diff --git a/CHANGES.rst b/CHANGES.rst index 17c1a19..982db5f 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -5,6 +5,8 @@ Unreleased - Drop support for Python 3.8 and 3.9. - Remove previously deprecated code. +- Make ``URLSafeSerializer.loads`` reject unexpected timed-load arguments + instead of silently ignoring them. :issue:`429` Version 2.2.0 diff --git a/src/itsdangerous/url_safe.py b/src/itsdangerous/url_safe.py index 56a0793..1117eba 100644 --- a/src/itsdangerous/url_safe.py +++ b/src/itsdangerous/url_safe.py @@ -75,6 +75,17 @@ class URLSafeSerializer(URLSafeSerializerMixin, Serializer[str]): alphabet as well as ``'_'``, ``'-'`` and ``'.'``. """ + def loads( # type: ignore[override] + self, s: str | bytes, salt: str | bytes | None = None + ) -> t.Any: + """Reverse of :meth:`dumps` without timed-load arguments. + + Keep the signature explicit so arguments intended for + :class:`URLSafeTimedSerializer`, such as ``max_age``, fail instead of + being silently ignored. + """ + return super().loads(s, salt) + class URLSafeTimedSerializer(URLSafeSerializerMixin, TimedSerializer[str]): """Works like :class:`.TimedSerializer` but dumps and loads into a diff --git a/tests/test_itsdangerous/test_url_safe.py b/tests/test_itsdangerous/test_url_safe.py index 37e4812..77236de 100644 --- a/tests/test_itsdangerous/test_url_safe.py +++ b/tests/test_itsdangerous/test_url_safe.py @@ -22,3 +22,11 @@ class TestURLSafeTimedSerializer(TestURLSafeSerializer, TestTimedSerializer): @pytest.fixture() def serializer_factory(self): return partial(URLSafeTimedSerializer, secret_key="secret-key") + + +def test_url_safe_serializer_rejects_timed_arguments(): + serializer = URLSafeSerializer("secret-key") + signed = serializer.dumps("value") + + with pytest.raises(TypeError, match="max_age"): + serializer.loads(signed, max_age=60)