Detect requests.request() calls without a timeout in B113 - #1463
Open
arpitjain099 wants to merge 1 commit into
Open
Detect requests.request() calls without a timeout in B113#1463arpitjain099 wants to merge 1 commit into
arpitjain099 wants to merge 1 commit into
Conversation
B113 flags requests calls that lack a timeout, but it only matched the
named verb helpers (get, post, put, and so on). It never checked
requests.request(method, url, ...), the generic entry point those helpers
wrap, which also has no default timeout. Both requests.request('GET', url)
and requests.request('GET', url, timeout=None) were missed.
The httpx branch of the same plugin already keeps "request" in its set, so
httpx.request(..., timeout=None) was caught while the requests equivalent
was not. This adds a REQUESTS_ATTRS set (the verbs plus "request") and uses
it for the two requests branches; httpx behavior is unchanged.
Extends examples/requests-missing-timeout.py with the two new error cases
and a timeout=5 okay case, and bumps the functional test counts from 25 to
27.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
arpitjain099
requested review from
ericwb,
lukehinds and
sigmavirus24
as code owners
July 24, 2026 18:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I work on supply-chain security tooling and was reading the B113 plugin.
B113 flags
requestscalls that are missing a timeout, but it only looks at the named verb helpers (get, post, put, and so on). It never checksrequests.request(method, url, ...), which is the generic entry point those helpers all wrap and which also has no default timeout. So both of these are missed today:The httpx side of the same plugin already includes
"request"in its set, sohttpx.request(..., timeout=None)is caught while the requests equivalent is not. This lines the two up.The change is small: add a
REQUESTS_ATTRSset (the verbs plus"request") and use it for the two requests branches. httpx behavior is unchanged. I extendedexamples/requests-missing-timeout.pywith the two new error cases plus atimeout=5okay case, and bumped the expected counts in the functional test (25 to 27). The functional suite passes locally.