Tainted flow: 'req' from os.environ.get (line 696, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 97% confidence
- Finding
Sending the API key to the intended service is expected, but the destination safeguards are flawed: the localhost prefix check also accepts an external address such as http://localhost.attacker.example without explicit HTTP opt-in. If an attacker induces that base-URL configuration, requests disclose the automatically resolved API key and submitted data over HTTP; default urllib redirects can also forward the custom X-API-Key header across origins.
- Content
python req = Request(url, data=body, headers=headers, method=method) try: with urlopen(req, timeout=120) as resp: raw = resp.read().decode("utf-8") return json.loads(raw) if raw else {} except HTTPError as e: