Skip to content

Security: Add timeout to all HTTP requests (requests library) #37

Description

@CViescaA

Description

The QGIS.org plugin security check flagged a missing `timeout` parameter in HTTP requests:

File: `dialogs/server_config_dialog.py` Line 230
Issue: `requests.get(url)` called without `timeout`

Additionally, `api_request.py` line 117 uses `self.session.request()` without a timeout for all API calls (including ZIP uploads).

Risk

Without a timeout, requests can hang indefinitely if the server is unresponsive, potentially freezing the QGIS UI.

Proposed Solution

  • Add a `timeout=30` seconds for simple connectivity tests (`testHttpConn`).
  • Add a `timeout=(10, 300)` tuple (connection timeout, read timeout) for API requests. The generous read timeout (300s) accounts for large geodata ZIP file uploads.
  • Centralize timeout constants in `settings.py` for maintainability.
  • Add `requests.exceptions.Timeout` to exception handlers.

References

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions