pyupio / safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.
https://safetycli.com/product/safety-cli
MIT License
1.66k stars 141 forks source link

ResourceWarning (unclosed socket) in safety v.2.3.1 #422

Closed Peterl777 closed 1 year ago

Peterl777 commented 1 year ago

Description

When I run safety check, the program runs normally. At the end of the run, Python emits the error: sys:1: ResourceWarning: unclosed <ssl.SSLSocket fd=704, family=23, type=1, proto=0, laddr=('2001:8003:2c1c:8a0<snip>', 54722, 0, 0), > raddr=('2600:9000:<snip>', 443, 0, 0)>

IMPORTANT NOTE: I have all Python warnings turned on. These are not turned on by default.(I have some experience with Python warnings).

C:\Users\PeterL777> echo %PYTHONWARNINGS%
a

What I Did

C:\Users\PeterL777> safety check
+========================================================================================================+

                               /$$$$$$            /$$
                              /$$__  $$          | $$
           /$$$$$$$  /$$$$$$ | $$  \__//$$$$$$  /$$$$$$   /$$   /$$
          /$$_____/ |____  $$| $$$$   /$$__  $$|_  $$_/  | $$  | $$
         |  $$$$$$   /$$$$$$$| $$_/  | $$$$$$$$  | $$    | $$  | $$
          \____  $$ /$$__  $$| $$    | $$_____/  | $$ /$$| $$  | $$
          /$$$$$$$/|  $$$$$$$| $$    |  $$$$$$$  |  $$$$/|  $$$$$$$
         |_______/  \_______/|__/     \_______/   \___/   \____  $$
                                                          /$$  | $$
                                                         |  $$$$$$/
  by pyup.io                                              \______/

+========================================================================================================+

 REPORT

  You are using Safety's free vulnerability database. This data is outdated, limited, and
  licensed for non-commercial use only.
  All commercial projects must sign up and get an API key at https://pyup.io

  Safety v2.3.1 is scanning for Vulnerabilities...
  Scanning dependencies in your environment:

  -> c:\users\peter\appdata\local\programs\python\python311\lib\site-packages

  Using non-commercial database
  Found and scanned 44 packages
  Timestamp 2022-11-09 16:18:34
  0 vulnerabilities found
  0 vulnerabilities ignored
+========================================================================================================+

 No known security vulnerabilities found.

+========================================================================================================+

  You are using Safety's free vulnerability database. This data is outdated, limited, and
  licensed for non-commercial use only.
  All commercial projects must sign up and get an API key at https://pyup.io

+========================================================================================================+
sys:1: ResourceWarning: unclosed <ssl.SSLSocket fd=704, family=23, type=1, proto=0, laddr=('2001:8003:2c1c:8a00:ed17:<snip>', 54722, 0, 0), raddr=('2600:9000:209a:5200:10:<snip>', 443, 0, 0)>

I haven't checked the code, but looks like there's an unclosed socket there. Coming from Requests? Session object not closed?

Peterl777 commented 1 year ago

Thanks @yeisonvargasf !