Fix timeout security issue

.gitignore

@@ -8,3 +8,6 @@ pb_tool.cfg
 *.iml
 *.ipr
 
+# VS Code
+.vscode
+.venv

api_request.py

@@ -4,7 +4,7 @@
 
 from qgis.core import QgsMessageLog, Qgis
 
-from .settings import TAG
+from .settings import TAG, REQUEST_TIMEOUT_API
 from .helpers import show_fail_box
 
 
@@ -114,11 +114,13 @@ def _sendRequest(self, endpoint: str, method: str, **kwargs) -> Optional[request
         if endpoint != "/login_check" and endpoint != "/upload/zip":
             QgsMessageLog.logMessage(f"Sending request to endpoint {endpoint} with kwargs: {kwargs}", TAG, level=Qgis.MessageLevel.Info)
         try:
-            response = self.session.request(method=method.upper(), url=url, headers= self.headers, **kwargs)
+            response = self.session.request(method=method.upper(), url=url, headers= self.headers, timeout=REQUEST_TIMEOUT_API, **kwargs)
             return response
-        except requests.HTTPError as http_err:
+        except requests.exceptions.HTTPError as http_err:
             QgsMessageLog.logMessage(str(http_err), TAG, level=Qgis.MessageLevel.Critical)
-        except requests.RequestException as req_err:
+        except requests.exceptions.Timeout as timeout_err:
+            QgsMessageLog.logMessage(str(timeout_err), TAG, level=Qgis.MessageLevel.Critical)
+        except requests.exceptions.RequestException as req_err:
             QgsMessageLog.logMessage(str(req_err), TAG, level=Qgis.MessageLevel.Critical)
         return None
 

dialogs/server_config_dialog.py

@@ -11,7 +11,7 @@
 from ..api_request import ApiRequest
 from ..helpers import show_success_box, list_qgs_settings_child_groups, show_fail_box, uri_validator, waitCursor
 from ..server_config import ServerConfig
-from ..settings import PLUGIN_SETTINGS_SERVER_CONFIG_KEY, TAG
+from ..settings import PLUGIN_SETTINGS_SERVER_CONFIG_KEY, TAG, REQUEST_TIMEOUT_SIMPLE
 
 # Dialog from .ui file
 WIDGET, BASE = uic.loadUiType(os.path.join(
@@ -227,7 +227,7 @@ def testHttpConn(self, url: str, serverName: str) -> Optional[str]:
         if not uri_validator(url):
             return errorStr
         try:
-            resp = requests.get(url)
+            resp = requests.get(url, timeout=REQUEST_TIMEOUT_SIMPLE)
             if serverName != "Mapbender":
                 if resp.status_code != 200:
                     content_type = resp.headers.get('Content-Type', '')
@@ -236,7 +236,7 @@ def testHttpConn(self, url: str, serverName: str) -> Optional[str]:
             else:
                 if resp.status_code != 200:
                     return errorStr
-        except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError) as error:
+        except (requests.exceptions.MissingSchema, requests.exceptions.ConnectionError, requests.exceptions.Timeout) as error:
             QgsMessageLog.logMessage(f"Connection error: {error}", TAG, level=Qgis.MessageLevel.Critical)
             return f"{errorStr}"
 

main_dialog.py

@@ -9,7 +9,6 @@
 
 from qgis.core import Qgis, QgsSettings, QgsMessageLog
 
-
 from .api_request import ApiRequest
 from .qgis_server_api_upload import QgisServerApiUpload
 from .mapbender_api_upload import MapbenderApiUpload

settings.py

@@ -2,4 +2,8 @@
 
 # General
 PLUGIN_SETTINGS_SERVER_CONFIG_KEY = 'QGIS2Mapbender'
-TAG = 'QGIS2Mapbender'
+TAG = 'QGIS2Mapbender'
+
+# Timeout settings for HTTP requests
+REQUEST_TIMEOUT_SIMPLE = 30
+REQUEST_TIMEOUT_API = (10, 300)