The no-magic web API and microservices framework for Python developers, with a focus on reliability and performance at scale.
This report summarizes scanner evidence for falconry/falcon, a Python project with 9,807 GitHub stars. SynthScan examined 66,637 lines of code across 309 source files, recording 1518 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 29.1 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 797 finding(s).
Are imports declared and package/API names verified? 490 finding(s).
Are wrappers, guards, and repeated structures necessary? 837 finding(s).
Which changes need focused human review? 1518 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1518 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/add_contributors.py | 104 | def _update_towncrier_template(template, contributors): | CODE |
| LOW | tests/test_media_multipart.py | 208 | def test_invalid_text_or_charset(charset, data): | CODE |
| LOW | tests/test_media_multipart.py | 252 | def test_from_buffered_stream(): | CODE |
| LOW | tests/test_media_multipart.py | 285 | def test_body_part_properties(): | CODE |
| LOW | tests/test_media_multipart.py | 303 | def test_empty_or_missing_filename(): | CODE |
| LOW | tests/test_media_multipart.py | 528 | def test_unexpected_form_structure(client): | CODE |
| LOW | tests/test_media_multipart.py | 642 | def test_nested_multipart_mixed(): | CODE |
| LOW | tests/test_media_multipart.py | 692 | def test_content_transfer_encoding_header(client): | CODE |
| LOW | tests/test_media_multipart.py | 800 | def test_max_secure_filename_length(custom_client, max_length, expected): | CODE |
| LOW | tests/test_media_multipart.py | 857 | def test_deserialize_part_media(client): | CODE |
| LOW | tests/test_media_multipart.py | 883 | def test_deserialize_custom_media(custom_client): | CODE |
| LOW | tests/test_media_multipart.py | 924 | def test_multipart_parse_options_default_handlers_unique(): | CODE |
| LOW | tests/test_httperror.py | 368 | def test_client_does_not_accept_json_or_xml(self, client): | CODE |
| LOW | tests/test_httperror.py | 385 | def test_custom_error_serializer(self, client, yaml): | CODE |
| LOW | tests/test_httperror.py | 438 | def test_custom_error_serializer_optional_representation( | CODE |
| LOW | tests/test_httperror.py | 467 | def test_custom_serializer_no_representation(self, client): | CODE |
| LOW | tests/test_httperror.py | 477 | def test_client_does_not_accept_anything(self, client): | CODE |
| LOW | tests/test_httperror.py | 951 | def test_title_default_message_if_none(self, status, status_type, client): | CODE |
| LOW | tests/test_httperror.py | 973 | def test_serialize_error_uses_media_handler(self, client): | CODE |
| LOW | tests/test_httperror.py | 982 | def test_serialize_no_json_media_handler(self, client): | CODE |
| LOW | tests/test_httperror.py | 1070 | def test_serializes_error_to_preferred_by_sender( | CODE |
| LOW | tests/test_httperror.py | 1092 | def test_json_async_only_error(self, util): | CODE |
| LOW | tests/test_custom_router.py | 7 | def test_custom_router_add_route_should_be_used(asgi, util): | CODE |
| LOW | tests/test_custom_router.py | 24 | def test_custom_router_find_should_be_used(asgi, util): | CODE |
| LOW | tests/test_custom_router.py | 76 | def test_can_pass_additional_params_to_add_route(asgi, util): | CODE |
| LOW | tests/test_custom_router.py | 101 | def test_custom_router_takes_req_positional_argument(asgi, util): | CODE |
| LOW | tests/test_custom_router.py | 124 | def test_custom_router_takes_req_keyword_argument(asgi, util): | CODE |
| LOW⚡ | tests/test_utils.py | 289 | def test_uri_encode_value_double(self, value, expected): | CODE |
| LOW⚡ | tests/test_utils.py | 295 | def test_uri_encode_double_hexchars(self): | CODE |
| LOW⚡ | tests/test_utils.py | 303 | def test_uri_encode_value_double_hexchars(self): | CODE |
| LOW⚡ | tests/test_utils.py | 402 | def test_prop_uri_encode_models_stdlib_quote(self): | CODE |
| LOW⚡ | tests/test_utils.py | 409 | def test_prop_uri_encode_value_models_stdlib_quote_safe_tilde(self): | CODE |
| LOW⚡ | tests/test_utils.py | 416 | def test_prop_uri_decode_models_stdlib_unquote_plus(self): | CODE |
| LOW⚡ | tests/test_utils.py | 613 | def test_http_status_to_code_neg(self, v): | CODE |
| LOW⚡ | tests/test_utils.py | 617 | def test_etag_dumps_to_header_format(self): | CODE |
| LOW⚡ | tests/test_utils.py | 627 | def test_etag_strong_vs_weak_comparison(self): | CODE |
| LOW⚡ | tests/test_utils.py | 780 | def test_path_escape_chars_in_create_environ(self): | CODE |
| LOW⚡ | tests/test_utils.py | 784 | def test_no_prefix_allowed_for_query_strings_in_create_environ(self): | CODE |
| LOW⚡ | tests/test_utils.py | 788 | def test_plus_in_path_in_create_environ(self): | CODE |
| LOW⚡ | tests/test_utils.py | 792 | def test_none_header_value_in_create_environ(self): | CODE |
| LOW⚡ | tests/test_utils.py | 801 | def test_httpnow_alias_for_backwards_compat(self): | CODE |
| LOW⚡ | tests/test_utils.py | 870 | def test_repr_result_when_body_varies(self, asgi, util, value, simulate): | CODE |
| LOW⚡ | tests/test_utils.py | 929 | def test_rich_repr_result_when_body_varies(self, asgi, util, value, simulate): | CODE |
| LOW⚡ | tests/test_utils.py | 1033 | def test_wsgi_iterable_not_closeable(self): | CODE |
| LOW⚡ | tests/test_utils.py | 1038 | def test_path_must_start_with_slash(self, app): | CODE |
| LOW⚡ | tests/test_utils.py | 1044 | def test_cached_text_in_result(self, app): | CODE |
| LOW | tests/test_utils.py | 111 | def test_deprecated_decorator(self): | CODE |
| LOW | tests/test_utils.py | 176 | def test_pack_query_params_none(self): | CODE |
| LOW | tests/test_utils.py | 179 | def test_pack_query_params_one(self): | CODE |
| LOW | tests/test_utils.py | 199 | def test_pack_query_params_several(self): | CODE |
| LOW | tests/test_utils.py | 231 | def test_to_query_str_encoding(self, params, csv): | CODE |
| LOW | tests/test_utils.py | 351 | def test_uri_decode_bad_coding(self, encoded, expected, decode_approach): | CODE |
| LOW | tests/test_utils.py | 362 | def test_uri_decode_bad_unicode(self, encoded, expected, decode_approach): | CODE |
| LOW | tests/test_utils.py | 374 | def test_uri_decode_unquote_plus(self, decode_approach): | CODE |
| LOW | tests/test_utils.py | 509 | def test_parse_query_string_edge_cases(self, query_string, keep_blank, expected): | CODE |
| LOW | tests/test_utils.py | 588 | def test_code_to_http_status_value_error(self, v): | CODE |
| LOW | tests/test_utils.py | 686 | def test_secure_filename_empty_value(self): | CODE |
| LOW | tests/test_utils.py | 690 | def test_secure_filename_invalid_max_length(self): | CODE |
| LOW | tests/test_utils.py | 705 | def test_secure_filename_windows_reserved_names( | CODE |
| LOW | tests/test_utils.py | 725 | def test_simulate_request_protocol(asgi, protocol, method, util): | CODE |
| 528 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tox.ini | 90 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tox.ini | 92 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tox.ini | 97 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tox.ini | 99 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tox.ini | 347 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tox.ini | 349 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tox.ini | 359 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tox.ini | 361 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 3 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 13 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 37 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 39 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 52 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 54 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 111 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 113 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 144 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 146 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 211 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 213 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 235 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 237 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 254 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 256 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 278 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 280 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 307 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 309 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 322 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 324 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 375 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 377 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 412 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 418 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 452 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tox.ini | 454 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cookies.py | 351 | # ===================================================================== | COMMENT |
| MEDIUM⚡ | tests/test_cookies.py | 353 | # ===================================================================== | COMMENT |
| MEDIUM | tests/test_cookies.py | 110 | # ===================================================================== | COMMENT |
| MEDIUM | tests/test_cookies.py | 112 | # ===================================================================== | COMMENT |
| MEDIUM | tests/test_after_hooks.py | 14 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_after_hooks.py | 16 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_after_hooks.py | 34 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_after_hooks.py | 36 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_after_hooks.py | 108 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_after_hooks.py | 110 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_after_hooks.py | 228 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_after_hooks.py | 230 | # -------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 207 | # ======================================================= | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 209 | # ======================================================= | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 215 | # ======================================================= | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 217 | # ======================================================= | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 223 | # ======================================================= | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 225 | # ======================================================= | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 232 | # ======================================================= | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 234 | # ======================================================= | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 1083 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_request_attrs.py | 1085 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_request_attrs.py | 249 | # ======================================================= | COMMENT |
| MEDIUM | tests/test_request_attrs.py | 251 | # ======================================================= | COMMENT |
| 79 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/conftest.py | 20 | CODE | |
| LOW | tests/test_typing.py | 1 | CODE | |
| LOW | tests/test_validators.py | 1 | CODE | |
| LOW | e2e-tests/server/hub.py | 1 | CODE | |
| LOW | falcon/hooks.py | 17 | CODE | |
| LOW | falcon/hooks.py | 45 | CODE | |
| LOW | falcon/hooks.py | 48 | CODE | |
| LOW | falcon/_typing.py | 16 | CODE | |
| LOW | falcon/_typing.py | 51 | CODE | |
| LOW | falcon/_typing.py | 52 | CODE | |
| LOW | falcon/_typing.py | 53 | CODE | |
| LOW | falcon/http_error.py | 16 | CODE | |
| LOW | falcon/request_helpers.py | 17 | CODE | |
| LOW | falcon/asgi_spec.py | 17 | CODE | |
| LOW | falcon/request.py | 15 | CODE | |
| LOW | falcon/__init__.py | 334 | CODE | |
| LOW | falcon/__init__.py | 335 | CODE | |
| LOW | falcon/__init__.py | 336 | CODE | |
| LOW | falcon/__init__.py | 337 | CODE | |
| LOW | falcon/__init__.py | 338 | CODE | |
| LOW | falcon/__init__.py | 339 | CODE | |
| LOW | falcon/__init__.py | 340 | CODE | |
| LOW | falcon/__init__.py | 341 | CODE | |
| LOW | falcon/__init__.py | 342 | CODE | |
| LOW | falcon/__init__.py | 343 | CODE | |
| LOW | falcon/__init__.py | 344 | CODE | |
| LOW | falcon/__init__.py | 345 | CODE | |
| LOW | falcon/__init__.py | 346 | CODE | |
| LOW | falcon/__init__.py | 347 | CODE | |
| LOW | falcon/__init__.py | 348 | CODE | |
| LOW | falcon/__init__.py | 349 | CODE | |
| LOW | falcon/__init__.py | 350 | CODE | |
| LOW | falcon/__init__.py | 351 | CODE | |
| LOW | falcon/__init__.py | 352 | CODE | |
| LOW | falcon/__init__.py | 353 | CODE | |
| LOW | falcon/__init__.py | 354 | CODE | |
| LOW | falcon/__init__.py | 355 | CODE | |
| LOW | falcon/__init__.py | 356 | CODE | |
| LOW | falcon/__init__.py | 357 | CODE | |
| LOW | falcon/__init__.py | 358 | CODE | |
| LOW | falcon/__init__.py | 359 | CODE | |
| LOW | falcon/__init__.py | 360 | CODE | |
| LOW | falcon/__init__.py | 361 | CODE | |
| LOW | falcon/__init__.py | 362 | CODE | |
| LOW | falcon/__init__.py | 363 | CODE | |
| LOW | falcon/__init__.py | 364 | CODE | |
| LOW | falcon/__init__.py | 365 | CODE | |
| LOW | falcon/__init__.py | 366 | CODE | |
| LOW | falcon/__init__.py | 367 | CODE | |
| LOW | falcon/__init__.py | 368 | CODE | |
| LOW | falcon/__init__.py | 369 | CODE | |
| LOW | falcon/__init__.py | 370 | CODE | |
| LOW | falcon/__init__.py | 371 | CODE | |
| LOW | falcon/__init__.py | 372 | CODE | |
| LOW | falcon/__init__.py | 373 | CODE | |
| LOW | falcon/__init__.py | 374 | CODE | |
| LOW | falcon/__init__.py | 375 | CODE | |
| LOW | falcon/__init__.py | 376 | CODE | |
| LOW | falcon/__init__.py | 377 | CODE | |
| LOW | falcon/__init__.py | 378 | CODE | |
| 416 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_utils.py | 744 | except AttributeError: | CODE |
| HIGH | tests/test_request_query_string_media.py | 181 | except errors.HTTPBadRequest: | CODE |
| HIGH | tests/test_request_query_string_media.py | 258 | except Exception: | CODE |
| HIGH | tests/test_request_query_string_media.py | 281 | except falcon.MediaNotFoundError: | CODE |
| HIGH | tests/test_response_body.py | 71 | except StopIteration: | CODE |
| HIGH | tests/test_media_handlers.py | 24 | except ImportError: | CODE |
| HIGH | tests/test_media_handlers.py | 29 | except ImportError: | CODE |
| HIGH | tests/test_media_handlers.py | 34 | except ImportError: | CODE |
| HIGH | tests/test_media_handlers.py | 39 | except ImportError: | CODE |
| HIGH | tests/test_media_handlers.py | 45 | except ImportError: | CODE |
| HIGH | tests/test_wsgi.py | 167 | except OSError: | CODE |
| HIGH | tests/asgi/test_asgi_servers.py | 116 | except requests.ConnectionError: | CODE |
| HIGH | tests/asgi/test_asgi_servers.py | 368 | except EOFError: | CODE |
| HIGH | tests/asgi/test_asgi_servers.py | 511 | except KeyboardInterrupt: | CODE |
| HIGH | tests/asgi/test_ws.py | 685 | except falcon.WebSocketDisconnected: | CODE |
| HIGH | tests/asgi/test_ws.py | 710 | except falcon.WebSocketDisconnected: | CODE |
| HIGH | tests/asgi/test_ws.py | 166 | except asyncio.CancelledError: | CODE |
| HIGH | e2e-tests/conftest.py | 44 | except requests.exceptions.RequestException: | CODE |
| HIGH | examples/look/tests/conftest.py | 33 | except requests.exceptions.RequestException: | CODE |
| HIGH | falcon/request.py | 1363 | except KeyError: | CODE |
| HIGH | falcon/app_helpers.py | 403 | except (AttributeError, TypeError): | CODE |
| HIGH | falcon/response_helpers.py | 58 | except KeyError: | CODE |
| HIGH | falcon/response_helpers.py | 69 | except KeyError: | CODE |
| HIGH | falcon/asgi/request.py | 350 | except KeyError: | CODE |
| HIGH | falcon/asgi/request.py | 385 | except KeyError: | CODE |
| HIGH | falcon/asgi/stream.py | 304 | except KeyError: | CODE |
| HIGH | falcon/asgi/stream.py | 388 | except KeyError: | CODE |
| HIGH | falcon/asgi/stream.py | 451 | except KeyError: | CODE |
| HIGH | falcon/asgi/ws.py | 735 | except asyncio.CancelledError: | CODE |
| HIGH | falcon/asgi/app.py | 819 | except asyncio.CancelledError: | CODE |
| HIGH | falcon/util/mediatypes.py | 324 | except ValueError: | CODE |
| HIGH | falcon/testing/client.py | 2390 | except asyncio.CancelledError: | CODE |
| HIGH | falcon/routing/util.py | 73 | except AttributeError: | CODE |
| HIGH | falcon/media/handlers.py | 187 | except ValueError: | CODE |
| HIGH | falcon/media/validators/jsonschema.py | 11 | except ImportError: # pragma: nocover | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | falcon/request.py | 1176 | Deserialize the query string as a media object. This method URL-decodes the query string and then deserializes | STRING |
| HIGH | falcon/request.py | 1320 | Retrieve the raw string value for the given header. Args: name (str): Header name, case-insensitive | STRING |
| HIGH | falcon/request.py | 1378 | Retrieve the int value for the given header. Args: name (str): Header name, case-insensitive (e.g., | STRING |
| HIGH | falcon/request.py | 1420 | Return an HTTP header with HTTP-Date values as a datetime. Args: name (str): Header name, case-inse | STRING |
| HIGH | falcon/request.py | 1527 | Return the raw value of a query string parameter as a string. Note: If an HTML form is POSTed to th | STRING |
| HIGH | falcon/request.py | 1669 | Return the value of a query string parameter as an int. Args: name (str): Parameter name, case-sens | STRING |
| HIGH | falcon/request.py | 1798 | Return the value of a query string parameter as an float. Args: name (str): Parameter name, case-se | STRING |
| HIGH | falcon/request.py | 1918 | Return the value of a query string parameter as an UUID. The value to convert must conform to the standard UUID | STRING |
| HIGH | falcon/request.py | 2039 | Return the value of a query string parameter as a boolean. This method treats valueless parameters as flags. By | STRING |
| HIGH | falcon/request.py | 2202 | Return the value of a query string parameter as a list. List items must be comma-separated or must be provided | STRING |
| HIGH | falcon/request.py | 2381 | Return the value of a query string parameter as a datetime. Args: name (str): Parameter name, case- | STRING |
| HIGH | falcon/request.py | 2488 | Return the value of a query string parameter as a date. Args: name (str): Parameter name, case-sens | STRING |
| HIGH | falcon/request.py | 2546 | Return the decoded JSON value of a query string parameter. Given a JSON value, decode it to an appropriate Pyth | STRING |
| HIGH | falcon/request.py | 2617 | Return a query string parameter's value deserialized by a media handler. This is useful for implementing the Op | STRING |
| HIGH | falcon/request.py | 2719 | Return the value of a query string parameter as a dictionary. Two input formats are supported: * An al | STRING |
| HIGH | falcon/response.py | 678 | Retrieve the raw string value for the given header. Normally, when a header has multiple values, they will be | STRING |
| HIGH | falcon/asgi/request.py | 759 | Retrieve the raw string value for the given header. Args: name (str): Header name, case-insensitive | STRING |
| HIGH | falcon/asgi/request.py | 841 | Return the raw value of a query string parameter as a string. Note: If an HTML form is POSTed to th | STRING |
| HIGH | falcon/util/misc.py | 176 | Convert an HTTP date string to a datetime instance. Args: http_date (str): An RFC 1123 date string, e.g.: | STRING |
| HIGH | falcon/util/misc.py | 301 | Get a bound method of the given object by name. Args: obj: Object on which to look up the method. m | STRING |
| HIGH | falcon/util/misc.py | 371 | Sanitize the provided `filename` to contain only ASCII characters. Only ASCII alphanumerals, ``'.'``, ``'-'`` and ` | STRING |
| HIGH | falcon/util/uri.py | 345 | Parse a query string into a dict. Query string parameters are assumed to use standard form-encoding. Only param | STRING |
| HIGH | falcon/util/uri.py | 534 | Unquote an RFC 7320 "quoted-string". Args: quoted (str): Original quoted string Returns: str: | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup.py | 41 | # CPython versions (especially 3.12+), cythonizing pure Python code | COMMENT |
| LOW | tox.ini | 1 | [tox] | COMMENT |
| LOW | tests/test_wsgi_servers.py | 341 | # TODO(vytas): In retrospect, it would be easier to maintain these | COMMENT |
| LOW | docs/conf.py | 1 | # Copyright 2014-2026 by Falcon Contributors. | COMMENT |
| LOW | docs/conf.py | 41 | # | COMMENT |
| LOW | docs/conf.py | 121 | # Sphinx is looking for the mapped types defined as classes, however, typing | COMMENT |
| LOW | docs/ext/falcon_releases.py | 1 | # Copyright 2025-2026 by Vytautas Liuolia. | COMMENT |
| LOW | docs/ext/newsfragments.py | 1 | # Copyright 2026 by Vytautas Liuolia. | COMMENT |
| LOW | docs/ext/doorway.py | 1 | # Copyright 2016 by Rackspace Hosting, Inc. | COMMENT |
| LOW | docs/ext/workarounds.py | 1 | # Copyright 2025-2026 by Vytautas Liuolia. | COMMENT |
| LOW | docs/ext/rfc.py | 1 | # Copyright 2016 by Rackspace Hosting, Inc. | COMMENT |
| LOW | docs/ext/private_args.py | 1 | # Copyright 2021 by Kurt Griffiths | COMMENT |
| LOW | docs/ext/cibuildwheel.py | 1 | # Copyright 2024-2026 by Vytautas Liuolia. | COMMENT |
| LOW | e2e-tests/conftest.py | 1 | # Copyright 2020-2026 by Vytautas Liuolia. | COMMENT |
| LOW | e2e-tests/test_e2e.py | 1 | # Copyright 2020-2026 by Vytautas Liuolia. | COMMENT |
| LOW | falcon/hooks.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/version.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/_typing.py | 1 | # Copyright 2021-2026 by Vytautas Liuolia. | COMMENT |
| LOW | falcon/http_error.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/request_helpers.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/request_helpers.py | 81 | if _COOKIE_NAME_RESERVED_CHARS.search(name): | COMMENT |
| LOW | falcon/asgi_spec.py | 1 | # Copyright 2020 by Kurt Griffiths | COMMENT |
| LOW | falcon/constants.py | 141 | # omitted, preference is given to the encoding specified in the | COMMENT |
| LOW | falcon/request.py | 1 | # Licensed under the Apache License, Version 2.0 (the "License"); | COMMENT |
| LOW | falcon/request.py | 261 | # empty string, so normalize it in that case. | COMMENT |
| LOW | falcon/__init__.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/__init__.py | 661 | # flavor of the framework as HTTP 500 tracebacks may disappear completely, | COMMENT |
| LOW | falcon/status_codes.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/response.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/response.py | 941 | Can take values 'anonymous' or 'use-credentials' or None. | COMMENT |
| LOW | falcon/response.py | 1381 | # PERF(vytas): uglier inline version of Response._set_media_type | COMMENT |
| LOW | falcon/forwarded.py | 1 | # Based on code from the aiohttp project, Copyright 2013-2017 by Nikolay Kim and | COMMENT |
| LOW | falcon/responders.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/stream.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/inspect.py | 1 | # Copyright 2020-2026 by Federico Caselli | COMMENT |
| LOW | falcon/redirects.py | 1 | # Copyright 2015 by Kurt Griffiths | COMMENT |
| LOW | falcon/app_helpers.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/app_helpers.py | 321 | COMMENT | |
| LOW | falcon/http_status.py | 1 | # Copyright 2015 by Hurricane Labs LLC | COMMENT |
| LOW | falcon/app.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/app.py | 461 | # traversal for _get_responder() to fail. An example is | COMMENT |
| LOW | falcon/app.py | 541 | ): | COMMENT |
| LOW | falcon/errors.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/errors.py | 201 | # pattern using typing.Unpack: | COMMENT |
| LOW | falcon/typing.py | 1 | # Copyright 2024 by Federico Caselli | COMMENT |
| LOW | falcon/response_helpers.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/response_helpers.py | 101 | # sufficiently expressive. | COMMENT |
| LOW | falcon/cmd/inspect_app.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | falcon/cmd/bench.py | 1 | # Copyright 2013 by Rackspace Hosting, Inc. | COMMENT |
| LOW | falcon/asgi/multipart.py | 1 | # Copyright 2019-2026 by Vytautas Liuolia. | COMMENT |
| LOW | falcon/asgi/_request_helpers.py | 1 | # Copyright 2019 by Kurt Griffiths | COMMENT |
| LOW | falcon/asgi/request.py | 1 | # Copyright 2019-2020 by Kurt Griffiths | COMMENT |
| LOW | falcon/asgi/request.py | 121 | # ===================================================================== | COMMENT |
| LOW | falcon/asgi/request.py | 221 | self.content_type = None | COMMENT |
| LOW | falcon/asgi/request.py | 241 | # ===================================================================== | COMMENT |
| LOW | falcon/asgi/request.py | 501 | # access this field when setting self._cached_access_route | COMMENT |
| LOW | falcon/asgi/__init__.py | 1 | # Copyright 2019 by Kurt Griffiths. | COMMENT |
| LOW | falcon/asgi/response.py | 1 | # Copyright 2019 by Kurt Griffiths | COMMENT |
| LOW | falcon/asgi/response.py | 381 | # in case the latter contains Set-Cookie headers that should be | COMMENT |
| LOW | falcon/asgi/stream.py | 1 | # Copyright 2019 by Kurt Griffiths | COMMENT |
| 43 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_request_query_string_media.py | 79 | def on_get(self, req, resp): | CODE |
| MEDIUM | tests/test_request_query_string_media.py | 302 | def on_get(self, req, resp): | CODE |
| LOW | tests/test_request_query_string_media.py | 258 | except Exception: | CODE |
| LOW | tests/test_request_query_string_media.py | 309 | except Exception: | CODE |
| LOW | tests/test_query_params.py | 379 | except Exception as ex: | CODE |
| LOW | tests/test_query_params.py | 455 | except Exception as ex: | CODE |
| LOW | tests/test_query_params.py | 583 | except Exception as ex: | CODE |
| LOW | tests/test_query_params.py | 749 | except Exception as ex: | CODE |
| LOW | tests/test_request_media.py | 194 | except Exception as e: | CODE |
| LOW | tests/test_request_media.py | 218 | except Exception as e: | CODE |
| LOW | tests/test_request_media.py | 323 | except Exception as e: | CODE |
| LOW | tests/test_request_media.py | 327 | except Exception as e: | CODE |
| LOW | tests/test_request_media.py | 342 | except Exception as e: | CODE |
| LOW | tests/test_request_media.py | 349 | except Exception as e: | CODE |
| MEDIUM | tests/asgi/test_ws.py | 70 | def on_websocket(self, req, ws, explicit): | CODE |
| MEDIUM | tests/asgi/test_ws.py | 696 | def on_websocket(self, req, ws): | CODE |
| LOW | tests/asgi/test_ws.py | 675 | except Exception as ex: | CODE |
| LOW | tests/asgi/test_ws.py | 700 | except Exception as ex: | CODE |
| LOW | tests/asgi/test_ws.py | 991 | except Exception: | CODE |
| LOW | tests/asgi/test_response_media_asgi.py | 154 | except Exception as ex: | CODE |
| LOW | examples/things_advanced.py | 121 | except Exception as ex: | CODE |
| LOW | examples/things_advanced_asgi.py | 127 | except Exception as ex: | CODE |
| LOW | examples/recipes/request_id_log.py | 14 | except Exception: | CODE |
| LOW | falcon/request.py | 1151 | except Exception as err: | CODE |
| LOW | falcon/inspect.py | 794 | except Exception: | CODE |
| LOW | falcon/app.py | 468 | except Exception as ex: | CODE |
| LOW | falcon/app.py | 490 | except Exception as ex: | CODE |
| LOW | falcon/app.py | 498 | except Exception as ex: | CODE |
| LOW | falcon/app.py | 509 | except Exception as ex: | CODE |
| LOW | falcon/app.py | 565 | except Exception as ex: | CODE |
| LOW | falcon/app.py | 1417 | except Exception as handler_ex: | CODE |
| MEDIUM | falcon/asgi/request.py | 283 | def content_length(self) -> int | None: | CODE |
| LOW | falcon/asgi/request.py | 646 | except Exception as err: | CODE |
| LOW | falcon/asgi/ws.py | 489 | except Exception as ex: | CODE |
| LOW | falcon/asgi/app.py | 564 | except Exception as ex: | CODE |
| LOW | falcon/asgi/app.py | 589 | except Exception as ex: | CODE |
| LOW | falcon/asgi/app.py | 598 | except Exception as ex: | CODE |
| LOW | falcon/asgi/app.py | 649 | except Exception as ex: | CODE |
| LOW | falcon/asgi/app.py | 748 | except Exception as ex: | CODE |
| LOW | falcon/asgi/app.py | 1174 | except Exception: | CODE |
| LOW | falcon/asgi/app.py | 1190 | except Exception: | CODE |
| LOW | falcon/asgi/app.py | 1289 | except Exception as ex: | CODE |
| LOW | falcon/asgi/app.py | 1470 | except Exception as handler_ex: | CODE |
| LOW | falcon/asgi/app.py | 1497 | except Exception as ex: | CODE |
| LOW | falcon/routing/compiled.py | 446 | except Exception as e: | CODE |
| LOW | falcon/media/urlencoded.py | 64 | except Exception as err: | CODE |
| LOW | falcon/media/json.py | 182 | except Exception as ex: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_error_reporter.py | 148 | raise falcon.HTTPStatus(falcon.HTTP_OK, text='{"result": null}') | CODE |
| HIGH⚡ | tests/test_request_query_string_media.py | 48 | # Query string: {"numbers":[1,2],"flag":null} | COMMENT |
| HIGH⚡ | tests/test_request_query_string_media.py | 49 | json_data = '{"numbers":[1,2],"flag":null}' | CODE |
| HIGH | tests/test_request_attrs.py | 128 | # NOTE(kgriffs): Behavior for IP addresses is undefined, | COMMENT |
| HIGH | falcon/request.py | 1186 | method will URL-decode it to ``{"numbers":[1,2],"flag":null}`` and | STRING |
| HIGH⚡ | falcon/asgi/stream.py | 179 | # just be left undefined; hence we do not implement readline(), | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_media_multipart.py | 149 | CODE | |
| LOW | tests/test_httperror.py | 50 | CODE | |
| LOW | tests/test_utils.py | 1290 | CODE | |
| LOW | tests/asgi/test_asgi_servers.py | 671 | CODE | |
| LOW | tests/asgi/test_ws.py | 307 | CODE | |
| LOW | tests/asgi/test_ws.py | 325 | CODE | |
| LOW | tests/asgi/test_hello_asgi.py | 47 | CODE | |
| LOW | docs/ext/falcon_releases.py | 152 | CODE | |
| LOW | falcon/hooks.py | 89 | CODE | |
| LOW | falcon/hooks.py | 174 | CODE | |
| LOW | falcon/hooks.py | 134 | CODE | |
| LOW | falcon/hooks.py | 199 | CODE | |
| LOW | falcon/request.py | 558 | CODE | |
| LOW | falcon/request.py | 876 | CODE | |
| LOW | falcon/request.py | 956 | CODE | |
| LOW | falcon/request.py | 2030 | CODE | |
| LOW | falcon/request.py | 2709 | CODE | |
| LOW | falcon/response.py | 267 | CODE | |
| LOW | falcon/forwarded.py | 92 | CODE | |
| LOW | falcon/inspect.py | 216 | CODE | |
| LOW | falcon/inspect.py | 228 | CODE | |
| LOW | falcon/app_helpers.py | 96 | CODE | |
| LOW | falcon/app_helpers.py | 284 | CODE | |
| LOW | falcon/app.py | 407 | CODE | |
| LOW | falcon/app.py | 1208 | CODE | |
| LOW | falcon/asgi/multipart.py | 200 | CODE | |
| LOW | falcon/asgi/request.py | 463 | CODE | |
| LOW | falcon/asgi/response.py | 180 | CODE | |
| LOW | falcon/asgi/stream.py | 423 | CODE | |
| LOW | falcon/asgi/ws.py | 250 | CODE | |
| LOW | falcon/asgi/app.py | 457 | CODE | |
| LOW | falcon/asgi/app.py | 1132 | CODE | |
| LOW | falcon/asgi/app.py | 1202 | CODE | |
| LOW | falcon/asgi/structures.py | 127 | CODE | |
| LOW | falcon/util/misc.py | 238 | CODE | |
| LOW | falcon/util/uri.py | 342 | CODE | |
| LOW | falcon/testing/helpers.py | 815 | CODE | |
| LOW | falcon/routing/compiled.py | 166 | CODE | |
| LOW | falcon/routing/compiled.py | 450 | CODE | |
| LOW | falcon/routing/compiled.py | 259 | CODE | |
| LOW | falcon/media/multipart.py | 365 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_request_context.py | 23 | # Define a Request-alike with a custom context type | COMMENT |
| MEDIUM⚡ | tests/test_request_context.py | 35 | # Define a Request-alike with a non-callable custom context type | COMMENT |
| MEDIUM⚡ | tests/test_request_context.py | 47 | # Define a Request-alike with a custom context type | COMMENT |
| MEDIUM⚡ | tests/asgi/test_request_context_asgi.py | 23 | # Define a Request-alike with a custom context type | COMMENT |
| MEDIUM⚡ | tests/asgi/test_request_context_asgi.py | 34 | # Define a Request-alike with a non-callable custom context type | COMMENT |
| MEDIUM⚡ | tests/asgi/test_request_context_asgi.py | 45 | # Define a Request-alike with a custom context type | COMMENT |
| MEDIUM⚡ | falcon/asgi/request.py | 242 | # Create a context object | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_request_query_string_media.py | 140 | # Plain text - should just return the decoded string | COMMENT |
| LOW | tests/test_cookies.py | 468 | # we cannot simply use pytest.raises | COMMENT |
| LOW | tests/test_wsgi.py | 76 | # NOTE(kgriffs): Elsewhere we just use req.bounded_stream, so | COMMENT |
| LOW | tests/asgi/test_ws.py | 100 | # cycles to just use the same pattern whether or not the conductor | COMMENT |
| LOW | falcon/constants.py | 145 | # ignore it anyway and just use what is specified in the document, | COMMENT |
| LOW | falcon/request.py | 1356 | # people to usually just use the relevant helper properties | COMMENT |
| MEDIUM | falcon/request.py | 2942 | """Set to ``True`` in order to automatically consume the request stream | STRING |
| MEDIUM | falcon/request.py | 3010 | """Set to ``True`` in order to strip the trailing slash, if present, at the | STRING |
| LOW | falcon/response.py | 553 | # so we can just pass this in and when __setitem__() calls | COMMENT |
| MEDIUM | falcon/stream.py | 31 | """Wrap *wsgi.input* streams to make them more robust. | STRING |
| LOW | falcon/asgi/stream.py | 144 | # NOTE(kgriffs): If length is unknown we just set remaining bytes | COMMENT |
| LOW | falcon/testing/helpers.py | 239 | # NOTE(kgriffs): Part of the time just return an | COMMENT |
| MEDIUM | falcon/media/multipart.py | 524 | # characters known to be very robust through mail gateways, and NOT | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | falcon/response.py | 350 | CODE | |
| LOW | falcon/app.py | 302 | CODE | |
| LOW | falcon/app.py | 317 | CODE | |
| LOW | falcon/app.py | 332 | CODE | |
| LOW | falcon/app.py | 347 | CODE | |
| LOW | falcon/app.py | 361 | CODE | |
| LOW | falcon/asgi/app.py | 366 | CODE | |
| LOW | falcon/asgi/app.py | 381 | CODE | |
| LOW | falcon/asgi/app.py | 396 | CODE | |
| LOW | falcon/asgi/app.py | 411 | CODE | |
| LOW | falcon/asgi/app.py | 425 | CODE | |
| LOW | falcon/testing/client.py | 471 | CODE | |
| LOW | falcon/testing/client.py | 693 | CODE | |
| LOW | falcon/testing/client.py | 721 | CODE | |
| LOW | falcon/testing/client.py | 752 | CODE | |
| LOW | falcon/testing/helpers.py | 973 | CODE | |
| LOW | falcon/testing/helpers.py | 1118 | CODE | |
| LOW | falcon/testing/helpers.py | 1201 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | falcon/request.py | 0 | a dict-like object for configuring the media-types to handle. by default, handlers are provided for the ``application/js | STRING |
| HIGH | falcon/response.py | 0 | a dict-like object for configuring the media-types to handle. by default, handlers are provided for the ``application/js | STRING |
| HIGH | falcon/media/multipart.py | 0 | a dict-like object for configuring the media-types to handle. by default, handlers are provided for the ``application/js | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_media_multipart.py | 71 | b'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod ' | CODE |
| LOW | tests/test_media_multipart.py | 71 | b'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod ' | CODE |
| LOW⚡ | tests/test_utils.py | 865 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praese', | CODE |
| LOW⚡ | tests/test_utils.py | 865 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praese', | CODE |
| LOW⚡ | tests/test_utils.py | 924 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praese', | CODE |
| LOW⚡ | tests/test_utils.py | 924 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praese', | CODE |
| LOW | tests/test_utils.py | 981 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praese', | CODE |
| LOW | tests/test_utils.py | 981 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Praese', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | e2e-tests/server/__init__.py | 3 | __all__ = ['app'] | CODE |
| LOW | e2e-tests/server/hub.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | falcon/response.py | 709 | def set_header(self, name: str, value: str) -> None: | CODE |
| LOW | falcon/response.py | 1356 | def _set_media_type(self, media_type: str | None = None) -> None: | CODE |
| LOW | falcon/app.py | 1052 | def set_error_reporter(self, reporter: ErrorReporter[_ReqT]) -> None: | CODE |
| LOW | falcon/app.py | 1499 | def _update_sink_and_static_routes(self) -> None: | CODE |
| LOW | falcon/app.py | 1145 | def set_error_serializer(self, serializer: ErrorSerializer[_ReqT, _RespT]) -> None: | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | examples/look/look/images.py | 44 | # Note the use of dependency injection for standard library | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | examples/ws_tutorial/ws_tutorial/app.py | 63 | # Check if the route is protected | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_utils.py | 1622 | def test_function(self, recwarn): | CODE |
| LOW | falcon/hooks.py | 108 | def do_something(req, resp, resource, params): | STRING |