Description: The code fetches and writes remote content directly to the local protocol file without
validating response status, size, or content type, which could allow corrupted or
malicious data to be persisted if the upstream or network is compromised.
update_cdp.py [75-81]

for domain_file in includes:
    url = base_url + domain_file
    response = http.request("GET", url)
    concatenated += response.data.decode("utf-8") + "\n"
# Overwrite the file with concatenated domains
with open(file_path, "w") as file:
    file.write(concatenated)

Follow the guide to enable codebase context checks.

Follow the guide to enable custom compliance check.

Add a status check after the HTTP request to ensure it was successful (status
200), and raise an exception if it failed to prevent generating a corrupted
file.

scripts/update_cdp.py [77-78]

 response = http.request("GET", url)
+if response.status != 200:
+    raise Exception(f"Failed to fetch {url}, status code: {response.status}")
 concatenated += response.data.decode("utf-8") + "\n"

• Apply / Chat

Ensure the HTTP response is closed after use to avoid leaking connections; use a
context manager with preload_content=False or explicitly release it.

scripts/update_cdp.py [77-78]

-response = http.request("GET", url)
-concatenated += response.data.decode("utf-8") + "\n"
+response = http.request("GET", url, preload_content=False)
+try:
+    concatenated += response.read().decode("utf-8") + "\n"
+finally:
+    response.release_conn()

• Apply / Chat