bottlepy / bottle

bottle.py is a fast and simple micro-framework for python web-applications.
http://bottlepy.org/
MIT License
8.33k stars 1.46k forks source link

Setting custom request attributes requires name validation #1359

Closed valq7711 closed 2 years ago

valq7711 commented 2 years ago

https://github.com/bottlepy/bottle/blob/71bb933649ba009cd537c2e973519d6e024c02a2/bottle.py#L1594-L1599

What about request.body = 'blah'? By the idea it should raise an error, since body is read-only property, but it doesn't, it just creates environ['bottle.request.ext.body']. Note that request.body will still return 'real body' (BytesIO), not 'blah'

This issue affects all request attributes/properties.