From 7374f6e19163c9032938398136733010192792a7 Mon Sep 17 00:00:00 2001 From: ltsyk Date: Thu, 30 Jul 2026 08:34:08 +0800 Subject: [PATCH] fix: reject unexpected kwargs on untimed Serializer.loads Untimed loads rejects max_age etc (issue #429) --- src/itsdangerous/serializer.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/itsdangerous/serializer.py b/src/itsdangerous/serializer.py index 5ed949c..ca42c56 100644 --- a/src/itsdangerous/serializer.py +++ b/src/itsdangerous/serializer.py @@ -330,7 +330,17 @@ def loads( ) -> t.Any: """Reverse of :meth:`dumps`. Raises :exc:`.BadSignature` if the signature validation fails. + + Unexpected keyword arguments are rejected so callers cannot + accidentally pass timed-serializer options such as ``max_age`` + to an untimed serializer (issue #429). """ + if kwargs: + unexpected = ", ".join(sorted(kwargs)) + raise TypeError( + f"{type(self).__name__}.loads() got unexpected keyword " + f"argument(s): {unexpected}" + ) s = want_bytes(s) last_exception = None