Describe the bug
B501 (request_with_no_cert_validation) and B113 (request_without_timeout) both match httpx.request(...), but on the requests side they only match the seven verb helpers:
HTTP_VERBS = {"get", "options", "head", "post", "put", "patch", "delete"}
HTTPX_ATTRS = {"request", "stream", "Client", "AsyncClient"} | HTTP_VERBSrequests.request() is the documented generic form of requests.get() and friends, so it is skipped by both checks. For B501 that means a call which explicitly disables TLS certificate validation goes unreported by a HIGH severity check.
Reproduction
import httpx
import requests
httpx.request("GET", "https://example.com", verify=False) # line 4
httpx.request("GET", "https://example.com", timeout=None) # line 5
requests.request("GET", "https://example.com", verify=False) # line 7
requests.request("GET", "https://example.com", timeout=None) # line 8$ bandit probe.py -f custom --msg-template "{line}: {test_id} {msg}"
4: B501 Call to httpx with verify=False disabling SSL certificate checks, security issue.
5: B113 Call to httpx with timeout set to NoneLines 7 and 8 produce nothing. The requests calls are the ones that matter more here — requests has no default timeout, whereas httpx defaults to 5 seconds.
A second file showing the contrast against the verb helpers:
import requests
requests.request("GET", "https://example.com", verify=False) # line 4 - not reported
requests.request("GET", "https://example.com") # line 5 - not reported
requests.get("https://example.com", verify=False) # line 8 - B501 + B113
requests.get("https://example.com") # line 9 - B1139: B501 Call to requests with verify=False disabling SSL certificate checks, security issue.
9: B113 Call to requests without timeout
10: B113 Call to requests without timeout
Expected behavior
requests.request(...) should be treated like the verb helpers by both checks, as httpx.request(...) already is.
Note the httpx-only difference in B113 looks deliberate and should stay: httpx defaults to a 5 second timeout, so only an explicit timeout=None is a problem there, which is exactly what the plugin does today.
bandit version
main at 8f23766, Python 3.13 (also present in the released 1.9.x plugins).
Additional context
requests.request appears in neither examples/requests-ssl-verify-disabled.py nor examples/requests-missing-timeout.py, while httpx.request appears in the first — which is why the gap went unnoticed. I have a PR ready that matches request on the requests side and extends both example files so the functional tests cover it.
Describe the bug
B501 (
request_with_no_cert_validation) and B113 (request_without_timeout) both matchhttpx.request(...), but on therequestsside they only match the seven verb helpers:requests.request()is the documented generic form ofrequests.get()and friends, so it is skipped by both checks. For B501 that means a call which explicitly disables TLS certificate validation goes unreported by a HIGH severity check.Reproduction
Lines 7 and 8 produce nothing. The
requestscalls are the ones that matter more here —requestshas no default timeout, whereashttpxdefaults to 5 seconds.A second file showing the contrast against the verb helpers:
Expected behavior
requests.request(...)should be treated like the verb helpers by both checks, ashttpx.request(...)already is.Note the httpx-only difference in B113 looks deliberate and should stay:
httpxdefaults to a 5 second timeout, so only an explicittimeout=Noneis a problem there, which is exactly what the plugin does today.bandit version
mainat8f23766, Python 3.13 (also present in the released 1.9.x plugins).Additional context
requests.requestappears in neitherexamples/requests-ssl-verify-disabled.pynorexamples/requests-missing-timeout.py, whilehttpx.requestappears in the first — which is why the gap went unnoticed. I have a PR ready that matchesrequeston the requests side and extends both example files so the functional tests cover it.