Tainted flow: 'req' from os.environ.get (line 683, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 96% confidence
- Finding
Sending the API key to the intended Phosor endpoint is legitimate, so the environment-to-network flow alone is not exfiltration. However, default urllib redirect handling can forward the custom X-API-Key header to a different origin or an HTTP destination; additionally, the localhost startswith check incorrectly accepts hosts such as http://localhost.attacker.example without explicit HTTP opt-in. Exploitation requires influence over a redirect or the configured endpoint and could expose the generation account's credentials and submitted data.
- Content
python req = Request(url, data=body, headers=headers, method=method) try: with urlopen(req, timeout=120) as resp: raw = resp.read().decode("utf-8") return json.loads(raw) if raw else {} except HTTPError as e: