[ADD] missing-timeout: Used when a method call an external request

Calling external request needs to use timeout in order to avoid waiting for a long time

You can even reproduce the case using deelay.me

e.g.

```python
import requests
response = requests.get("https://deelay.me/5000/http://localhost:80")  # It will spend 5s

response = requests.get("https://deelay.me/5000/http://localhost:80", timeout=2)  # timeout

response = requests.get("https://deelay.me/1000/http://localhost:80", timeout=2)  # fine

```

After 2s if the request doesn't have response it raises the following exception
requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='deelay.me', port=443): Read timed out. (read timeout=2)

But if it responses <=1s it is fine

Now you can test the same but using a bigger delay

You can define your custom methods using the configuration parameter: --timeout-methods

The default methods are:
    - http.client.HTTPConnection
    - http.client.HTTPSConnection
    - requests.delete
    - requests.get
    - requests.head
    - requests.options
    - requests.patch
    - requests.post
    - requests.put
    - requests.request
    - serial.Serial
    - smtplib.SMTP
    - suds.client.Client

Author: moylop260

CONTRIBUTORS.txt

@@ -88,6 +88,7 @@ contributors:
   * Add consider-merging-isinstance, superfluous-else-return
   * Fix consider-using-ternary for 'True and True and True or True' case
   * Add bad-docstring-quotes and docstring-first-line-empty
+  * Add missing-timeout
 - Ville Skyttä <[email protected]>
 - Pierre-Yves David <[email protected]>
 - David Shea <[email protected]>: invalid sequence and slice index

doc/whatsnew/2/2.14/full.rst

@@ -5,6 +5,7 @@ What's New in Pylint 2.14.0?
 ----------------------------
 Release date: TBA
 
+* Added new checker ``missing-timeout``.
 
 * The refactoring checker now also raises 'consider-using-generator' messages for
   ``max()``, ``min()`` and ``sum()``.

doc/whatsnew/2/2.14/summary.rst

@@ -7,7 +7,7 @@ Summary -- Release highlights
 With 2.14 ``pylint`` only supports Python version 3.7.2 and above.
 
 We introduced several new checks among which ``duplicate-value`` for sets,
-``comparison-of-constants``, and checks related to lambdas. We removed ``no-init`` and
+``comparison-of-constants``, ``missing-timeout`` and checks related to lambdas. We removed ``no-init`` and
 made ``no-self-use`` optional as they were too opinionated. We also added an option
 to generate a toml configuration: ``--generate-toml-config``.
 
@@ -30,6 +30,8 @@ to contribute to ``pylint`` or open source without any experience with our code!
 New checkers
 ============
 
+* Added new checker ``missing-timeout``.
+
 * Added new checker ``comparison-of-constants``.
 
   Closes #6076

pylint/checkers/variables.py

@@ -463,6 +463,12 @@ def _has_locals_call_after_node(stmt, scope):
         "Used when there is an unbalanced tuple unpacking in assignment",
         {"old_names": [("E0632", "old-unbalanced-tuple-unpacking")]},
     ),
+    "W0635": (
+        "Missing timeout for method %s",
+        "missing-timeout",
+        'Used when a method needs a "timeout" parameter '
+        "in order to avoid waiting for a long time.",
+    ),
     "E0633": (
         "Attempting to unpack a non-sequence%s",
         "unpacking-non-sequence",
@@ -1051,6 +1057,31 @@ class VariablesChecker(BaseChecker):
                 "help": "List of names allowed to shadow builtins",
             },
         ),
+        (
+            "timeout-methods",
+            {
+                "default": (
+                    "http.client.HTTPConnection",
+                    "http.client.HTTPSConnection",
+                    "requests.delete",
+                    "requests.get",
+                    "requests.head",
+                    "requests.options",
+                    "requests.patch",
+                    "requests.post",
+                    "requests.put",
+                    "requests.request",
+                    "serial.Serial",
+                    "smtplib.SMTP",
+                    "suds.client.Client",
+                    "urllib.request.urlopen",
+                ),
+                "type": "csv",
+                "metavar": "<comma separated list>",
+                "help": "List of library.method which require a timeout parameter "
+                "e.g. 'requests.get,requests.post'",
+            },
+        ),
     )
 
     def __init__(self, linter=None):
@@ -1080,6 +1111,7 @@ def visit_module(self, node: nodes.Module) -> None:
         """Visit module : update consumption analysis variable
         checks globals doesn't overrides builtins.
         """
+        self._imports: dict = {}
         self._to_consume = [NamesConsumer(node, "module")]
         self._postponed_evaluation_enabled = is_postponed_evaluation_enabled(node)
 
@@ -1098,9 +1130,11 @@ def visit_module(self, node: nodes.Module) -> None:
         "invalid-all-format",
         "unused-variable",
         "undefined-variable",
+        "missing-timeout",
     )
     def leave_module(self, node: nodes.Module) -> None:
         """Leave module: check globals."""
+        self._imports = {}
         assert len(self._to_consume) == 1
 
         self._check_metaclasses(node)
@@ -1163,6 +1197,43 @@ def leave_setcomp(self, _: nodes.SetComp) -> None:
         # do not check for not used locals here
         self._to_consume.pop()
 
+    @utils.only_required_for_messages(
+        "missing-timeout",
+    )
+    def visit_call(self, node: nodes.Call) -> None:
+        """Check if the call needs timeout parameter based on package.func_name
+        configured in config.timeout_methods.
+
+        Package uses the self._imports dict variable
+        in order to know the original package name imported
+        """
+        lib_name = ""
+        if isinstance(node.func, nodes.Attribute) and isinstance(
+            node.func.expr, nodes.Name
+        ):
+            lib_alias = node.func.expr.name
+            # Use dict "self._imports" to know the source library of the method
+            lib_name = self._imports.get(lib_alias) or lib_alias
+        func_name = (
+            isinstance(node.func, astroid.Name)
+            and node.func.name
+            or isinstance(node.func, astroid.Attribute)
+            and node.func.attrname
+        )
+        lib_func_name = (
+            # If it using "requests.request()"
+            f"{lib_name}.{func_name}"
+            if lib_name
+            # If it using "from requests import request;request()"
+            else self._imports.get(func_name)
+        )
+        if lib_func_name in self.config.timeout_methods:
+            for keyword in node.keywords:
+                if keyword.arg == "timeout":
+                    break
+            else:
+                self.add_message("missing-timeout", node=node, args=(lib_func_name,))
+
     def visit_functiondef(self, node: nodes.FunctionDef) -> None:
         """Visit function: update consumption analysis variable and check locals."""
         self._to_consume.append(NamesConsumer(node, "function"))
@@ -1665,9 +1736,14 @@ def _check_consumer(
 
         return (VariableVisitConsumerAction.RETURN, found_nodes)
 
-    @utils.only_required_for_messages("no-name-in-module")
+    @utils.only_required_for_messages("no-name-in-module", "missing-timeout")
     def visit_import(self, node: nodes.Import) -> None:
-        """Check modules attribute accesses."""
+        """Check modules attribute accesses and
+        fill "self._imports" dict variable with {alias: package} to be used in.
+
+        "visit_call" method to check if it needs timeout parameter.
+        """
+        self._imports.update({alias or name: f"{name}" for name, alias in node.names})
         if not self._analyse_fallback_blocks and utils.is_from_fallback_block(node):
             # No need to verify this, since ImportError is already
             # handled by the client code.
@@ -1687,9 +1763,16 @@ def visit_import(self, node: nodes.Import) -> None:
                 continue
             self._check_module_attrs(node, module, parts[1:])
 
-    @utils.only_required_for_messages("no-name-in-module")
+    @utils.only_required_for_messages("no-name-in-module", "missing-timeout")
     def visit_importfrom(self, node: nodes.ImportFrom) -> None:
-        """Check modules attribute accesses."""
+        """Check modules attribute accesses and
+        fill "self._imports" dict variable with {alias: package} to be used in.
+
+        "visit_call" method to check if it needs timeout parameter.
+        """
+        self._imports.update(
+            {alias or name: f"{node.modname}.{name}" for name, alias in node.names}
+        )
         if not self._analyse_fallback_blocks and utils.is_from_fallback_block(node):
             # No need to verify this, since ImportError is already
             # handled by the client code.

tests/functional/m/missing/missing_timeout.py

@@ -0,0 +1,154 @@
+# pylint: disable=consider-using-with,import-error,missing-module-docstring,reimported
+import http.client
+import smtplib
+import smtplib as smtplib_r
+import urllib
+from http.client import (
+    HTTPConnection,
+    HTTPConnection as HTTPConnection_r,
+    HTTPSConnection,
+    HTTPSConnection as HTTPSConnection_r,
+)
+from smtplib import SMTP, SMTP as SMTP_r
+from urllib.request import urlopen, urlopen as urlopen_r
+
+import requests
+import serial
+import serial as serial_r
+import suds.client
+from requests import (
+    delete,
+    delete as delete_r,
+    get,
+    get as get_r,
+    head,
+    head as head_r,
+    options,
+    options as options_r,
+    patch,
+    patch as patch_r,
+    post,
+    post as post_r,
+    put,
+    put as put_r,
+    request,
+    request as request_r,
+)
+from serial import Serial, Serial as Serial_r
+from suds.client import Client, Client as Client_r
+
+# requests without timeout
+requests.delete("http://localhost")  # [missing-timeout]
+requests.get("http://localhost")  # [missing-timeout]
+requests.head("http://localhost")  # [missing-timeout]
+requests.options("http://localhost")  # [missing-timeout]
+requests.patch("http://localhost")  # [missing-timeout]
+requests.post("http://localhost")  # [missing-timeout]
+requests.put("http://localhost")  # [missing-timeout]
+requests.request("call", "http://localhost")  # [missing-timeout]
+
+delete_r("http://localhost")  # [missing-timeout]
+get_r("http://localhost")  # [missing-timeout]
+head_r("http://localhost")  # [missing-timeout]
+options_r("http://localhost")  # [missing-timeout]
+patch_r("http://localhost")  # [missing-timeout]
+post_r("http://localhost")  # [missing-timeout]
+put_r("http://localhost")  # [missing-timeout]
+request_r("call", "http://localhost")  # [missing-timeout]
+
+delete("http://localhost")  # [missing-timeout]
+get("http://localhost")  # [missing-timeout]
+head("http://localhost")  # [missing-timeout]
+options("http://localhost")  # [missing-timeout]
+patch("http://localhost")  # [missing-timeout]
+post("http://localhost")  # [missing-timeout]
+put("http://localhost")  # [missing-timeout]
+request("call", "http://localhost")  # [missing-timeout]
+
+# requests valid cases
+requests.delete("http://localhost", timeout=10)
+requests.get("http://localhost", timeout=10)
+requests.head("http://localhost", timeout=10)
+requests.options("http://localhost", timeout=10)
+requests.patch("http://localhost", timeout=10)
+requests.post("http://localhost", timeout=10)
+requests.put("http://localhost", timeout=10)
+requests.request("call", "http://localhost", timeout=10)
+
+delete_r("http://localhost", timeout=10)
+get_r("http://localhost", timeout=10)
+head_r("http://localhost", timeout=10)
+options_r("http://localhost", timeout=10)
+patch_r("http://localhost", timeout=10)
+post_r("http://localhost", timeout=10)
+put_r("http://localhost", timeout=10)
+request_r("call", "http://localhost", timeout=10)
+
+delete("http://localhost", timeout=10)
+get("http://localhost", timeout=10)
+head("http://localhost", timeout=10)
+options("http://localhost", timeout=10)
+patch("http://localhost", timeout=10)
+post("http://localhost", timeout=10)
+put("http://localhost", timeout=10)
+request("call", "http://localhost", timeout=10)
+
+# urllib without timeout
+urllib.request.urlopen("http://localhost")  # [missing-timeout]
+urlopen("http://localhost")  # [missing-timeout]
+urlopen_r("http://localhost")  # [missing-timeout]
+
+# urllib valid cases
+urllib.request.urlopen("http://localhost", timeout=10)
+urlopen("http://localhost", timeout=10)
+urlopen_r("http://localhost", timeout=10)
+
+# suds without timeout
+suds.client.Client("http://localhost")  # [missing-timeout]
+Client("http://localhost")  # [missing-timeout]
+Client_r("http://localhost")  # [missing-timeout]
+
+# suds valid cases
+suds.client.Client("http://localhost", timeout=10)
+Client("http://localhost", timeout=10)
+Client_r("http://localhost", timeout=10)
+
+# http.client without timeout
+http.client.HTTPConnection("http://localhost")  # [missing-timeout]
+http.client.HTTPSConnection("http://localhost")  # [missing-timeout]
+HTTPConnection("http://localhost")  # [missing-timeout]
+HTTPSConnection("http://localhost")  # [missing-timeout]
+HTTPConnection_r("http://localhost")  # [missing-timeout]
+HTTPSConnection_r("http://localhost")  # [missing-timeout]
+
+# http.client valid cases
+http.client.HTTPConnection("http://localhost", timeout=10)
+http.client.HTTPSConnection("http://localhost", timeout=10)
+HTTPConnection("http://localhost", timeout=10)
+HTTPSConnection("http://localhost", timeout=10)
+HTTPConnection_r("http://localhost", timeout=10)
+HTTPSConnection_r("http://localhost", timeout=10)
+
+# smtplib without timeout
+smtplib.SMTP("http://localhost")  # [missing-timeout]
+smtplib_r.SMTP("http://localhost")  # [missing-timeout]
+SMTP("http://localhost")  # [missing-timeout]
+SMTP_r("http://localhost")  # [missing-timeout]
+
+# smtplib valid cases
+smtplib.SMTP("http://localhost", timeout=10)
+smtplib_r.SMTP("http://localhost", timeout=10)
+SMTP("http://localhost", timeout=10)
+SMTP_r("http://localhost", timeout=10)
+
+# Serial without timeout
+serial.Serial("/dev/ttyS1")  # [missing-timeout]
+serial_r.Serial("/dev/ttyS1")  # [missing-timeout]
+Serial("/dev/ttyS1")  # [missing-timeout]
+Serial_r("/dev/ttyS1")  # [missing-timeout]
+
+# serial valid cases
+serial.Serial("/dev/ttyS1", timeout=10)
+serial_r.Serial("/dev/ttyS1", timeout=10)
+Serial("/dev/ttyS1", timeout=10)
+Serial_r("/dev/ttyS1", timeout=10)

tests/functional/m/missing/missing_timeout.txt

@@ -0,0 +1,44 @@
+missing-timeout:41:0:41:35::Missing timeout for method requests.delete:UNDEFINED
+missing-timeout:42:0:42:32::Missing timeout for method requests.get:UNDEFINED
+missing-timeout:43:0:43:33::Missing timeout for method requests.head:UNDEFINED
+missing-timeout:44:0:44:36::Missing timeout for method requests.options:UNDEFINED
+missing-timeout:45:0:45:34::Missing timeout for method requests.patch:UNDEFINED
+missing-timeout:46:0:46:33::Missing timeout for method requests.post:UNDEFINED
+missing-timeout:47:0:47:32::Missing timeout for method requests.put:UNDEFINED
+missing-timeout:48:0:48:44::Missing timeout for method requests.request:UNDEFINED
+missing-timeout:50:0:50:28::Missing timeout for method requests.delete:UNDEFINED
+missing-timeout:51:0:51:25::Missing timeout for method requests.get:UNDEFINED
+missing-timeout:52:0:52:26::Missing timeout for method requests.head:UNDEFINED
+missing-timeout:53:0:53:29::Missing timeout for method requests.options:UNDEFINED
+missing-timeout:54:0:54:27::Missing timeout for method requests.patch:UNDEFINED
+missing-timeout:55:0:55:26::Missing timeout for method requests.post:UNDEFINED
+missing-timeout:56:0:56:25::Missing timeout for method requests.put:UNDEFINED
+missing-timeout:57:0:57:37::Missing timeout for method requests.request:UNDEFINED
+missing-timeout:59:0:59:26::Missing timeout for method requests.delete:UNDEFINED
+missing-timeout:60:0:60:23::Missing timeout for method requests.get:UNDEFINED
+missing-timeout:61:0:61:24::Missing timeout for method requests.head:UNDEFINED
+missing-timeout:62:0:62:27::Missing timeout for method requests.options:UNDEFINED
+missing-timeout:63:0:63:25::Missing timeout for method requests.patch:UNDEFINED
+missing-timeout:64:0:64:24::Missing timeout for method requests.post:UNDEFINED
+missing-timeout:65:0:65:23::Missing timeout for method requests.put:UNDEFINED
+missing-timeout:66:0:66:35::Missing timeout for method requests.request:UNDEFINED
+missing-timeout:97:0:97:42::Missing timeout for method urllib.request.urlopen:UNDEFINED
+missing-timeout:98:0:98:27::Missing timeout for method urllib.request.urlopen:UNDEFINED
+missing-timeout:99:0:99:29::Missing timeout for method urllib.request.urlopen:UNDEFINED
+missing-timeout:107:0:107:38::Missing timeout for method suds.client.Client:UNDEFINED
+missing-timeout:108:0:108:26::Missing timeout for method suds.client.Client:UNDEFINED
+missing-timeout:109:0:109:28::Missing timeout for method suds.client.Client:UNDEFINED
+missing-timeout:117:0:117:46::Missing timeout for method http.client.HTTPConnection:UNDEFINED
+missing-timeout:118:0:118:47::Missing timeout for method http.client.HTTPSConnection:UNDEFINED
+missing-timeout:119:0:119:34::Missing timeout for method http.client.HTTPConnection:UNDEFINED
+missing-timeout:120:0:120:35::Missing timeout for method http.client.HTTPSConnection:UNDEFINED
+missing-timeout:121:0:121:36::Missing timeout for method http.client.HTTPConnection:UNDEFINED
+missing-timeout:122:0:122:37::Missing timeout for method http.client.HTTPSConnection:UNDEFINED
+missing-timeout:133:0:133:32::Missing timeout for method smtplib.SMTP:UNDEFINED
+missing-timeout:134:0:134:34::Missing timeout for method smtplib.SMTP:UNDEFINED
+missing-timeout:135:0:135:24::Missing timeout for method smtplib.SMTP:UNDEFINED
+missing-timeout:136:0:136:26::Missing timeout for method smtplib.SMTP:UNDEFINED
+missing-timeout:145:0:145:27::Missing timeout for method serial.Serial:UNDEFINED
+missing-timeout:146:0:146:29::Missing timeout for method serial.Serial:UNDEFINED
+missing-timeout:147:0:147:20::Missing timeout for method serial.Serial:UNDEFINED
+missing-timeout:148:0:148:22::Missing timeout for method serial.Serial:UNDEFINED