Issues

• docs UI (Scalar/Swagger) loads CDN scripts without pinned version or SRI

  enhancement
  QueryaHub/OxyRoute#226 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• WebSocket routes have no Origin validation (CSWSH risk when auth relies on cookies)

  enhancement
  QueryaHub/OxyRoute#225 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• Bearer token prefix matched case-sensitively

  bug
  QueryaHub/OxyRoute#224 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• extract_cookie_value: one malformed cookie pair aborts the whole search via ?

  bug
  QueryaHub/OxyRoute#223 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• JSON error bodies built via format! without escaping (json/multipart error paths)

  bug
  QueryaHub/OxyRoute#222 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• SSE: event/id fields not sanitized against newlines, allows event injection

  bug
  QueryaHub/OxyRoute#221 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• perf: header_get_lax does up to 3 Python attribute/dict lookups per header read

  enhancement
  QueryaHub/OxyRoute#220 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• perf: request body copied twice (PyBytes -> PooledBuffer), pool churns even when body is empty

  enhancement
  QueryaHub/OxyRoute#219 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• perf: CORS/security-headers merge goes through Python on every request with Origin, disables sync short-circuit entirely

  enhancement
  QueryaHub/OxyRoute#218 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• perf: JSON dict/list handler returns go through slow AttributeError + json.dumps path

  enhancementP1
  QueryaHub/OxyRoute#217 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• _ProtocolWrapper (access_log_hook path) missing __call__/__aiter__, likely breaks body-reading routes under Granian

  bug
  QueryaHub/OxyRoute#216 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• AdaptiveConcurrencyLimiter self-throttles to min_limit over time (min_rtt never resets, mixes non-2xx latencies)

  bug
  QueryaHub/OxyRoute#215 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• DBQuery chunk_size does not bound memory despite docstring claim

  bug
  QueryaHub/OxyRoute#214 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• DBQuery result decoding: UUID/TIMESTAMP/NUMERIC silently mangled, .unwrap() can panic the tokio task

  bug
  QueryaHub/OxyRoute#213 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• path params auto-coerce to bool/int/float, breaking string-typed routes

  bugP1
  QueryaHub/OxyRoute#212 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• handler return of list/dict is misinterpreted (wrong content-type, wrong status)

  bugP1
  QueryaHub/OxyRoute#211 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• remove /test_db prototype endpoint from hot path (info leak + shadows user routes)

  bugP1
  QueryaHub/OxyRoute#210 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• set_middleware silently overwrites request middleware stack (breaks CORS+CSRF combo)

  bugP0
  QueryaHub/OxyRoute#209 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• rate limiter shard map grows unbounded / O(n) scan per request once full

  bugP0
  QueryaHub/OxyRoute#208 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• rate limiter trusts X-Forwarded-For / X-Real-IP unconditionally

  bugP0
  QueryaHub/OxyRoute#207 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• request body fully buffered before OXYROUTE_MAX_BODY_BYTES check

  bugP0
  QueryaHub/OxyRoute#206 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026

• deadlock: lock-order inversion between handle_rsgi GIL and AppState write lock

  bugP0
  QueryaHub/OxyRoute#205 · Filter by author ZhuchkaTriplesix opened on Sep 29, 2026