Use of urlopen()

[Pascal-0x90]

Proposal

The use of urlopen() can pose security threats and should be replaced with a safer alternative.

Motivation

The codebase should more strictly follow Python convention to hopefully improve maintainability.

Details

I feel this is something we can leave alone in the code. The user cannot define custom URLs. The security vulnerability comes when the user can define the use of file:// however, we only let the user have access to the http:// and https:// protocols.

findcdn/src/findcdn/cdnEngine/detectCDN/cdn_check.py

Line 131 in 25eb36e

response = request.urlopen(req, timeout=timeout) # nosec

[DoctorEww]

I agree there is not an obvious way to exploit the protocol; I don't see this as an issue.

[S4lt5]

@Pascal-0x90 @DoctorEww While it might not be exploitable, I had always understood that urllib (not urrllib3 pip module) is not thread safe. Does that pose any issues here with use in the threadpool?