Skip to content

BaseRequest.text() and .post(): map invalid body bytes to HTTP 415#13100

Draft
HrachShah wants to merge 1 commit into
aio-libs:masterfrom
HrachShah:fix/13099-text-unicodedecode-as-415
Draft

BaseRequest.text() and .post(): map invalid body bytes to HTTP 415#13100
HrachShah wants to merge 1 commit into
aio-libs:masterfrom
HrachShah:fix/13099-text-unicodedecode-as-415

Conversation

@HrachShah

Copy link
Copy Markdown

Fixes #13099.

BaseRequest.text() and the application/x-www-form-urlencoded branch of BaseRequest.post() catch LookupError from bytes.decode(charset) and re-raise it as HTTPUnsupportedMediaType (HTTP 415). The intent is to surface any decode problem as a 415 so the user gets a clear status code instead of an unhandled UnicodeDecodeError in their handler.

But the catch only covers LookupError, which is what an unknown codec raises (LookupError: unknown encoding: ...). It misses the more common case: the charset name is known (utf-8, latin-1, etc.) but the body is not valid in that encoding. bytes.decode() raises UnicodeDecodeError for that, which is a subclass of ValueError, so it propagates out of text() / post() and crashes the handler with a traceback that the user has no way to handle cleanly.

Fix: extend the except clause to also catch UnicodeDecodeError, so an invalid byte sequence in the body maps to the same HTTP 415 a missing codec does. The body is still consumed and the existing _read_bytes cache is populated, so subsequent req.read() / req.json() calls don't re-decode.

Tests in tests/test_web_request.py:

  • test_request_text_raises_415_for_invalid_utf8_bytesreq.text() with body b'\xff' and Content-Type: text/plain; charset=utf-8 now raises HTTPUnsupportedMediaType (pre-fix: leaks UnicodeDecodeError).
  • test_request_post_urlencoded_raises_415_for_invalid_utf8_bytesreq.post() with body b'a=1&b=\xff' and Content-Type: application/x-www-form-urlencoded now raises HTTPUnsupportedMediaType (pre-fix: leaks UnicodeDecodeError).

Both tests fail on the pre-fix code with the original UnicodeDecodeError and pass with the fix applied.

$ PYTHONPATH='.' python3 -m pytest tests/test_web_request.py -k 'invalid_utf8 or wrong_content_type' -v
============================== 3 passed in 0.09s ==============================

Full tests/test_web_request.py run: 135 passed.

CHANGES fragment at CHANGES/13099.bugfix.rst.

The except clause around the bytes.decode() call in BaseRequest.text()
and the application/x-www-form-urlencoded branch of BaseRequest.post()
only catches LookupError, so an invalid-bytes UnicodeDecodeError
leaks out of the helper and into the user's request handler.

Mirror the existing 415 contract for unknown charset names: a body
that cannot be decoded with the declared (or default) charset is
'unsupported media type' from aiohttp's perspective. The test pair
covers the default-charset path and the explicit-charset path; both
fail on the pre-fix code with UnicodeDecodeError and pass with the
fix.
@psf-chronographer psf-chronographer Bot added the bot:chronographer:provided There is a change note present in this PR label Jul 8, 2026
@codecov

codecov Bot commented Jul 8, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.97%. Comparing base (9e00085) to head (953471e).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #13100   +/-   ##
=======================================
  Coverage   98.97%   98.97%           
=======================================
  Files         131      131           
  Lines       48635    48652   +17     
  Branches     2525     2525           
=======================================
+ Hits        48135    48154   +19     
+ Misses        376      374    -2     
  Partials      124      124           
Flag Coverage Δ
Autobahn 22.12% <10.52%> (-0.01%) ⬇️
CI-GHA 98.92% <100.00%> (+<0.01%) ⬆️
OS-Linux 98.68% <100.00%> (+<0.01%) ⬆️
OS-Windows 97.08% <100.00%> (+<0.01%) ⬆️
OS-macOS 97.97% <100.00%> (+<0.01%) ⬆️
Py-3.10 98.16% <100.00%> (+<0.01%) ⬆️
Py-3.11 98.43% <100.00%> (+<0.01%) ⬆️
Py-3.12 98.52% <100.00%> (+<0.01%) ⬆️
Py-3.13 98.49% <100.00%> (+0.01%) ⬆️
Py-3.14 98.51% <100.00%> (+<0.01%) ⬆️
Py-3.14t 97.61% <100.00%> (+<0.01%) ⬆️
Py-pypy-3.11 97.47% <100.00%> (-0.01%) ⬇️
VM-macos 97.97% <100.00%> (+<0.01%) ⬆️
VM-ubuntu 98.68% <100.00%> (+<0.01%) ⬆️
VM-windows 97.08% <100.00%> (+<0.01%) ⬆️
cython-coverage 37.91% <0.00%> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

@codspeed-hq

codspeed-hq Bot commented Jul 8, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 83 untouched benchmarks
⏩ 83 skipped benchmarks1


Comparing HrachShah:fix/13099-text-unicodedecode-as-415 (953471e) with master (9e00085)

Open in CodSpeed

Footnotes

  1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bot:chronographer:provided There is a change note present in this PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BaseRequest.text() leaks UnicodeDecodeError for bodies that fail to decode with the declared charset

1 participant