Security context

Highlights

Denial of Service: 14 prior fixes. Scrutinize any change in this area.

bottle.py: most-fixed (34 issues). Treat as high-risk during review.

15 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Arbitrary Code Execution: The framework historically utilized python's native `pickle` deserialization to decode signed secure cookies. If an attacker can forge or bypass the signature verification, this leads directly to remote code execution. developers must completely avoid pickle-based payloads for cookie storage.

Path Traversal: File serving features (`static_file`, `send_file`) and template engines have repeatedly failed to normalize paths properly across platforms. On Windows environments, differences in path separators, trailing slashes, or empty roots allowed directory traversal outside the intended directory root. Consistently use absolute canonical paths and prefix-based containment validation.

Denial of Service: The custom multipart parser, parameter parsing (`parse_qsl`), and template engine are historically vulnerable to resource exhaustion. Key vectors include unconstrained request body sizes, unrestricted URL parameter parsing (HashDoS), and catastrophic backtracking (ReDoS) in complex nested regex patterns. Strict length constraints and optimized regex patterns are mandatory guards.