Tainted flow: 'url' from os.getenv (line 100, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Content
# ────────────────────────────────────────────────────── def download_image(url: str, out_path: str) -> bool: try: r = requests.get(url, timeout=60) r.raise_for_status() Path(out_path).parent.mkdir(parents=True, exist_ok=True) with open(out_path, "wb") as f:- Confidence
- 94% confidence
- Finding
- r = requests.get(url, timeout=60)
