Repository navigation
Conversation
dict(parse_qsl(...)) collapses repeated keys, so a strict match accepted a
request body carrying data the params dict cannot represent (e.g. a body
"a=1&a=2" against {"a": "2"}). Fail the strict match when the parsed
pairs outnumber the collapsed dict, and add a regression test.
Author
|
All six workflow runs on this branch sit at |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
urlencoded_params_matcherparses the body withdict(parse_qsl(...)), which collapses repeated keys (last value wins). Under the defaultstrict_match=Truea body carrying a duplicate key then compares equal to a params dict that cannot represent it:So a strict matcher for
{"a": "2"}wrongly matches a body ofa=1&a=2(for exampledata=[("a", "1"), ("a", "2")]), even though it sent ana=1the spec never allowed. Same lossy-parse_qslfamily as #804;query_string_matcheravoids it by comparing the parsed pair lists rather than dicts.Fix: in the strict path, reject the body when the parsed pairs outnumber the collapsed dict. The non-strict path (meant to allow extra params) is untouched. Added
test_urlencoded_params_matcher_strict_repeated_keys(fails onmaster, passes here) and a CHANGES entry. Prepared with AI assistance under my direction; I reviewed and tested it myself.