DeppWang / youdaonote-pull

📝 一个一键导出 / 备份「有道云笔记」所有笔记的 Python 脚本。 A Python script to export/backup all the notes of the "Youdao Note".
MIT License
1.33k stars 292 forks source link

Potential Vulnerability in requests==2.22.0 #153

Open wangyueq0101 opened 1 month ago

wangyueq0101 commented 1 month ago

Summary

A reachable construct was identified in requests==2.22.0 through my static analysis database. This version has been flagged as vulnerable in PyPI's open-source vulnerability database. The analysis uncovered 1call chain leading to this construct. Below is one example to illustrate the potential vulnerability:

Call Chain Analysis

pull->pull.YoudaoNotePull.pull_dir_by_id_recursively->core.api.YoudaoNoteApi.get_dir_info_by_id->core.api.YoudaoNoteApi.http_get->requests.sessions.Session.get->requests.sessions.Session.request->requests.sessions.Session.send->requests.sessions.SessionRedirectMixin.resolve_redirects->requests.sessions.SessionRedirectMixin.rebuild_proxies

Patch and Code Changes

We suspect that this construct( requests.sessions.SessionRedirectMixin.rebuild_proxies) may be vulnerable because it was modified in a [security-related patch]. This suggests that the original code might have contained a flaw, and it may still be risky to use the affected version (requests==2.22.0) without further investigation.

Note:

This issue was identified through a static analysis of the project at commit [76dd82fb2216250027e7bd17b54df99e4700704c].