fix(kernel): validate request timeout

Signed-off-by: Vu Anh Phung <vu.phung@databricks.com>

Author: vuanhphung

CONNECTION_PARAMETERS.md

@@ -99,7 +99,7 @@ to change without notice.
 
 | Option                               | Type        | Thrift | Kernel | Default Value | Note                                                                                                                                            |
 | ------------------------------------ | ----------- | :----: | :----: | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
-| `_socket_timeout`                    | `float` (s) |   ✅   |   ✅   | `900` (Thrift); `120` (kernel) | Thrift: socket send/recv/connect timeout. Kernel: total HTTP request deadline from connect through response-body completion. A positive value is forwarded; unset or `0` selects the kernel's 120s default. On the kernel path, `0` is neither unlimited nor an immediate timeout. |
+| `_socket_timeout`                    | `float` (s) |   ✅   |   ✅   | `900` (Thrift); `120` (kernel) | Thrift: socket send/recv/connect timeout. Kernel: total HTTP request deadline from connect through response-body completion. A positive value is forwarded; unset or `0` selects the kernel's 120s default. On the kernel path, `0` is neither unlimited nor immediate; negative and non-finite values raise `ValueError`. |
 | `_pool_connections`                  | `int`       |   ✅   |   ⚠️   | `10`          | Number of urllib3 connection pools. Configures the connector's shared Python HTTP client; the kernel's query transport is its own Rust stack.  |
 | `_pool_maxsize`                      | `int`       |   ✅   |   ⚠️   | `20`          | Max connections per pool on the shared Python HTTP client. Same kernel caveat as `_pool_connections`.                                          |
 | `_proxy_auth_method`                 | `str`       |   ✅   |   ⚠️   | `None`        | `basic` or `negotiate` (Kerberos). Applies to the shared Python HTTP client; not threaded to the kernel query transport. See [`docs/proxy.md`](docs/proxy.md). |

src/databricks/sql/backend/kernel/client.py

@@ -23,6 +23,7 @@
 from __future__ import annotations
 
 import logging
+import math
 import threading
 import uuid
 from typing import Any, Dict, List, Optional, Set, TYPE_CHECKING, Union
@@ -219,7 +220,23 @@ def __init__(
         self._retry_options = kwargs.get("retry_options") or {}
         # The connector's ``_socket_timeout`` is already expressed in
         # seconds, matching the kernel's request-timeout binding.
-        self._request_timeout_secs = kwargs.get("request_timeout_secs")
+        request_timeout_secs = kwargs.get("request_timeout_secs")
+        if request_timeout_secs is None:
+            self._request_timeout_secs = None
+        else:
+            try:
+                self._request_timeout_secs = float(request_timeout_secs)
+            except (TypeError, ValueError, OverflowError) as exc:
+                raise ValueError(
+                    "_socket_timeout must be a non-negative finite number of seconds"
+                ) from exc
+            if (
+                not math.isfinite(self._request_timeout_secs)
+                or self._request_timeout_secs < 0
+            ):
+                raise ValueError(
+                    "_socket_timeout must be a non-negative finite number of seconds"
+                )
         self._catalog = catalog
         self._schema = schema
         # ``_use_arrow_native_complex_types`` is the connector-side

src/databricks/sql/client.py

@@ -276,7 +276,8 @@ def read(self) -> Optional[OAuthToken]:
         #  On Thrift, the timeout in seconds for socket send, recv and connect
         #  operations. On the kernel path, a positive value is the total HTTP
         #  request deadline. Kernel values of None or 0 select its 120-second
-        #  default; 0 is neither unlimited nor an immediate timeout.
+        #  default; 0 is neither unlimited nor an immediate timeout. Negative
+        #  and non-finite values are rejected.
         # _disable_pandas
         #  In case the deserialisation through pandas causes any issues, it can be disabled with
         #  this flag.

tests/unit/test_kernel_client.py

@@ -371,6 +371,18 @@ def fake_session(**kw):
         assert captured["request_timeout_secs"] == timeout
 
 
+@pytest.mark.parametrize("timeout", [-1, float("nan"), float("inf")])
+def test_request_timeout_rejects_invalid_values(timeout):
+    with pytest.raises(ValueError, match="non-negative finite"):
+        kernel_client.KernelDatabricksClient(
+            server_hostname="example.cloud.databricks.com",
+            http_path="/sql/1.0/warehouses/abc",
+            auth_provider=AccessTokenAuthProvider("dapi-test"),
+            ssl_options=None,
+            request_timeout_secs=timeout,
+        )
+
+
 def test_execute_command_forwards_parameters_to_bind_param():
     """``execute_command(parameters=[...])`` routes each parameter
     through ``bind_tspark_params`` onto the kernel statement before