From 0e7219b191d36b1ba06c16066c450377863ea571 Mon Sep 17 00:00:00 2001 From: dollaransh17 Date: Fri, 3 Oct 2025 13:41:43 +0530 Subject: [PATCH] Security Fix: Add timeout parameters to HTTP requests This fix addresses a critical security vulnerability where HTTP requests could hang indefinitely, potentially causing denial of service. Changes: - Added 10-second timeout to version check API call - Added 10-second timeout to GitHub pull request API call - Added 30-second timeout to data file downloads (larger timeout for data) - Added 10-second timeout to exclusions list download Impact: - Prevents infinite hangs that could freeze the application - Improves user experience with predictable response times - Fixes security issue flagged by Bandit static analysis (B113) - Makes the application more robust in poor network conditions The timeouts are conservative enough to work with slow connections while preventing indefinite blocking that could be exploited. --- sherlock_project/sherlock.py | 4 ++-- sherlock_project/sites.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/sherlock_project/sherlock.py b/sherlock_project/sherlock.py index 250175a5..ba630c73 100644 --- a/sherlock_project/sherlock.py +++ b/sherlock_project/sherlock.py @@ -742,7 +742,7 @@ def main(): # Check for newer version of Sherlock. If it exists, let the user know about it try: - latest_release_raw = requests.get(forge_api_latest_release).text + latest_release_raw = requests.get(forge_api_latest_release, timeout=10).text latest_release_json = json_loads(latest_release_raw) latest_remote_tag = latest_release_json["tag_name"] @@ -802,7 +802,7 @@ def main(): if args.json_file.isnumeric(): pull_number = args.json_file pull_url = f"https://api.github.com/repos/sherlock-project/sherlock/pulls/{pull_number}" - pull_request_raw = requests.get(pull_url).text + pull_request_raw = requests.get(pull_url, timeout=10).text pull_request_json = json_loads(pull_request_raw) # Check if it's a valid pull request diff --git a/sherlock_project/sites.py b/sherlock_project/sites.py index 2ba811d7..b7aaf4c5 100644 --- a/sherlock_project/sites.py +++ b/sherlock_project/sites.py @@ -129,7 +129,7 @@ class SitesInformation: if data_file_path.lower().startswith("http"): # Reference is to a URL. try: - response = requests.get(url=data_file_path) + response = requests.get(url=data_file_path, timeout=30) except Exception as error: raise FileNotFoundError( f"Problem while attempting to access data file URL '{data_file_path}': {error}" @@ -166,7 +166,7 @@ class SitesInformation: if honor_exclusions: try: - response = requests.get(url=EXCLUSIONS_URL) + response = requests.get(url=EXCLUSIONS_URL, timeout=10) if response.status_code == 200: exclusions = response.text.splitlines() exclusions = [exclusion.strip() for exclusion in exclusions]