Skip to content

Commit 1db65a4

Browse files
committed
No need to check httpx client without timeout defined
Unlike python-requests, the httpx client has a default timeout of 5 seconds on its class and functions. As such, there is no need for Bandit to check for an undefined timeout. However, explicitly setting the timeout to None is still a potential problem as that would create a situtation where the client would block forever. Fixes: #1175 Signed-off-by: Eric Brown <[email protected]>
1 parent bcb6648 commit 1db65a4

File tree

2 files changed

+9
-8
lines changed

2 files changed

+9
-8
lines changed

bandit/plugins/request_without_timeout.py

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -59,12 +59,7 @@ def request_without_timeout(context):
5959
HTTPX_ATTRS = {"request", "stream", "Client", "AsyncClient"} | HTTP_VERBS
6060
qualname = context.call_function_name_qual.split(".")[0]
6161

62-
if (
63-
qualname == "requests"
64-
and context.call_function_name in HTTP_VERBS
65-
or qualname == "httpx"
66-
and context.call_function_name in HTTPX_ATTRS
67-
):
62+
if qualname == "requests" and context.call_function_name in HTTP_VERBS:
6863
# check for missing timeout
6964
if context.check_call_arg_value("timeout") is None:
7065
return bandit.Issue(
@@ -73,6 +68,12 @@ def request_without_timeout(context):
7368
cwe=issue.Cwe.UNCONTROLLED_RESOURCE_CONSUMPTION,
7469
text=f"Call to {qualname} without timeout",
7570
)
71+
if (
72+
qualname == "requests"
73+
and context.call_function_name in HTTP_VERBS
74+
or qualname == "httpx"
75+
and context.call_function_name in HTTPX_ATTRS
76+
):
7677
# check for timeout=None
7778
if context.check_call_arg_value("timeout", "None"):
7879
return bandit.Issue(

tests/functional/test_functional.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -411,8 +411,8 @@ def test_requests_ssl_verify_disabled(self):
411411
def test_requests_without_timeout(self):
412412
"""Test for the `requests` library missing timeouts."""
413413
expect = {
414-
"SEVERITY": {"UNDEFINED": 0, "LOW": 0, "MEDIUM": 36, "HIGH": 0},
415-
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 36, "MEDIUM": 0, "HIGH": 0},
414+
"SEVERITY": {"UNDEFINED": 0, "LOW": 0, "MEDIUM": 25, "HIGH": 0},
415+
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 25, "MEDIUM": 0, "HIGH": 0},
416416
}
417417
self.check_example("requests-missing-timeout.py", expect)
418418

0 commit comments

Comments
 (0)