Tainted flow: 'req' from os.environ.get (line 184, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 96% confidence
- Finding
The request destination is derived from PATENTMAX_BASE_URL, which comes from the environment and is used directly in urllib.request.urlopen when claiming a trial key. In an agent setting, environment variables are often influenced by deployment configuration; if an attacker can change this value, the tool will send outbound requests to an arbitrary host and may interact with a malicious service, enabling SSRF-style abuse and unauthorized exfiltration of submitted patent material or metadata.
- Content
python req.add_header("Content-Type", "application/json") req.add_header("Accept", "application/json") try: with urllib.request.urlopen(req, timeout=30) as response: payload = json.loads(response.read().decode("utf-8")) except urllib.error.HTTPError as exc: message = _server_message(exc.read().decode("utf-8", "replace"))