Skip to content

Reject - #433

Closed
daleselaji-dev wants to merge 2 commits into
pallets:mainfrom
daleselaji-dev:codex/reject-unsupported-max-age
Closed

Reject #433
daleselaji-dev wants to merge 2 commits into
pallets:mainfrom
daleselaji-dev:codex/reject-unsupported-max-age

Conversation

@daleselaji-dev

Copy link
Copy Markdown

Fixes #429

Serializer.loads currently accepts and ignores arbitrary keyword arguments. This lets URLSafeSerializer silently accept max_age, which only applies to URLSafeTimedSerializer and can hide an incorrect token-expiration configuration. Remove the unused kwargs parameter so unsupported arguments raise TypeError at runtime and are rejected by type checkers. TimedSerializer keeps its explicit max_age API.

Tests: PYTHONPATH=src python -m pytest tests/test_itsdangerous/test_serializer.py tests/test_itsdangerous/test_timed.py -q (145 passed); PYTHONPATH=src python -m ruff check src/itsdangerous/serializer.py tests/test_itsdangerous/test_serializer.py; python -m compileall -q src/itsdangerous/serializer.py tests/test_itsdangerous/test_serializer.py.

@davidism

davidism commented Aug 5, 2026

Copy link
Copy Markdown
Member

@davidism davidism closed this Aug 5, 2026
@davidism davidism changed the title Reject unsupported serializer load arguments AI junk Aug 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

URLSafeSerializer.loads silently ignores unexpected max_age argument

2 participants