Affected: koxudaxi datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.

Affected: PyPI: datamodel-code-generator

### Summary

When `datamodel-code-generator` fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any `Authorization` header, to the redirect target even when the redirect changes origin (host/port/scheme). Credentials that an operator scoped to a trusted schema host are therefore forwarded to an attacker-controlled or otherwise different host, leaking them.

### Details

In `src/datamodel_code_generator/http.py`, `get_body()` follows redirects manually and re-issues each hop with the same `headers` argument, with no check that the origin is unchanged:

```python for redirect_count in range(MAX_HTTP_REDIRECTS + 1): _validate_url_for_fetch(current_url, allow_private_network=allow_private_network) response = httpx.get(current_url, headers=headers, follow_redirects=False, ...) # same headers every hop if (redirect_url := _get_redirect_url(httpx, current_url, response)) is None: break current_url = redirect_url ```

Browsers and HTTP clients such as `requests`/`httpx` strip `Authorization` when a redirect crosses origin; here it is preserved unconditionally. Headers are operator-supplied via `--http-headers` (and credentials can also arrive through `--url` userinfo), so a redirect from the trusted host to any other host discloses them.

### PoC

Self-contained reproducer: https://gist.github.com/thegr1ffyn/ade3035d7f2be95e16f11698259cdbc2 Host A (the trusted schema host) 302-redirects to host B (a di…