securesauce / precli

Precaution CLI - command line static application security testing tool
https://precli.readthedocs.io/
Other
22 stars 3 forks source link

New rule to check for network clients without a timeout #519

Closed ericwb closed 1 month ago

ericwb commented 3 months ago

Is your feature request related to a problem? Please describe. Python has a default timeout, but it's value defaults to the operating system, which may be long. Even worse if the client is setting the timeout to 0 to indicate wait forever. This effectively can deadlock code.

Describe the solution you'd like Check all client calls with a timeout value.

Describe alternatives you've considered n/a

Additional context https://docs.python.org/3/library/socket.html#socket.create_connection https://cwe.mitre.org/data/definitions/1088.html

Love this idea? Give it a 👍. We prioritize fulfilling features with the most 👍.