Skip to content

fix: raise Error instead of assert for user input validation - #3245

Open
Pavel Feldman (pavelfeldman) wants to merge 1 commit into
mainfrom
fix-playwright-43281
Open

Pavel Feldman (pavelfeldman) wants to merge 1 commit into
mainfrom
fix-playwright-43281

Conversation

@pavelfeldman

Copy link
Copy Markdown
Member

Several checks on user input used assert, so python -O stripped them. For example, request.post(url, data="", form={...}) then sent the request and dropped form without telling the caller. Without -O, these checks raised AssertionError, which isn't a Playwright Error.

This turns every user-facing assert in _impl into raise Error(...) and keeps the messages. That covers:

  • APIRequestContext.fetch: the first argument must be a URL or a Request; only one of data / form / multipart; non-negative max_redirects / max_retries; form file payloads must have a bytes buffer.
  • Serializing an evaluate argument: only str regex patterns are supported.
  • Regex flags: only MULTILINE / IGNORECASE / DOTALL are supported.
  • to_have_text / to_contain_text with a list: the expected value must be a list or tuple.

The asserts that check internal invariants (channel state, transport, _soft_scope nesting) are unchanged.

Tests: the existing tests for these messages now expect Error. They fail on main because it raises AssertionError, and they pass with this change, both normally and under python -O. The neighbouring fetch, evaluate, assertions and interception suites pass, async and sync.

Fixes: microsoft/playwright#43281

@pavelfeldman
Pavel Feldman (pavelfeldman) marked this pull request as ready for review October 12, 2026 21:59

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Request-body validation is bypassed under python -O, silently ignoring form

2 participants