AI junk

CHANGES.rst

@@ -5,6 +5,8 @@ Unreleased
 
 -   Drop support for Python 3.8 and 3.9.
 -   Remove previously deprecated code.
+-   Make ``URLSafeSerializer.loads`` reject unexpected timed-load arguments
+    instead of silently ignoring them. :issue:`429`
 
 
 Version 2.2.0

src/itsdangerous/url_safe.py

@@ -75,6 +75,17 @@ class URLSafeSerializer(URLSafeSerializerMixin, Serializer[str]):
     alphabet as well as ``'_'``, ``'-'`` and ``'.'``.
     """
 
+    def loads(  # type: ignore[override]
+        self, s: str | bytes, salt: str | bytes | None = None
+    ) -> t.Any:
+        """Reverse of :meth:`dumps` without timed-load arguments.
+
+        Keep the signature explicit so arguments intended for
+        :class:`URLSafeTimedSerializer`, such as ``max_age``, fail instead of
+        being silently ignored.
+        """
+        return super().loads(s, salt)
+
 
 class URLSafeTimedSerializer(URLSafeSerializerMixin, TimedSerializer[str]):
     """Works like :class:`.TimedSerializer` but dumps and loads into a

tests/test_itsdangerous/test_url_safe.py

@@ -22,3 +22,11 @@ class TestURLSafeTimedSerializer(TestURLSafeSerializer, TestTimedSerializer):
     @pytest.fixture()
     def serializer_factory(self):
         return partial(URLSafeTimedSerializer, secret_key="secret-key")
+
+
+def test_url_safe_serializer_rejects_timed_arguments():
+    serializer = URLSafeSerializer("secret-key")
+    signed = serializer.dumps("value")
+
+    with pytest.raises(TypeError, match="max_age"):
+        serializer.loads(signed, max_age=60)