Yufeng He cbbd72a1ab

fix(skillscan): recognize remaining requests/httpx HTTP methods as network sinks (#4130) ...

python-env-dump-exfil flags a file that both reads the bulk process environment
and reaches a network sink. The call-based sink check only listed requests
get/post/put/request and httpx get/post, so a bulk env dump sent through an
equally body-carrying method (requests.patch/delete, httpx.put/patch/delete, or
the generic httpx.request/stream) evaded the CRITICAL finding whenever the
destination URL was not a plain string literal (e.g. built at runtime) -- the
exact evasion the string-literal URL sink is meant to resist. requests.post was
caught but requests.patch was not, an arbitrary gap on clients the analyzer
already covers.

Complete the requests and httpx HTTP-verb surface in _call_is_network_sink so an
obfuscated-URL exfil through those methods is flagged like post/put.

Signed-off-by: Yufeng He <40085740+he-yufeng@users.noreply.github.com>

2026-07-13 16:11:17 +08:00

..

harness

fix(skillscan): recognize remaining requests/httpx HTTP methods as network sinks (#4130)

2026-07-13 16:11:17 +08:00