[LKuemmel]

references #4148 (review) Punkt 2

Summary by Sourcery

Log binary HTTP responses using only their content type and size while preserving text response logging.

Bug Fixes:

• Prevent binary HTTP responses from being decoded and logged as text.

Enhancements:

• Log binary response metadata, including content type and size, while continuing to log textual responses in full.

Tests:

• Add coverage for text responses, binary and mislabeled ZIP responses, disabled debug logging, and preserved error handling.

[Copilot]

🟡 Changes recommended

A moderate active finding remains because unlisted binary media types can still be decoded and written to DEBUG logs, so the change does not reliably prevent binary-content logging.

1 open issue

• Unlisted binary media types are still logged as decoded text · New

What changed in this PR

This pull request updates shared HTTP response logging to log recognized binary responses by content type and size instead of their decoded body, with accompanying regression tests.

Changes:

• Adds binary-response detection based on MIME types and ZIP signatures.
• Preserves text-response logging and existing HTTP error handling.
• Adds tests for binary, text, disabled-debug, and error-response behavior.
• Moderate issue: Unlisted binary media types can still fall through to response.text and expose decoded binary contents in DEBUG logs.

File	Description
packages/​modules/​common/​req.py	Implements metadata-only logging for recognized binary responses; binary media types outside the whitelist may still be logged as decoded text.
packages/​modules/​common/​req_test.py	Adds regression coverage for binary ZIP handling, text logging, debug-level behavior, and error responses.

_{Review effort: Lite}

[sourcery-ai]

Sourcery assessment

Approved.

[Copilot]

🟢 Approval recommended

No active review issues remain, and the change includes focused handling and test coverage for text, binary, ZIP, disabled-debug, and error responses.

No open issues 🎉

1 resolved since last review

• Unlisted binary media types are still logged as decoded text

_{Review effort: Lite}

Ein Bot darf einen PR nicht akzeptieren.

[LKuemmel]

@sourcery-ai review

[sourcery-ai]

Reviewer's Guide

Implementation

Add a response logger that logs textual bodies as before but logs binary responses by content type and size, including ZIP files mislabeled as text.

• packages/modules/common/req.py L3, L50-67

Tests

Test textual and binary response logging, ZIP detection, disabled debug logging, and preservation of HTTP error responses.

• packages/modules/common/req_test.py L1-78

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 3 issues

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="packages/modules/common/req.py" line_range="58" />
<code_context>
+            content_type in ('application/json', 'application/xml', 'application/x-www-form-urlencoded') or
+            (content_type.startswith('application/') and content_type.endswith(('+json', '+xml'))))
+    # The portal can omit/mislabel the content type of ZIP downloads.
+    if not text or response.content.startswith((b'PK\x03\x04', b'PK\x05\x06', b'PK\x07\x08')):
+        log.debug("Get-Response: binary data (%s, %s bytes)", content_type or 'unknown type', len(response.content))
+    else:
</code_context>
<issue_to_address>
**Binary payloads are written to logs**

When non-ZIP binary data is labeled with a text/* content type, `_log_response` trusts the text media type and logs `response.text`, decoding and emitting the binary payload instead of metadata; callers see the binary payload in debug logs.

Detect non-ZIP binary payloads before logging `response.text` and log only their type and size.
</issue_to_address>

### Comment 2
<location path="packages/modules/common/req.py" line_range="56" />
<code_context>
+    content_type = response.headers.get('Content-Type', '').split(';', 1)[0].strip().lower()
+    text = (content_type.startswith('text/') or
+            content_type in ('application/json', 'application/xml', 'application/x-www-form-urlencoded') or
+            (content_type.startswith('application/') and content_type.endswith(('+json', '+xml'))))
+    # The portal can omit/mislabel the content type of ZIP downloads.
+    if not text or response.content.startswith((b'PK\x03\x04', b'PK\x05\x06', b'PK\x07\x08')):
</code_context>
<issue_to_address>
**Text response bodies disappear from logs**

When a response uses an unlisted textual application/* media type such as `application/javascript`, `_log_response` classifies the response as binary and logs only its type and size, so callers cannot inspect the body in debug logs.

Classify textual application/* media types as text instead of limiting them to the listed types and JSON/XML suffixes.
</issue_to_address>

### Comment 3
<location path="packages/modules/common/req.py" line_range="58" />
<code_context>
+            content_type in ('application/json', 'application/xml', 'application/x-www-form-urlencoded') or
+            (content_type.startswith('application/') and content_type.endswith(('+json', '+xml'))))
+    # The portal can omit/mislabel the content type of ZIP downloads.
+    if not text or response.content.startswith((b'PK\x03\x04', b'PK\x05\x06', b'PK\x07\x08')):
+        log.debug("Get-Response: binary data (%s, %s bytes)", content_type or 'unknown type', len(response.content))
+    else:
</code_context>
<issue_to_address>
**Prefixed ZIP contents enter logs**

When a ZIP download has a prepended executable and is labeled with a text-like Content-Type, `_log_response` recognizes ZIP data only when a ZIP signature starts at byte zero, so a self-extracting ZIP with a prepended executable and a text-like Content-Type falls through to `response.text` and its binary body appears in debug logs.

Detect ZIP archives with a format-aware check that supports prepended data before logging their contents.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

🟡 Medium · Binary payloads are written to logs

When non-ZIP binary data is labeled with a text/* content type, _log_response trusts the text media type and logs response.text, decoding and emitting the binary payload instead of metadata; callers see the binary payload in debug logs.

Detect non-ZIP binary payloads before logging response.text and log only their type and size.

Prompt for AI agents

In `packages/modules/common/req.py` at line 58:

**Binary payloads are written to logs**

When non-ZIP binary data is labeled with a text/* content type, `_log_response` trusts the text media type and logs `response.text`, decoding and emitting the binary payload instead of metadata; callers see the binary payload in debug logs.

Detect non-ZIP binary payloads before logging `response.text` and log only their type and size.

[sourcery-ai]

🟡 Medium · Text response bodies disappear from logs

When a response uses an unlisted textual application/* media type such as application/javascript, _log_response classifies the response as binary and logs only its type and size, so callers cannot inspect the body in debug logs.

Classify textual application/* media types as text instead of limiting them to the listed types and JSON/XML suffixes.

Prompt for AI agents

In `packages/modules/common/req.py` at line 56:

**Text response bodies disappear from logs**

When a response uses an unlisted textual application/* media type such as `application/javascript`, `_log_response` classifies the response as binary and logs only its type and size, so callers cannot inspect the body in debug logs.

Classify textual application/* media types as text instead of limiting them to the listed types and JSON/XML suffixes.

[sourcery-ai]

🟡 Medium · Prefixed ZIP contents enter logs

When a ZIP download has a prepended executable and is labeled with a text-like Content-Type, _log_response recognizes ZIP data only when a ZIP signature starts at byte zero, so a self-extracting ZIP with a prepended executable and a text-like Content-Type falls through to response.text and its binary body appears in debug logs.

Detect ZIP archives with a format-aware check that supports prepended data before logging their contents.

Prompt for AI agents

In `packages/modules/common/req.py` at line 58:

**Prefixed ZIP contents enter logs**

When a ZIP download has a prepended executable and is labeled with a text-like Content-Type, `_log_response` recognizes ZIP data only when a ZIP signature starts at byte zero, so a self-extracting ZIP with a prepended executable and a text-like Content-Type falls through to `response.text` and its binary body appears in debug logs.

Detect ZIP archives with a format-aware check that supports prepended data before logging their contents.