CodeVetter · Repo Unpack · Data flow
pallets/werkzeug
Incoming HTTP data becomes a WSGI environ before Request interprets it. Body access passes through stream limits, then form or JSON parsers whose results are owned by the request instance. Response turns application data and headers into a byte iterable and start_response call. File persistence, outbound proxy traffic, and Redis writes are explicit boundaries rather than implicit framework services.
- WSGIRequestHandler.make_environ decodes request paths, constructs CGI/WSGI fields, normalizes headers, ignores underscore-bearing header names, and wraps chunked input in DechunkedInput with wsgi.input_terminated.
- Request converts WSGI path strings and query bytes into Sans-I/O metadata; args uses parse_qsl with blank values preserved and invalid-byte quoting behavior.
- get_input_stream rejects a declared length above max_content_length and, for server-terminated input, applies a LimitedStream when a maximum is configured.
- FormDataParser dispatches by MIME type: multipart uses a required boundary and MultiPartParser, URL-encoded bodies are read and decoded in full, and unsupported types return empty form/file collections with the stream.
- MultipartDecoder events drive text accumulation or file-stream writes; completed file streams are rewound and wrapped in FileStorage, while default upload streams use SpooledTemporaryFile.
- get_data optionally caches raw body bytes; get_json consumes those bytes through json_module.loads and maintains separate silent/non-silent cache entries.
- Response.get_wsgi_response combines final headers and its body iterator; __call__ invokes start_response and returns that iterator, with normal iteration wrapped in ClosingIterator.
- Persistence destinations are caller-selected: FileStorage.save copies an upload into a supplied path or stream, while Shortly.insert_url writes Redis target/reverse mappings after allocating a counter-based identifier.