mirror of
https://github.com/kennethreitz/responder.git
synced 2026-07-21 18:39:29 +00:00
kennethreitz
36abcb402e
Adversarial multi-agent review of the full diff surfaced real issues (several in my own additions); all fixed and regression-tested: - response_model: only validate dict/model bodies and only for actual Pydantic models — `response_model=list` (a documented marker) no longer 500s, and list bodies pass through untouched as in v4.0. - Open-redirect guard: normalize backslashes and leading control/whitespace before classifying, so `/\evil.com` & friends are blocked (browsers treat `\` as `/`). - Server sessions: reverted the dirty-tracking/deepcopy optimization — it broke sliding backend TTL (premature logout) and crashed on non-deepcopyable MemoryBackend values. Back to v4.0 always-write semantics. - Reverted the ServerErrorMiddleware-outermost reorder: it dropped X-Request-ID and mislogged status on 500s. Restored v4.0 ordering. - req.params: decode the scope query string as UTF-8 (not latin-1) so raw non-ASCII queries aren't mojibaked; keeps the no-urlparse speedup. - GraphQL max_depth: follow fragment spreads so depth can't be smuggled via chained fragments (cycles broken; operations measured as roots). - Type-hint body injection: gate to POST/PUT/PATCH/DELETE and skip params that declare a default, so GET and optional-model handlers keep working. Bumps version to 4.1.0 and finalizes the changelog. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>