Header name change request for BenchmarkTest00656 OWASP Python Test

[AkashSahai]

Hi @davewichers,

Hope you are doing well.

For the OWASP BenchmarkPython test BenchmarkTest00656, could you please update the header name in benchmark-crawler-http.xml from my_user_id to either myuserid or my-user-id.

Right now, the test is not working because Werkzeug drops headers that contain underscores. The current header is:

<header name="my_user_id" value="BenchmarkTest00656"/>

Could you please change it to either:

<header name="my-user-id" value="BenchmarkTest00656"/>

or

<header name="myuserid" value="BenchmarkTest00656"/>

This behavior is documented here:
https://werkzeug.palletsprojects.com/en/stable/changes/#version-2-3-0
pallets/werkzeug#2622

Thanks.

[davewichers]

How does Werkzeug relate to BenchmarkPython? Is this a tool/library you are using to analyze BenchmarkPython?

[AkashSahai]

Hi @davewichers,

Werkzeug is not a separate analysis tool. BenchmarkPython is implemented as a Flask web application, and Flask uses Werkzeug underneath for HTTP request handling.

In this repo, the app is created with Flask in app.py and the pinned dependencies include both Flask and Werkzeug in requirements.txt.

Because header parsing happens in the Flask/Werkzeug request stack before the test code sees the request, headers containing underscores are dropped there, so BenchmarkTest00656 never receives my_user_id and the intended code path does not execute.

Thanks.

[AkashSahai]

Hi @davewichers,

BenchmarkPython is built on Flask, which uses Werkzeug for request handling. Since headers with underscores are dropped before the test code executes, BenchmarkTest00656 never receives my_user_id, and the intended code path is missed.

If it would help, I can share more details from my side on this change.

Thanks.

[davewichers]

Is the change in the test case file itself, or the infrastructure of the app? Either way, if you want to create a PR with the desired changes, that would be helpful.

[AkashSahai]

Hi @davewichers,

Sharing the PR below with the relevant changes.
PR with relevant changes

Thanks.

[AkashSahai]

Hi @davewichers,

Hope you are doing well.

I have shared the PR here: [https://github.com//pull/5]

If you need any additional information regarding this change, please let me know.

Thanks.

[AkashSahai]

Thank you, @davewichers, for your support. The issue is now resolved.