pallets / werkzeug

The comprehensive WSGI web application library.
https://werkzeug.palletsprojects.com
BSD 3-Clause "New" or "Revised" License
6.66k stars 1.73k forks source link

restrict containers accepted by multi #2995

Closed davidism closed 2 weeks ago

davidism commented 2 weeks ago

When inlining the type annotations, I noticed that iter_multi_items and related methods were annotated to accept collections.abc.Iterable, but actually called isinstance(value, (list, tuple). I expanded this to isinstance(value, Container) and not isinstance(value, str). However, this incorrectly matched and iterated over bytes, bytearray, memoryview, array, etc, all of which should be treated as single values. Rather than trying to build up an allow list, I've gone back to restricting to (list, tuple, set), adding set since it was the one built-in collection type missing that would make sense to use.

fixes #2994