Skip to content

poplib — no timeout

Synchronous Access of POP3 without Timeout

The poplib.POP3 and poplib.POP3_SSL classes are used to connect to mail servers using the Post Office Protocol version 3 (POP3) for retrieving emails. By default, these classes do not enforce a timeout on the network connection, which means that an application could block indefinitely if the mail server becomes unresponsive or there is a network failure. This can result in resource exhaustion, Denial of Service (DoS), or unresponsive behavior in the application.

This rule ensures that a timeout parameter is provided when creating instances of poplib.POP3 or poplib.POP3_SSL to prevent the risk of indefinite blocking during network communication.

Failing to specify a timeout in these classes may cause the application to block indefinitely while waiting for a response from the mail server. This can lead to Denial of Service (DoS) vulnerabilities or cause the application to become unresponsive.

Example

poplib_pop3_no_timeout.py
1
2
3
4
5
6
import poplib
import ssl


pop = poplib.POP3("mail.my-mail-server.com")
pop.stls(ssl.create_default_context())
Example Output 
> precli tests/unit/rules/python/stdlib/poplib/examples/poplib_pop3_no_timeout.py
⚠️  Warning on line 10 in tests/unit/rules/python/stdlib/poplib/examples/poplib_pop3_no_timeout.py
PY043: Synchronous Access of Remote Resource without Timeout
The class 'poplib.POP3' is used without a timeout, which may cause the application to block indefinitely if the remote server does not respond.

Remediation

Always provide a timeout parameter when using poplib.POP3 or poplib.POP3_SSL. This ensures that if the mail server is unreachable or unresponsive, the connection attempt will fail after a set period, preventing indefinite blocking and resource exhaustion.

Alternatively, the global default timeout can be set via socket.setdefaulttimeout(). This is a good option to enforce a consistent timeout for any network library that uses sockets, including poplib.

poplib_pop3_no_timeout.py
1
2
3
4
5
6
import poplib
import ssl


pop = poplib.POP3("mail.my-mail-server.com", timeout=5)
pop.stls(ssl.create_default_context())

Default Configuration

enabled = true
level = "warning"

See also

Info

New in version 0.6.7