Skip to content

Fix: responses/__init__.py's _on_request() (~line 1099) mutated the SAME... - #813

Open
M001N wants to merge 1 commit into
getsentry:masterfrom
M001N:oss-engine/67aa0374-f2e63353
Open

Fix: responses/__init__.py's _on_request() (~line 1099) mutated the SAME...#813
M001N wants to merge 1 commit into
getsentry:masterfrom
M001N:oss-engine/67aa0374-f2e63353

Conversation

@M001N

@M001N M001N commented Aug 16, 2026

Copy link
Copy Markdown

Summary

In _on_request(), params/req_kwargs are still set on request before calling _find_match() (needed because matchers.py's query_param_matcher/request_kwargs_matcher read them during matching). Immediately after matching completes, a shallow copy (call_request = copy.copy(request)) is taken to carry those attributes for the internal call log, and del request.params / del request.req_kwargs strips them from the live request object before it can flow onward to the caller (via response.request or a raised exception's .request). All Call(...)/self._calls.add(...) construction sites in _on_request were switched to use call_request instead of request, so responses.calls[i].request.params/.req_kwargs keep working exactly as documented. Updated README.rst's query-params example and two existing tests (test_matchers.py::test_request_matches_params and test_responses.py's assert_params helper used by test_request_param*) that had been asserting .params on the live resp.request object, to instead read it from responses.calls[...].request, since that behavior was the actual bug.

Problem

getsentry/responses issue reference: #738

Root Cause

responses/init.py's _on_request() (~line 1099) mutated the SAME live PreparedRequest instance that requests threads back to the caller (via response.request / exception.request) by doing request.params = ... and request.req_kwargs = kwargs directly on it. Since that mutation happened before matching and was never undone, these responses-internal attributes stayed attached to the request object visible to caller code (e.g. in a raised exception's .request), leaking mock-only internals into what should look like a plain, real PreparedRequest.

Testing

PASS - full suite: 231 passed, 0 failed (18 pre-existing unrelated deprecation warnings).

Related Issue

#738

@M001N
M001N requested a review from markstory as a code owner August 16, 2026 21:50
Comment thread README.rst
constructed_url = r"http://example.com/test?I+am=a+big+test&hello=world"
assert resp.url == constructed_url
assert resp.request.url == constructed_url
assert resp.request.params == params

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could break userland code. But I don't see how we fix the reported issue without removing this attribute.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants