Tainted flow: 'req' from os.environ.get (line 25, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The code builds outbound requests to a URL taken directly from the PROXY_URL environment variable and sends both user query data and the X-Proxy-Token header to that destination. If the runtime environment is misconfigured or attacker-controlled, this enables server-side request forgery and credential exfiltration to an arbitrary endpoint, which is especially risky because the proxy token is transmitted automatically on every request.
- Content
python method="POST", ) try: resp = urllib.request.urlopen(req, timeout=timeout) data = json.loads(resp.read().decode("utf-8")) if data.get("status") == "error": return {"success": False, "error": data.get("message", "未知错误")}