CodeVetter · Repo Unpack · Risk map
encode/httpx
The following are source observations and one explicitly labeled resource-risk hypothesis, not confirmed vulnerabilities. Sensitive boundaries include outbound routing, certificate trust, credentials, redirects, stream ownership, and filesystem downloads. Several restrictions are intentional compatibility or API limits with corresponding tests. Documentation drift and excluded branches also matter when an agent assesses behavior.
- Verbose CLI tracing prints raw request headers, including reversible Basic Authorization; help text warns about this and test_auth asserts the exposed header. Headers.__repr__ masking therefore does not imply CLI output redaction.
- trust_env defaults true; environment/system proxy discovery can alter routing, and SSL_CERT_FILE/SSL_CERT_DIR can replace default certificate locations. Custom transports disable automatic environment-proxy discovery, while explicit proxy configuration remains supported.
- verify=False explicitly disables hostname checking and certificate verification. NetRCAuth loads a caller-selected or default netrc file at construction, and deprecated cert arguments load certificate chains from external paths.
- Redirect authorization policy depends on scheme, host and effective port; Authorization survives only same-origin redirects or the defined same-host HTTP:80-to-HTTPS:443 upgrade exception. Redirect requests also discard the original Cookie header and rebuild cookies from the jar.
- Manual stream=True callers must arrange response closure, and generator request bodies can raise StreamConsumed when redirected or retried for Digest authentication; inspected tests encode both replay restrictions.
- Resource-risk hypothesis: large or highly compressed responses can demand substantial memory because read()/aread() join decoded bodies, ASGITransport collects response parts, and its stream joins them. Connection Limits do not impose a body-size bound in these inspected paths. (inferred)
- Digest authentication retains challenge and nonce-counter state and deliberately rejects auth-int-only challenges with NotImplementedError; a test expects that failure, so auth-int must not be described as supported.
- The WSGITransport docstring still recommends Client(app=app), but the inspected Client constructor accepts transport and has no app argument. This concrete documentation drift makes constructor source a necessary check before copying examples.