CodeVetter · Repo Unpack · Testing signals
pallets/werkzeug
Tests and CI were inspected, not executed; no passing result or coverage percentage is established. Pytest covers protocol utilities and adapters, with separate middleware and Sans-I/O test files plus subprocess-based live-server fixtures. The inspected assertions address parsing limits, routing trust, JSON failures, file transfer, security helpers, and redirect behavior. This inventory is bounded, and example persistence/concurrency behavior was not established by the inspected tests.
- Pytest discovers tests under tests/, treats warnings as errors, and declares a dev_server marker; tox's configured test command is pytest -v --tb=short with forwarded positional arguments.
- TestFormParser asserts early total-length rejection, multipart field-memory rejection, part-count rejection, and URL-encoded exemption from max_form_parts; a separate test checks memory limits across multiple decoder events.
- Routing tests reject disallowed WebSocket methods and verify Request.trusted_hosts during Map.bind_to_environ; ProxyFix tests exercise the resulting request root, route building, matching, and redirect location.
- JSON tests assert successful request/response decoding, 415 for an unsupported content type, silent and forced parsing behavior, 400 for malformed data, and body consumption when caching is disabled.
- File tests assert conditional 304 responses, cache-age behavior, ETag options, and traversal rejection; range tests assert 206 output, clamping, 416 failures, first-range-only behavior, and POST exemption.
- Security tests assert scrypt/PBKDF2 formats, salt variability, and unsafe-path rejection; Client tests reject external redirect following and redirect loops. These assertions exist but were not executed in this investigation.
- DevServerClient launches a subprocess and reserves ports; live-server tests include HTTP, TLS, reloading, and Unix sockets, with platform skips and a Windows-CI skip for a reloader test.
- Inspected CI config runs locked uv/tox tests across Python 3.11–3.15, free-threaded 3.14, PyPy, Windows, and macOS, plus mypy and pre-commit jobs; docs-only/README changes skip the tests workflow, and no execution or example Redis concurrency coverage is established here.