Open takkaria opened 1 year ago
Looks like bento.dev
no longer resolves and the Wayback Machine points to semgrep.dev
...
Anyway, rules:
r2c-requests-no-auth-over-http
: Alerts when auth param is possibly used over http://, which could expose credentials.r2c-requests-use-scheme
: Alerts when URLs passed to requests API methods don't have a URL scheme (e.g., https://), otherwise an exception will be thrown.r2c-requests-use-timeout
: This check detects when a requests API method has been called without a timeout. requests will hang forever without a timeout; add a timeout to prevent this behavior.
S113
from flake8-bandit
I was about to suggest the same for flake8-timeout
, but stumbled across this. The added bonus with flake8-timeout
is that it also catches cases where no timeout is passed to urllib.request.open
as well.
It's really nice to have a linter catch when you don't provide a timeout to a request call (
r2c-requests-use-timeout
).Though I can't find it on GitHub, only on PyPi.