internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: pallets/werkzeug

Issue:
`any` converter should validate value to `url_for`
Expectation:
When using `url_for` for an endpoint with an `<any(foo, bar):arg>` argument in its route, it will raise an error for arguments that are not part of the any statement.

Actual result:
It returns an invalid URL


Example:
```
from flask import Flask, url_for, redirect

app = Flask(__name__)

@app.route("/any/<any(foo, bar):part>")
def url_with_any(part):
    return part

@app.route("/")
def index():
    return redirect(url_for("url_with_any", part="doesnotexist")) # this will 404

```

Environment:

- Python version: Python 3.10.4
- Flask version: Flask 2.1.1



Discussion:
Happy to tackle

Resolving patch:
diff --git a/src/werkzeug/routing/converters.py b/src/werkzeug/routing/converters.py
--- a/src/werkzeug/routing/converters.py
+++ b/src/werkzeug/routing/converters.py
@@ -81,14 +81,25 @@ class AnyConverter(BaseConverter):
     :param map: the :class:`Map`.
     :param items: this function accepts the possible items as positional
                   arguments.
+
+    .. versionchanged:: 2.2
+        Value is validated when building a URL.
     """
 
     part_isolating = True
 
     def __init__(self, map: "Map", *items: str) -> None:
         super().__init__(map)
+        self.items = set(items)
         self.regex = f"(?:{'|'.join([re.escape(x) for x in items])})"
 
+    def to_url(self, value: t.Any) -> str:
+        if value in self.items:
+            return str(value)
+
+        valid_values = ", ".join(f"'{item}'" for item in sorted(self.items))
+        raise ValueError(f"'{value}' is not one of {valid_values}")
+
 
 class PathConverter(BaseConverter):
     """Like the default :class:`UnicodeConverter`, but it also matches


Test patch:
diff --git a/tests/test_routing.py b/tests/test_routing.py
--- a/tests/test_routing.py
+++ b/tests/test_routing.py
@@ -757,6 +757,19 @@ def test_anyconverter():
     assert a.match("/a.2") == ("yes_dot", {"a": "a.2"})
 
 
+def test_any_converter_build_validates_value() -> None:
+    m = r.Map([r.Rule("/<any(patient, provider):value>", endpoint="actor")])
+    a = m.bind("localhost")
+
+    assert a.build("actor", {"value": "patient"}) == "/patient"
+    assert a.build("actor", {"value": "provider"}) == "/provider"
+
+    with pytest.raises(ValueError) as exc:
+        a.build("actor", {"value": "invalid"})
+
+    assert str(exc.value) == "'invalid' is not one of 'patient', 'provider'"
+
+
 @pytest.mark.parametrize(
     ("endpoint", "value", "expect"),
     [
Repository: pallets/werkzeug

Issue:
Regression in routing on Python 3.11.0b2: ValueError: line 1-0 is not a valid range
After upgrading Python 3.11 to 3.11.0b2, the routing module seems to be broken. This is visible e.g. in werkzeug's tests. Example failure:

```pytb
_____________________________________________ test_proxy_fix[ipv6 - port, host with port] _____________________________________________
tests/middleware/test_proxy_fix.py:183: in test_proxy_fix
    url_map = Map([Rule("/parrot", endpoint="parrot")])
.tox/py311/lib/python3.11/site-packages/werkzeug/routing.py:1505: in __init__
    self.add(rulefactory)
.tox/py311/lib/python3.11/site-packages/werkzeug/routing.py:1546: in add
    rule.bind(self)
.tox/py311/lib/python3.11/site-packages/werkzeug/routing.py:805: in bind
    self.compile()
.tox/py311/lib/python3.11/site-packages/werkzeug/routing.py:885: in compile
    self._build = self._compile_builder(False).__get__(self, None)
.tox/py311/lib/python3.11/site-packages/werkzeug/routing.py:1073: in _compile_builder
    code = compile(module, "<werkzeug routing>", "exec")
E   ValueError: line 1-0 is not a valid range
```

To reproduce:
1. Install Python 3.11.0b2.
2. `tox -e py311`

Environment:

- Python version: 3.11.0b2
- Werkzeug version: git main (bb21bf90b0b121e3ed45b9950b823e4b43a81fd8)



Discussion:
FWIU now you need to set `end_lineno` along with `lineno`. I'm not sure if it's intentional, though.
FWICS it's python/cpython@5893b5db98b38b17750c0572c7209774a5034898

Though pytest seems to be affected as well, so I don't really know how I managed to run tests yesterday.
Ah, there's more info on pytest-dev/pytest#10008. The tests can be run with `--assert=plain` to workaround pytest problem. FWICS upstream has also fixed this in CPython but I think that this particular issue is worth fixing in werkzeug too. I'll submit a PR shortly.

Resolving patch:
diff --git a/src/werkzeug/routing.py b/src/werkzeug/routing.py
--- a/src/werkzeug/routing.py
+++ b/src/werkzeug/routing.py
@@ -1067,8 +1067,12 @@ def _join(parts: t.List[ast.AST]) -> ast.AST:
         for node in ast.walk(module):
             if "lineno" in node._attributes:
                 node.lineno = 1
+            if "end_lineno" in node._attributes:
+                node.end_lineno = node.lineno  # type: ignore[attr-defined]
             if "col_offset" in node._attributes:
                 node.col_offset = 0
+            if "end_col_offset" in node._attributes:
+                node.end_col_offset = node.col_offset  # type: ignore[attr-defined]
 
         code = compile(module, "<werkzeug routing>", "exec")
         return self._get_func_code(code, func_ast.name)


Test patch:
Repository: pallets/werkzeug

Issue:
Type signature is overbroad for `Response.get_json`
<!--
This issue tracker is a tool to address bugs in Werkzeug itself. Please
use Pallets Discord or Stack Overflow for questions about your own code.

Replace this comment with a clear outline of what the bug is.
-->

The type signature for `Response.get_json` is currently:
```py
    def get_json(self, force: bool = False, silent: bool = False) -> t.Optional[t.Any]:
```

However, if `silent` is `False`, as is the default, this is overbroad, since it will always return `t.Any`. This is problematic in calling code, since you'll get a type checking error if you do something like this:
```py
error: Value of type "Optional[Any]" is not indexable  [index]
                data = rv.get_json()["data"]
```
<!--
Describe how to replicate the bug.

Include a minimal reproducible example that demonstrates the bug.
Include the full traceback if there was an exception.
-->

<!--
Describe the expected behavior that should have happened but didn't.
-->

This can be fixed by using an `overload` from the `typing` module when `silent` is the `Literal[False]`

Environment:

- Python version: 3.9.6
- Werkzeug version: 2.1.2



Discussion:

Resolving patch:
diff --git a/src/werkzeug/wrappers/request.py b/src/werkzeug/wrappers/request.py
--- a/src/werkzeug/wrappers/request.py
+++ b/src/werkzeug/wrappers/request.py
@@ -543,6 +543,18 @@ def json(self) -> t.Optional[t.Any]:
     # with sentinel values.
     _cached_json: t.Tuple[t.Any, t.Any] = (Ellipsis, Ellipsis)
 
+    @t.overload
+    def get_json(
+        self, force: bool = ..., silent: "te.Literal[False]" = ..., cache: bool = ...
+    ) -> t.Any:
+        ...
+
+    @t.overload
+    def get_json(
+        self, force: bool = ..., silent: bool = ..., cache: bool = ...
+    ) -> t.Optional[t.Any]:
+        ...
+
     def get_json(
         self, force: bool = False, silent: bool = False, cache: bool = True
     ) -> t.Optional[t.Any]:
diff --git a/src/werkzeug/wrappers/response.py b/src/werkzeug/wrappers/response.py
--- a/src/werkzeug/wrappers/response.py
+++ b/src/werkzeug/wrappers/response.py
@@ -645,6 +645,14 @@ def json(self) -> t.Optional[t.Any]:
         """
         return self.get_json()
 
+    @t.overload
+    def get_json(self, force: bool = ..., silent: "te.Literal[False]" = ...) -> t.Any:
+        ...
+
+    @t.overload
+    def get_json(self, force: bool = ..., silent: bool = ...) -> t.Optional[t.Any]:
+        ...
+
     def get_json(self, force: bool = False, silent: bool = False) -> t.Optional[t.Any]:
         """Parse :attr:`data` as JSON. Useful during testing.
 


Test patch:
Repository: pallets/werkzeug

Issue:
Document send_from_directory
The `send_from_directory` function was added in 2.0.0 in #1888, but it was not added to documentation.
The [`send_file` docs](https://werkzeug.palletsprojects.com/en/2.2.x/utils/#werkzeug.utils.send_file) reference to it was probably intended to be a link.

Environment:

- Python version: none -- online docs
- Werkzeug version: 2.2.0



Discussion:

Resolving patch:
diff --git a/src/werkzeug/utils.py b/src/werkzeug/utils.py
--- a/src/werkzeug/utils.py
+++ b/src/werkzeug/utils.py
@@ -352,7 +352,7 @@ def send_file(
 
     Never pass file paths provided by a user. The path is assumed to be
     trusted, so a user could craft a path to access a file you didn't
-    intend.
+    intend. Use :func:`send_from_directory` to safely serve user-provided paths.
 
     If the WSGI server sets a ``file_wrapper`` in ``environ``, it is
     used, otherwise Werkzeug's built-in wrapper is used. Alternatively,
@@ -562,9 +562,10 @@ def send_from_directory(
     If the final path does not point to an existing regular file,
     returns a 404 :exc:`~werkzeug.exceptions.NotFound` error.
 
-    :param directory: The directory that ``path`` must be located under.
-    :param path: The path to the file to send, relative to
-        ``directory``.
+    :param directory: The directory that ``path`` must be located under. This *must not*
+        be a value provided by the client, otherwise it becomes insecure.
+    :param path: The path to the file to send, relative to ``directory``. This is the
+        part of the path provided by the client, which is checked for security.
     :param environ: The WSGI environ for the current request.
     :param kwargs: Arguments to pass to :func:`send_file`.
 


Test patch:
Repository: pallets/werkzeug

Issue:
Increase default work factor for PBKDF2 to 600,000 iterations
https://github.com/pallets/werkzeug/blob/bba2109e276ab876b8d64e2b967412cb6da1d865/src/werkzeug/security.py#L12

The value has not been updated for a few years. I propose increasing it to the same number as the next release of Django will use.

See https://github.com/django/django/pull/16521 and https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2.


Discussion:

Resolving patch:
diff --git a/src/werkzeug/security.py b/src/werkzeug/security.py
--- a/src/werkzeug/security.py
+++ b/src/werkzeug/security.py
@@ -9,7 +9,7 @@
     pass
 
 SALT_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-DEFAULT_PBKDF2_ITERATIONS = 260000
+DEFAULT_PBKDF2_ITERATIONS = 600000
 
 _os_alt_seps: t.List[str] = list(
     sep for sep in [os.sep, os.path.altsep] if sep is not None and sep != "/"


Test patch:
diff --git a/tests/test_security.py b/tests/test_security.py
--- a/tests/test_security.py
+++ b/tests/test_security.py
@@ -11,7 +11,7 @@
 def test_password_hashing():
     hash0 = generate_password_hash("default")
     assert check_password_hash(hash0, "default")
-    assert hash0.startswith("pbkdf2:sha256:260000$")
+    assert hash0.startswith("pbkdf2:sha256:600000$")
 
     hash1 = generate_password_hash("default", "sha1")
     hash2 = generate_password_hash("default", method="sha1")
Repository: pallets/werkzeug

Issue:
Stream argument to ProfilerMiddleware is not typed hinted correctly
The profiler middleware `src/werkzeug/middleware/profiler.py:80` documentation and implementation states that the argument `stream` can be set to `None` to disable output.
 
However the type hints specifies `stream: t.IO[str] = sys.stdout,` which is inconsistent with the documentation and the implementation.

To replicate the issue run a type hint aware validator against something initiating a `ProfilerMiddleware` with the `stream` argument set to `None`:
```
ProfilerMiddleware(
    app,
    stream=None
)
```
It will cause an error stating that `None` is not an acceptable value for `stream`.

It's a minor and easy fix that I'm happy to provide a PR for if deemed acceptable with the proposed change:
```
stream: t.Union[t.IO[str], None] = sys.stdout,
```

Environment:

- Python version: 3.10
- Werkzeug version: 2.2.3



Discussion:
Happy to review a PR

Resolving patch:
diff --git a/src/werkzeug/middleware/profiler.py b/src/werkzeug/middleware/profiler.py
--- a/src/werkzeug/middleware/profiler.py
+++ b/src/werkzeug/middleware/profiler.py
@@ -77,7 +77,7 @@ class ProfilerMiddleware:
     def __init__(
         self,
         app: "WSGIApplication",
-        stream: t.IO[str] = sys.stdout,
+        stream: t.Union[t.IO[str], None] = sys.stdout,
         sort_by: t.Iterable[str] = ("time", "calls"),
         restrictions: t.Iterable[t.Union[str, int, float]] = (),
         profile_dir: t.Optional[str] = None,


Test patch:
Repository: pallets/werkzeug

Issue:
Authorization.from_header with "Token" scheme cannot handle base64 padding on tokens
# Steps to reproduce

```
import base64
from werkzeug.datastructures.auth import Authorization
token = base64.encodebytes(b"This has base64 padding").decode("utf-8").strip()
a = Authorization.from_header(f"Token {token}")
a.token
```

# Expected result

```
VGhpcyBoYXMgYmFzZTY0IHBhZGRpbmc=
```

# Actual behavior

A `NoneType` is returned.

Environment:

- Python version: `Python 3.11.2 (v3.11.2:878ead1ac1, Feb  7 2023, 10:02:41) [Clang 13.0.0 (clang-1300.0.29.30)] on darwin`
- Werkzeug version: 2.3.3 / `main`



Discussion:

Resolving patch:
diff --git a/src/werkzeug/datastructures/auth.py b/src/werkzeug/datastructures/auth.py
--- a/src/werkzeug/datastructures/auth.py
+++ b/src/werkzeug/datastructures/auth.py
@@ -112,13 +112,12 @@ def from_header(cls, value: str | None) -> te.Self | None:
 
             return cls(scheme, {"username": username, "password": password})
 
-        parameters = parse_dict_header(rest)
+        if "=" in rest.rstrip("="):
+            # = that is not trailing, this is parameters.
+            return cls(scheme, parse_dict_header(rest), None)
 
-        if len(parameters) == 1 and parameters[next(iter(parameters))] is None:
-            # There is one parameter with no value, was actually a token.
-            return cls(scheme, None, rest)
-
-        return cls(scheme, parameters, None)
+        # No = or only trailing =, this is a token.
+        return cls(scheme, None, rest)
 
     def to_header(self) -> str:
         """Produce an ``Authorization`` header value representing this data.


Test patch:
diff --git a/tests/test_http.py b/tests/test_http.py
--- a/tests/test_http.py
+++ b/tests/test_http.py
@@ -203,6 +203,19 @@ def test_authorization_header(self):
         assert Authorization.from_header(None) is None
         assert Authorization.from_header("foo").type == "foo"
 
+    def test_authorization_token_padding(self):
+        # padded with =
+        token = base64.b64encode(b"This has base64 padding").decode()
+        a = Authorization.from_header(f"Token {token}")
+        assert a.type == "token"
+        assert a.token == token
+
+        # padded with ==
+        token = base64.b64encode(b"This has base64 padding..").decode()
+        a = Authorization.from_header(f"Token {token}")
+        assert a.type == "token"
+        assert a.token == token
+
     def test_bad_authorization_header_encoding(self):
         """If the base64 encoded bytes can't be decoded as UTF-8"""
         content = base64.b64encode(b"\xffser:pass").decode()
Repository: pallets/werkzeug

Issue:
calls to `iri_to_uri` fails when the argument is a bytestring
Calls to `iri_to_uri` fails when the argument is a bytestring. Here's an example:

```console
>>> from werkzeug import urls
>>> urls.iri_to_uri(b'/foo')
<stdin>:1: DeprecationWarning: Passing bytes is deprecated and will not be supported in Werkzeug 3.0.
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/midchildan/Documents/playground/werkzeug/lib/python3.10/site-packages/werkzeug/urls.py", line 983, in iri_to_uri
    iri = iri.decode(charset)
TypeError: decode() argument 'encoding' must be str, not None
```

This is what should've happened instead:

```console
>>> from werkzeug import urls
>>> urls.iri_to_uri(b'/foo')
>>> '/foo'
```

Environment:

- Python version: 3.10.11
- Werkzeug version: 2.3.4



Discussion:

Resolving patch:
diff --git a/src/werkzeug/urls.py b/src/werkzeug/urls.py
--- a/src/werkzeug/urls.py
+++ b/src/werkzeug/urls.py
@@ -966,6 +966,16 @@ def iri_to_uri(
 
     .. versionadded:: 0.6
     """
+    if charset is not None:
+        warnings.warn(
+            "The 'charset' parameter is deprecated and will be removed"
+            " in Werkzeug 3.0.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+    else:
+        charset = "utf-8"
+
     if isinstance(iri, tuple):
         warnings.warn(
             "Passing a tuple is deprecated and will not be supported in Werkzeug 3.0.",
@@ -982,16 +992,6 @@ def iri_to_uri(
         )
         iri = iri.decode(charset)
 
-    if charset is not None:
-        warnings.warn(
-            "The 'charset' parameter is deprecated and will be removed"
-            " in Werkzeug 3.0.",
-            DeprecationWarning,
-            stacklevel=2,
-        )
-    else:
-        charset = "utf-8"
-
     if errors is not None:
         warnings.warn(
             "The 'errors' parameter is deprecated and will be removed in Werkzeug 3.0.",


Test patch:
diff --git a/tests/test_urls.py b/tests/test_urls.py
--- a/tests/test_urls.py
+++ b/tests/test_urls.py
@@ -229,6 +229,9 @@ def test_iri_support():
     with pytest.deprecated_call():
         assert urls.uri_to_iri(b"/foo") == "/foo"
 
+    with pytest.deprecated_call():
+        assert urls.iri_to_uri(b"/foo") == "/foo"
+
     assert urls.iri_to_uri("/foo") == "/foo"
 
     assert (
Repository: pallets/werkzeug

Issue:
authorization parsing should catch base64 errors
### Steps to reproduce
```
>>> from werkzeug.datastructures import Authorization
>>> Authorization.from_header("Basic foo")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/private/tmp/.venv/lib/python3.11/site-packages/werkzeug/datastructures/auth.py", line 109, in from_header
    username, _, password = base64.b64decode(rest).decode().partition(":")
                            ^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/python@3.11/3.11.3/Frameworks/Python.framework/Versions/3.11/lib/python3.11/base64.py", line 88, in b64decode
    return binascii.a2b_base64(s, strict_mode=validate)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
binascii.Error: Incorrect padding
```

### Expected behavior
I would expect Werkzeug to handle this situation and return `None`.

### Environment
- Python version: `3.11.3`
- Werkzeug version: `2.3.4`



Discussion:
I've updated the title to describe the actual issue you're asking to fix. Happy to review a PR.

Resolving patch:
diff --git a/src/werkzeug/datastructures/auth.py b/src/werkzeug/datastructures/auth.py
--- a/src/werkzeug/datastructures/auth.py
+++ b/src/werkzeug/datastructures/auth.py
@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import base64
+import binascii
 import typing as t
 import warnings
 from functools import wraps
@@ -107,7 +108,7 @@ def from_header(cls, value: str | None) -> te.Self | None:
         if scheme == "basic":
             try:
                 username, _, password = base64.b64decode(rest).decode().partition(":")
-            except UnicodeError:
+            except (binascii.Error, UnicodeError):
                 return None
 
             return cls(scheme, {"username": username, "password": password})


Test patch:
diff --git a/tests/test_http.py b/tests/test_http.py
--- a/tests/test_http.py
+++ b/tests/test_http.py
@@ -216,6 +216,9 @@ def test_authorization_token_padding(self):
         assert a.type == "token"
         assert a.token == token
 
+    def test_authorization_basic_incorrect_padding(self):
+        assert Authorization.from_header("Basic foo") is None
+
     def test_bad_authorization_header_encoding(self):
         """If the base64 encoded bytes can't be decoded as UTF-8"""
         content = base64.b64encode(b"\xffser:pass").decode()
Repository: pallets/werkzeug

Issue:
`FileStorage.content_length` raises `TypeError` if no length was provided
I'm trying to get a file size using property `content_length` of class `werkzeug.datastructures.FileStorage`, but getting an error
```
File ".../services/file.py", line 18, in save_web_file
    if file.content_length > (2**8) * (2**10) * 100:  # 100KB
  File ".../lib/python3.10/site-packages/werkzeug/datastructures/file_storage.py", line 71, in content_length
    return _plain_int(self.headers.get("content-length") or 0)
  File ".../lib/python3.10/site-packages/werkzeug/_internal.py", line 326, in _plain_int
    if _plain_int_re.fullmatch(value) is None:
TypeError: expected string or bytes-like object
```
To reproduce this, you need to POST file form without `content_length` 

To fix it, i think we need to change 0 as int to '0', because _plain_int expects value as str, not int, but when we haven't content-length header or have empty field, 0 as int will passed.
```python
@property
def content_length(self):
    """The content-length sent in the header.  Usually not available"""
    try:
        return _plain_int(self.headers.get("content-length") or 0) # here 0 -> '0'
    except ValueError:
        return 0
 ```

Environment:

- Python version: 3.10
- Flask version: 2.3.2



Discussion:

Resolving patch:
diff --git a/src/werkzeug/datastructures/file_storage.py b/src/werkzeug/datastructures/file_storage.py
--- a/src/werkzeug/datastructures/file_storage.py
+++ b/src/werkzeug/datastructures/file_storage.py
@@ -67,10 +67,13 @@ def content_type(self):
     @property
     def content_length(self):
         """The content-length sent in the header.  Usually not available"""
-        try:
-            return _plain_int(self.headers.get("content-length") or 0)
-        except ValueError:
-            return 0
+        if "content-length" in self.headers:
+            try:
+                return _plain_int(self.headers["content-length"])
+            except ValueError:
+                pass
+
+        return 0
 
     @property
     def mimetype(self):


Test patch: