "0.104.1",
    "latest_filetype": "wheel"
  }
]

[
  {
    "name": "requests",
    "version": "2.25.1",
    "latest_version": "2.31.0",
    "latest_filetype": "wheel"
  },
  {
    "name": "fastapi",
    "version": "0.68.0", 
    "latest_version": "0.104.1",
    "latest_filetype": "wheel"
  }
]

Shell

pip install pip-audit
pip-audit

pip install pip-audit
pip-audit

Shell

pip install safety
safety check

pip install safety
safety check

JSON

[
  {
    "name": "requests",
    "version": "2.25.1",
    "id": "PYSEC-2023-74",
    "fix_versions": ["2.31.0"],
    "description": "Requests vulnerable to Proxy-Authorization header leak",
    "aliases": ["CVE-2023-32681"]
  }
]

[
  {
    "name": "requests",
    "version": "2.25.1",
    "id": "PYSEC-2023-74",
    "fix_versions": ["2.31.0"],
    "description": "Requests vulnerable to Proxy-Authorization header leak",
    "aliases": ["CVE-2023-32681"]
  }
]

Python

def update_package(package_name):
    """Update a specific package to its latest version"""
    try:
        result = subprocess.run(['pip', 'install', '--upgrade', package_name], 
                              capture_output=True, text=True, check=True)
        print(f"Update Report: {result.stdout}")
        
    except subprocess.CalledProcessError as e:
        print(f"Error updating {package_name}: {e}")

def update_package(package_name):
    """Update a specific package to its latest version"""
    try:
        result = subprocess.run(['pip', 'install', '--upgrade', package_name], 
                              capture_output=True, text=True, check=True)
        print(f"Update Report: {result.stdout}")
        
    except subprocess.CalledProcessError as e:
        print(f"Error updating {package_name}: {e}")

Shell

# Create and activate virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies from requirements.txt
pip install -r requirements.txt

# Generate requirements.txt with current packages
pip freeze > requirements.txt

# Create and activate virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies from requirements.txt
pip install -r requirements.txt

# Generate requirements.txt with current packages
pip freeze > requirements.txt

Python

import subprocess
import json

def analyze_outdated_packages():
    try:
        result = subprocess.run(['pip', 'list', '--outdated', '--format=json'], 
                              capture_output=True, text=True, check=True)
        outdated = json.loads(result.stdout)
        
        for package in outdated:
            name = package['name']
            current = package['version']
            latest = package['latest_version']
            print(f"{name}: {current} → {latest}")
            
    except subprocess.CalledProcessError as e:
        print(f"Error: {e}")

import subprocess
import json

def analyze_outdated_packages():
    try:
        result = subprocess.run(['pip', 'list', '--outdated', '--format=json'], 
                              capture_output=True, text=True, check=True)
        outdated = json.loads(result.stdout)
        
        for package in outdated:
            name = package['name']
            current = package['version']
            latest = package['latest_version']
            print(f"{name}: {current} → {latest}")
            
    except subprocess.CalledProcessError as e:
        print(f"Error: {e}")

text

requests: 2.25.1 → 2.31.0
fastapi: 0.68.0 → 0.104.1
pydantic: 1.8.2 → 2.5.0
urllib3: 1.26.5 → 2.1.0

requests: 2.25.1 → 2.31.0
fastapi: 0.68.0 → 0.104.1
pydantic: 1.8.2 → 2.5.0
urllib3: 1.26.5 → 2.1.0

Python

import subprocess
import json

def check_outdated_packages():
    """Check for outdated packages using pip list --outdated"""
    try:
        result = subprocess.run(['pip', 'list', '--outdated', '--format=json'], 
                              capture_output=True, text=True, check=True)
        outdated = json.loads(result.stdout)
        
        if outdated:
            print("Outdated packages found:")
            for package in outdated:
                print(f"- {package['name']}: {package['version']} -> {package['latest_version']}")
        else:
            print("All packages are up to date!")
            
    except subprocess.CalledProcessError as e:
        print(f"Error checking outdated packages: {e}")

JSON

[
  {
    "name": "requests",
    "version": "2.25.1",
    "latest_version": "2.31.0",
    "latest_filetype": "wheel"
  },
  {
    "name": "fastapi",
    "version": "0.68.0", 
    "latest_version": "0.104.1",
    "latest_filetype": "wheel"
  }
]

Shell

pip install pip-audit
pip-audit

Shell

pip install safety
safety check

JSON

[
  {
    "name": "requests",
    "version": "2.25.1",
    "id": "PYSEC-2023-74",
    "fix_versions": ["2.31.0"],
    "description": "Requests vulnerable to Proxy-Authorization header leak",
    "aliases": ["CVE-2023-32681"]
  }
]

Python

def update_package(package_name):
    """Update a specific package to its latest version"""
    try:
        result = subprocess.run(['pip', 'install', '--upgrade', package_name], 
                              capture_output=True, text=True, check=True)
        print(f"Update Report: {result.stdout}")
        
    except subprocess.CalledProcessError as e:
        print(f"Error updating {package_name}: {e}")

Shell

# Create and activate virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies from requirements.txt
pip install -r requirements.txt

# Generate requirements.txt with current packages
pip freeze > requirements.txt

Python

import subprocess
import json

def analyze_outdated_packages():
    try:
        result = subprocess.run(['pip', 'list', '--outdated', '--format=json'], 
                              capture_output=True, text=True, check=True)
        outdated = json.loads(result.stdout)
        
        for package in outdated:
            name = package['name']
            current = package['version']
            latest = package['latest_version']
            print(f"{name}: {current} → {latest}")
            
    except subprocess.CalledProcessError as e:
        print(f"Error: {e}")

text

requests: 2.25.1 → 2.31.0
fastapi: 0.68.0 → 0.104.1
pydantic: 1.8.2 → 2.5.0
urllib3: 1.26.5 → 2.1.0

Secure Dependency Management in Python

The Risk of External Dependencies in Python

Exploiting Outdated Python Packages

Join the 1M+ learners on CodeSignal

Checking for Outdated Python Packages

Understanding JSON-Formatted Output for Outdated Packages

Auditing for Vulnerabilities in Python

Understanding JSON-Formatted Output for Vulnerability Audits

Updating Python Packages Securely

Leveraging Software Composition Analysis (SCA) Tools for Python

Using requirements.txt and Virtual Environments

Using JSON Output in Scripts

Conclusion and Next Steps