CodeVetter · Repo Unpack · Risk map
pypa/virtualenv
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The important boundaries involve executing trusted interpreters/plugins, downloading executable packages, generating shell/configuration text, and deleting or overwriting filesystem state. Controls include strict download arguments, digest checks, extraction containment, and quoted substitutions. Cache reuse and subprocess environment handling deserve focused review because their behavior spans multiple invocations and processes.
- Registered entry points are loaded through e.load before implementation selection; the threat model explicitly trusts installed plugins and target interpreters running with the invoking user's rights.
- Filesystem effects extend beyond repository scope: --clear deletes the validated destination, --reset-app-data deletes the selected cache, default cache setup can migrate an old folder, and creation may write an adjacent .venv redirect.
- Download arguments are allow-listed, but PyPI digest verification is skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX is nonempty; the heuristic explicitly does not inspect pip.conf, and local extra-search wheels are trusted without hashes.
- VIRTUALENV_PERIODIC_UPDATE_INSECURE enables an unverified TLS context after the normal metadata lookup fails; those metadata responses provide the expected downloaded-wheel SHA-256 and release dates.
- Downloaded wheels and installation images are reused from trusted app-data without re-verification; bundled verification is memoized by filename, and has_image accepts any nonempty image directory.
- PipInvoke debug logging formats the full subprocess environment through LogCmd; trigger_update launches without its supplied env mapping, and _run_do_update uses os.environ rather than that caller mapping.
- Hypothesis: an interrupted image build or concurrent update-log writer can leave partial/shared state because image validity is only nonemptiness, JSON writes replace contents directly, and inspected update callers do not enter the store's available lock context. (inferred)
- Hypothesis: attacker-modified existing distribution metadata could expand reseeding's deletion scope, since _uninstall_dist joins top_level.txt and RECORD paths to dist.parent and deletes them without an explicit containment check in this function; the documented model trusts destination files. (inferred)