S113 - Rule Doesn't Take httpx Default Timeout into Account

[fullerzz]

The S113 rule has the following description:

Checks for uses of the Python requests or httpx module that omit the timeout parameter.

This rule fails to take into account that httpx enforces a default timeout of 5.0 seconds globally.

Omitting the timeout parameter in httpx's top-level API calls still results in a 5 second timeout. Likewise, the same applies to both httpx.Client and httpx.AsyncClient.

httpx Docs Used for Reference

https://www.python-httpx.org/advanced/timeouts/

HTTPX is careful to enforce timeouts everywhere by default.
The default behavior is to raise a TimeoutException after 5 seconds of network inactivity.

client = httpx.Client()  # 5s timeout by default
httpx.get('http://example.com/api/v1/example')  # 5s timeout by default

Timeouts can be explicitely disabled as so:

# Using the top-level API:
httpx.get('http://example.com/api/v1/example', timeout=None)

# Using a client instance:
with httpx.Client() as client:
    client.get("http://example.com/api/v1/example", timeout=None)

Suggestion

Maybe S113 can check for timeout=None in the case of httpx. Or I can just disable S113 if this rule is working as intended.

[charliermarsh]

I think it makes sense to respect the default and only flag explicit timeout=None, at least based on the above.

[evanrittenhouse]

Feel free to assign this to me, I have a local PR (mostly) working

[charliermarsh]

Thanks!

[trim21]

#12213

[trim21]

#12213 is merged, maybe we can close this?