Tainted flow: 'req' from os.environ.get (line 194, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Content
req = urllib.request.Request(url, data=data, headers=headers, method=method.upper()) try: with urllib.request.urlopen(req) as resp: payload = resp.read().decode("utf-8", errors="replace") return json.loads(payload) if payload else {"code": resp.status, "result": None} except urllib.error.HTTPError as e:- Confidence
- 90% confidence
- Finding
- Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.