Tainted flow: 'req' from os.environ.get (line 150, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The ClickHouse endpoint is fully controlled by the PDD_CH_URL environment variable and is used directly in urllib.request.urlopen without validation, allowlisting, or transport security requirements. In an agent or shared runtime, a malicious or misconfigured environment can redirect shop data to an attacker-controlled host, enable SSRF to internal services, or silently exfiltrate business data.
- Content
python def _ch(sql, data=None): q = urllib.parse.urlencode({"query": sql, "default_format": "JSONEachRow"}) req = urllib.request.Request(f"{CH_URL}/?{q}", data=data, method="POST" if data else "GET") return urllib.request.urlopen(req, timeout=30).read().decode() def _ch_rows(sql): out = _ch(sql).strip()