New check: download of .whl followed by pip install
Open
@laurentsimon is already working on this.
Since Jun 24, 2021.
kind/enhancement
Stale
- Dominant language
- Go
- Stars
- 5.7k
- Forks
- 724
- Avg merge
- 19h 30m
- Merged PRs (30d)
- 1
Description
We currently support downloadds followed by execution, bash, and other interpreters (see shell_download_validate.go#L38). We d support file saved on disk and executed. However, there are other patterns we don't support, such as:
- download of .whl followed by
pip install - download of .deb followed by
dpkg -i - download of whatever followed by its installer
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.