CodeVetter · Repo Unpack · Risk map
encode/starlette
These findings are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Material boundaries include optional body limits, client-readable signed sessions, filesystem serving, diagnostic output, and telemetry export. Middleware task boundaries and response-start state create compatibility-sensitive behavior. Existing tests cover several of these boundaries, but they were not executed during this inspection.
- Total request-body size is unlimited by default, Request.body buffers all chunks, and multipart max_part_size applies to non-file parts; spool_max_size is a disk-rollover threshold rather than a file-size cap. Nested limit responders replace the active limit rather than always choosing the minimum.
- Session payloads are base64 JSON protected by TimestampSigner, without encryption in this path; HttpOnly and SameSite=lax are defaults, while Secure requires https_only=True.
- Hypothesis: mutating a nested dictionary or list in request.session without assigning through Session can leave modified false and omit Set-Cookie, because tracking covers top-level dict operations rather than recursively wrapped values; the inspected tests do not settle this nested-mutation behavior. (inferred)
- StaticFiles rejects absolute paths and checks resolved containment by default, but follow_symlink=True uses lexical absolute paths; FileResponse separately accepts application-supplied filesystem paths without applying StaticFiles directory containment.
- debug=True sends exception tracebacks to clients, choosing HTML from the Accept header or plain text otherwise; ServerErrorMiddleware still re-raises after generating its response.
- Experimental OpenTelemetryMiddleware records query strings, client addresses, and user agents on spans and extracts incoming trace context; its API and emitted telemetry explicitly may change in minor releases without deprecation.
- BaseHTTPMiddleware introduces task-group and receive-cache boundaries; the suite explicitly marks backward context-variable propagation as xfail, and consumed streams are forwarded downstream as an empty body rather than replayed.
- BackgroundTasks stop on the first exception after response delivery, when exception handlers cannot replace started responses; the deprecated WSGI adapter also buffers the whole request and uses an unbounded memory stream, making these distinct compatibility and resource-review hotspots.