SShortSingh.
Back to feed

How to Lock Down Python URL Query-String Encoding Before It Breaks APIs

0
·25 views

Developers using Python's urllib.parse library risk subtle API failures when urlencode flags like doseq and quote_via are left at their defaults or scattered inconsistently across modules. Key behaviors such as doseq=False serializing lists as Python string literals, and quote_plus encoding spaces as plus signs rather than %20, can silently break server-side parsing depending on the API. A ripgrep-based audit is recommended to inventory all urlencode and related calls across a codebase before standardizing behavior. Probe instrumentation can be temporarily added to capture real wire-format output, which is then frozen into a pytest characterization suite to prevent regressions. The parse_qs helper also drops blank query values by default, meaning round-trip encoding tests must explicitly set keep_blank_values=True to avoid silent data loss.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

OpenAI's AI pipeline reports 948 distinct Linux kernel root vulnerabilities for $1.2M

In a mid-October run, an unreleased OpenAI cyber model generated 948 distinct local privilege escalation flaws in the Linux kernel, each with a path to root access. The total API cost was about $1.21 million, roughly $1,280 per vulnerability. The pipeline narrowed the kernel to code reachable by unprivileged users, then had agents validate flaws in virtual machines and attempt root exploits, with common protections like KASLR, SMEP, and SMAP enabled. The bugs are local rather than remote, so an attacker would still need an initial foothold, and the findings are counted as vulnerabilities rather than merged fixes. OpenAI says human engineers review exploits and patches before disclosure, starting with the most severe cases and sending reports to kernel maintainers gradually.

0
ProgrammingDEV Community ·

Detecting silent failures in AI agents with traces and evaluation events

AI agents can return a successful HTTP 200 with no exception and no error span, yet still give a wrong or incomplete answer, which keeps monitoring dashboards green. The article proposes tracing every agent step, separating technical errors from content errors, and attaching an evaluation result to each trace. It relies on OpenTelemetry GenAI conventions, including agent and tool-call spans and a gen_ai.evaluation.result event that records quality scores. Capturing tool arguments and results is opt-in because it may expose sensitive data, so it is recommended only on a masked sample. A broken evaluator is recorded as an error rather than treated as a correct answer.

0
ProgrammingHacker News ·

Merz Says Google Cloud Meets Sovereignty Standards for Intelligence Agencies

German Chancellor Friedrich Merz has stated that Google Cloud is sovereign enough to be used by intelligence agencies. The remark addresses the ongoing debate in Germany over how much control government bodies must retain over their digital infrastructure. It reflects a stance that a US-based cloud provider can meet the country's sovereignty requirements for sensitive security work. The source article, published by heise, provides further details on the context of the statement.

0
ProgrammingDEV Community ·

Freezing design tokens so AI agents can't edit shared styling scales

An agent asked to adjust spacing in a checkout header also changed a shared spacing token, which unintentionally affected other pages like settings. The author now freezes token and theme files by default for agent-driven UI work, allowing edits only to named component paths. Token changes require an explicit unlock, such as a human prompt or a separate pull request. When a design needs a new token, the agent is instructed to stop and propose the change in writing rather than editing the shared scale. The approach is paired with PR template checks, CI warnings, and review guidelines to keep token changes separate from feature work.