Tainted flow: 'LOG_FILE' from os.environ.get (line 23, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Content
def log(msg: str) -> None: """写入日志（用于调试）""" try: with open(LOG_FILE, "a", encoding="utf-8") as f: f.write(f"[{datetime.now().strftime('%H:%M:%S')}] {msg}\n") except Exception: pass- Confidence
- 81% confidence
- Finding
- LOG_FILE is taken directly from an environment variable and then opened for append without validation. If an attacker can influence the hook environment, they can redirect writes to arbitrary filesystem paths, potentially overwriting or polluting sensitive files accessible to the running user, or abusing symlinks in /tmp-style locations.