CodeVetter · Repo Unpack · Data flow
django/django
Configuration flows from the environment into LazySettings, then into the app registry, middleware list, URLConf, and connection handlers. An HTTP request becomes a request object, passes a middleware onion, resolves to a view, and returns an HttpResponse. ORM reads stay as Query objects until evaluation, then SQLCompiler sends SQL and params to a backend cursor. Writes go through Model.save_base and, for schema, through MigrationExecutor. Cross-cutting state (sessions, CSRF, signatures) is keyed by SECRET_KEY or server-side stores.
- WSGIHandler.__call__ sets the script prefix from the WSGI environ, sends request_started, builds a WSGIRequest (method, LimitedStream body capped at CONTENT_LENGTH, GET from QUERY_STRING, cookies from HTTP_COOKIE), then get_response. The iterable returned may be a wsgi.file_wrapper around response.file_to_stream.
- BaseHandler.load_middleware imports each settings.MIDDLEWARE path in reverse, instantiates it with the adapted next handler, and records process_view, process_template_response, and process_exception hooks. MiddlewareNotUsed skips an entry. get_response sets the thread URLConf to ROOT_URLCONF, runs the chain, and logs status >= 400.
- resolve_request uses request.urlconf if set, otherwise get_resolver(), then URLResolver.resolve(request.path_info). resolve walks url_patterns, merges kwargs, and returns a ResolverMatch. request_finished is connected to reset_urlconf.
- If the view returns an object with a callable render(), template-response middleware runs and then response.render() is called. A None or unawaited coroutine from a view raises ValueError. Async views on the sync path are wrapped with async_to_sync.
- QuerySet.filter clones via _chain and adds a Q object in _filter_or_exclude_inplace; it raises TypeError if the query is already sliced. Evaluation is deferred until _fetch_all, which lists self._iterable_class(self) and then runs prefetch_related if needed.
- SQLCompiler.execute_sql compiles with as_sql(), opens connection.cursor() or chunked_cursor(), and calls cursor.execute(sql, params). Result shape depends on MULTI, SINGLE, ROW_COUNT, or CURSOR. EmptyResultSet short-circuits.
- Model.save picks a database with router.db_for_write, optionally narrows update_fields for deferred instances, then save_base sends pre_save, writes inside transaction.atomic (if the model has parents) or mark_for_rollback_on_error, stores _state.db, clears _state.adding, and sends post_save with created=(not updated).
- MigrationExecutor.migrate ensures the django_migrations table unless the plan is empty, builds a plan, rejects mixed forward and backward plans with InvalidMigrationPlan, and applies forward migrations in full_plan order via apply_migration.
- CSRF: CsrfViewMiddleware reads the secret from the session (CSRF_USE_SESSIONS, key requires SessionMiddleware first) or from cookie CSRF_COOKIE_NAME (default csrftoken). Unsafe methods must present csrfmiddlewaretoken in POST or the header named by CSRF_HEADER_NAME (default HTTP_X_CSRFTOKEN). Failures go to CSRF_FAILURE_VIEW.
- HttpRequest.get_host validates the raw host against ALLOWED_HOSTS via validate_host. If DEBUG is true and ALLOWED_HOSTS is empty, the allow-list becomes .localhost, 127.0.0.1, and [::1]. Otherwise it raises DisallowedHost. is_secure consults SECURE_PROXY_SSL_HEADER before the scheme.
- Signed cookies: HttpRequest.get_signed_cookie calls signing._unsign_cookie and re-raises BadSignature unless a default is supplied. SIGNING_BACKEND defaults to django.core.signing.TimestampSigner. The signing module documents HMAC/SHA-256 over URL-safe base64 JSON using the project secret.
- Upload bounds in global settings: DATA_UPLOAD_MAX_MEMORY_SIZE and FILE_UPLOAD_MAX_MEMORY_SIZE are 2621440 bytes, DATA_UPLOAD_MAX_NUMBER_FIELDS is 1000, and DATA_UPLOAD_MAX_NUMBER_FILES is 100. WSGIRequest wraps wsgi.input in LimitedStream so reads cannot pass CONTENT_LENGTH.
- ImmediateBackend.enqueue does not hand work to another process: _execute_task sets status RUNNING, calls task.call (async_to_sync if needed), JSON-normalizes the return value, and sets SUCCESSFUL or FAILED with a traceback stored on TaskResult.errors.
- Settings reference order is explicit user module then global defaults. When MAILERS is defined, deprecated EMAIL_* names are rejected if also set, and getattr of those names is blocked. Database routers are an ordered list in DATABASE_ROUTERS, empty by default.