Skip to content

fix: validate mutually-exclusive body options under python -O - #3238

Closed
Suraj-Self (suraj-self) wants to merge 2 commits into
microsoft:mainfrom
suraj-self:fix-43281
Closed

Suraj-Self (suraj-self) wants to merge 2 commits into
microsoft:mainfrom
suraj-self:fix-43281

Conversation

@suraj-self

Copy link
Copy Markdown
Contributor

Fixes #43281

Summary

Replaces the assert-based mutual-exclusion guard in
APIRequestContext._inner_fetch() with an explicit conditional that raises
Error. assert statements are stripped under python -O, which previously
allowed conflicting data / form / multipart arguments to bypass
validation silently.

Also switches the check to presence semantics (is not None) so that empty
values such as data="" are counted as provided, consistent with how the
value is used later in the method.

Tests

  • Updated the existing test_should_reject_empty_data_with_form (sync + async)
    to expect Error instead of AssertionError.
  • Added test_should_reject_multiple_body_options_under_python_optimization
    (sync + async), which spawns a child interpreter with -O and verifies the
    guard still raises. Confirmed the new test fails on unpatched main and
    passes with the fix.

@pavelfeldman

Copy link
Copy Markdown
Member

Not sure why assert error is gone, also we don't need a test for such a minor use case.

@suraj-self

Copy link
Copy Markdown
Contributor Author

Not sure why assert error is gone, also we don't need a test for such a minor use case.

Thanks for reviewing. The explicit guard is needed because assert statements are removed under python -O. I changed the exception to Playwright's Error to match API validation conventions, but I agree that preserving AssertionError keeps this fix narrower. I'll simplify the change and remove the additional optimization-specific tests.

@pavelfeldman

Copy link
Copy Markdown
Member

We might need a larger change that addressees all the user-facing asserts.

@suraj-self

Copy link
Copy Markdown
Contributor Author

We might need a larger change that addressees all the user-facing asserts.

Agreed. This issue exposed one case where user-facing validation is disabled under python -O. A broader audit of user-facing asserts makes sense, and I'd be happy to help work on that as well.

@pavelfeldman

Copy link
Copy Markdown
Member

I'll close this one since it is just a one-off

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Request-body validation is bypassed under python -O, silently ignoring form

2 participants