Bandit 1.7.5 false positive for request_without_timeout (B113)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
Bandit is incorrectly marking calls to requests library without a timeout while the code it's actually not calling directly the requests library and the timeout is already set elsewhere.
Reproduction steps
- Define this code:
from mylibrary import my_session
class Repro:
def __init__(self):
self.requests = my_session(timeout=5)
def get(self, uri):
return self.requests.get(uri)
-
Run bandit:
bandit -l -i -r --skip B404,B603 somepath/ -
Get an error:
>> Issue: [B113:request_without_timeout] Requests call without timeout
Severity: Medium Confidence: Low
CWE: CWE-400 (https://cwe.mitre.org/data/definitions/400.html)
More Info: https://bandit.readthedocs.io/en/1.7.5/plugins/b113_request_without_timeout.html
Location: repro.py:10:15
9 def get(self, uri):
10 return self.requests.get(uri)
11
Expected behavior
Bandit should not report any error because the session has a default timeout set via an HTTPAdapter in another library.
The code calls self.requests that could be any kind of object, does bandit do code inspection of the object to detect that is actually a requests session?
I don't think so as it triggered the issue also with my pseudo code that doesn't import the real library.
If it was indeed doing introspection, it should probably also check if there is a default timeout set in the session.
Bandit version
1.7.5 (Default)
Python version
3.9,3.10
Additional context
[note] The dropdown menu of the issues template here on Github has a Python 3.1 version and is missing 3.10, possibly a typo in the template.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Bandit's B113 request_without_timeout plugin and reproduce the report using the Python example and the documented bandit command. Read the plugin's existing behavior and tests, then determine the intended handling for calls on arbitrary session-like attributes. Done means the agreed behavior is covered by a regression test and the false-positive case is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100