feat(rules): detect httpx for S113

[mkniewallner]

Summary

Bandit now also reports B113 on httpx (PyCQA/bandit#1060). This PR implements the same logic, to detect missing or None timeouts for httpx alongside requests.

Test Plan

Snapshot tests.

[charliermarsh]

Thanks -- this looks good to me!

[jyggen]

Not sure a missing timeout is a problem since httpx uses 5s as default. The rule is about preventing the client from waiting indefinitely, which it never will in the case of httpx and a missing timeout. Setting timeout to None is still problematic though.

[trim21]

httpx has default timeout， this PR would be a false positive

https://www.python-httpx.org/advanced/timeouts/

HTTPX is careful to enforce timeouts everywhere by default.

The default behavior is to raise a TimeoutException after 5 seconds of network inactivity.

B113: Test for missing requests timeout
This plugin test checks for requests or httpx calls without a timeout specified.

Nearly all production code should use this parameter in nearly all requests, Failure to do so can cause your program to hang indefinitely.

[mkniewallner]

Not sure a missing timeout is a problem since httpx uses 5s as default. The rule is about preventing the client from waiting indefinitely, which it never will in the case of httpx and a missing timeout. Setting timeout to None is still problematic though.

Indeed, really sorry for missing that obvious information, I should have better checked that.

[trim21]

false positive fix #12213