Replace security-critical assert statements with explicit exceptions#3149
Replace security-critical assert statements with explicit exceptions#3149ChihweiLHBird wants to merge 3 commits into
Conversation
Signed-off-by: Zhiwei Liang <zhiwei.liang@zliang.me>
75886b1 to
bf466fe
Compare
There was a problem hiding this comment.
Pull request overview
This PR replaces security-sensitive assert checks (which are stripped under Python -O) with explicit exceptions to ensure misconfiguration and invalid state are still enforced in production.
Changes:
- Replace an
assertonPROXIES_COUNTwith aValueErrorinparse_xforwarded - Replace an
asserton duplicate blueprint registration with aValueErrorinSanic.blueprint
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| sanic/headers.py | Converts proxy-count validation from assert to an explicit exception in forwarded-header parsing. |
| sanic/app.py | Converts duplicate-blueprint detection from assert to an explicit exception during blueprint registration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Zhiwei Liang <zhiwei.liang@zliang.me>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3149 +/- ##
=============================================
- Coverage 87.793% 87.710% -0.083%
=============================================
Files 105 105
Lines 8143 8145 +2
Branches 1290 1292 +2
=============================================
- Hits 7149 7144 -5
- Misses 687 693 +6
- Partials 307 308 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Signed-off-by: Zhiwei Liang <zhiwei.liang@zliang.me>
assertwithValueErrorinheaders.pyfor proxy count validation andapp.pyfor duplicate blueprint detectionassertstatements are stripped when Python runs with-O, silently disabling these checks in production