getstream 7.1.0__tar.gz → 7.2.0__tar.gz

{getstream-7.1.0 → getstream-7.2.0}/.release-please-manifest.json

@@ -1,4 +1,4 @@
 {
-  ".": "7.1.0",
+  ".": "7.2.0",
   "getstream-rtc": "0.1.0"
 }

{getstream-7.1.0 → getstream-7.2.0}/CHANGELOG.md

@@ -7,6 +7,19 @@ Entries from 6.1.1 on are generated by release-please from commit messages; earl
 ones were written by hand in the [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 format.
 
+## [7.2.0](https://github.com/GetStream/stream-py/compare/v7.1.0...v7.2.0) (2026-11-12)
+
+
+### Features
+
+* **moderation:** add `expected_value` to `UserCustomPropertyParameters`, `CallCustomPropertyParameters`, `ContentCustomPropertyParameters` and `ContentCustomPropertyCountParameters`, so value-operator custom-property rules can be set ([138e50a](https://github.com/GetStream/stream-py/commit/138e50ad2a713a85eef61508d6cf854d64692460))
+
+
+### Bug Fixes
+
+* cap decompressed gzip webhook bodies at 10 MiB (`getstream.webhook.MAX_WEBHOOK_PAYLOAD_BYTES`) and reject data after the gzip stream, because decompression runs before the signature check ([138e50a](https://github.com/GetStream/stream-py/commit/138e50ad2a713a85eef61508d6cf854d64692460))
+* stop double-encoding list query parameters ([#306](https://github.com/GetStream/stream-py/issues/306)) ([a584118](https://github.com/GetStream/stream-py/commit/a584118a15db9bd60b7daf571fa13d52e459b6d2)), closes [#305](https://github.com/GetStream/stream-py/issues/305)
+
 ## [7.1.0](https://github.com/GetStream/stream-py/compare/v7.0.0...v7.1.0) (2026-11-04)
 
 

{getstream-7.1.0 → getstream-7.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: getstream
-Version: 7.1.0
+Version: 7.2.0
 Summary: GetStream Python SDK - Build scalable activity feeds, chat, and video calling applications
 Author-email: sachaarbonel <sacha.arbonel@hotmail.fr>, tbarbugli <tbarbugli@gmail.com>
 License-File: LICENSE.md

{getstream-7.1.0 → getstream-7.2.0}/getstream/models/__init__.py

@@ -3927,6 +3927,9 @@ class CallCreatedEvent(DataClassJsonMixin):
 
 @dataclass
 class CallCustomPropertyParameters(DataClassJsonMixin):
+    expected_value: object | None = dc_field(
+        default=None, metadata=dc_config(field_name="expected_value")
+    )
     operator: str | None = dc_field(
         default=None, metadata=dc_config(field_name="operator")
     )
@@ -9268,6 +9271,9 @@ class ContentCountRuleParameters(DataClassJsonMixin):
 
 @dataclass
 class ContentCustomPropertyCountParameters(DataClassJsonMixin):
+    expected_value: object | None = dc_field(
+        default=None, metadata=dc_config(field_name="expected_value")
+    )
     operator: str | None = dc_field(
         default=None, metadata=dc_config(field_name="operator")
     )
@@ -9284,6 +9290,9 @@ class ContentCustomPropertyCountParameters(DataClassJsonMixin):
 
 @dataclass
 class ContentCustomPropertyParameters(DataClassJsonMixin):
+    expected_value: object | None = dc_field(
+        default=None, metadata=dc_config(field_name="expected_value")
+    )
     operator: str | None = dc_field(
         default=None, metadata=dc_config(field_name="operator")
     )
@@ -30303,6 +30312,9 @@ class UserCustomEventRequest(DataClassJsonMixin):
 
 @dataclass
 class UserCustomPropertyParameters(DataClassJsonMixin):
+    expected_value: object | None = dc_field(
+        default=None, metadata=dc_config(field_name="expected_value")
+    )
     operator: str | None = dc_field(
         default=None, metadata=dc_config(field_name="operator")
     )

{getstream-7.1.0 → getstream-7.2.0}/getstream/tests/test_webhook.py

@@ -1,6 +1,7 @@
 # Code generated by GetStream internal OpenAPI code generator. DO NOT EDIT.
 
 import hashlib
+import gzip
 import hmac
 import warnings
 from pathlib import Path
@@ -11,6 +12,7 @@ from getstream.webhook import (
     InvalidWebhookError,
     UnknownEvent,
     get_event_type,
+    gunzip_payload,
     parse_event,
     parse_sns,
     parse_sqs,
@@ -1261,6 +1263,16 @@ class TestWebhookConformanceNegative:
         with pytest.raises(InvalidWebhookError, match=InvalidWebhookError.GZIP_FAILED):
             verify_and_parse_webhook(body, sig, CANONICAL_TEST_SECRET)
 
+    def test_oversized_compression(self):
+        body = _read_bytes(self._neg("oversized_compression") / "body.gz")
+        sig = _read_str(self._neg("oversized_compression") / "signature.txt")
+        with pytest.raises(InvalidWebhookError, match="payload exceeds"):
+            verify_and_parse_webhook(body, sig, CANONICAL_TEST_SECRET)
+
+    def test_trailing_data_after_gzip(self):
+        with pytest.raises(InvalidWebhookError, match="trailing data"):
+            gunzip_payload(gzip.compress(b"{}") + b"XYZ")
+
     def test_bad_base64(self):
         # Per CHA-3071 wire format: decode_sqs_payload falls back to raw bytes when
         # base64 decoding fails (uncompressed wire format). For input that is

{getstream-7.1.0 → getstream-7.2.0}/getstream/utils/__init__.py

@@ -2,7 +2,6 @@ import enum
 import json
 import asyncio
 from typing import Dict, List, Optional, Union, cast
-from urllib.parse import quote
 from datetime import datetime
 from datetime import timezone
 from urllib.parse import urlparse, urlunparse
@@ -120,7 +119,7 @@ def build_query_param(**kwargs):
     - JSON-serializable objects with a `to_json` method will be serialized using that method.
     - datetime objects are converted to ISO 8601 strings.
     - Booleans are converted to lowercase strings.
-    - Lists are converted to comma-separated strings with URL-encoded values.
+    - Lists are converted to comma-separated strings.
     - Other types (strings, integers, dictionaries) are handled appropriately.
 
     Args:
@@ -142,7 +141,7 @@ def build_query_param(**kwargs):
         elif isinstance(value, (str, int)):
             params[key] = str(value)
         elif isinstance(value, list):
-            params[key] = ",".join(quote(_serialize_query_value(v)) for v in value)
+            params[key] = ",".join(_serialize_query_value(v) for v in value)
         else:
             # For dictionaries or any other types of objects
             params[key] = json.dumps(value)
@@ -158,7 +157,7 @@ async def build_query_param_async(**kwargs):
     This function handles various data types:
     - JSON-serializable objects with a `to_json` method will be serialized using that method.
     - Booleans are converted to lowercase strings.
-    - Lists are converted to comma-separated strings with URL-encoded values.
+    - Lists are converted to comma-separated strings.
     - Other types (strings, integers, dictionaries) are handled appropriately.
 
     Args:

{getstream-7.1.0 → getstream-7.2.0}/getstream/webhook.py

@@ -1,7 +1,6 @@
 # Code generated by GetStream internal OpenAPI code generator. DO NOT EDIT.
 
 import base64
-import gzip
 import hashlib
 import hmac
 import json
@@ -650,6 +649,11 @@ def verify_webhook_signature(body: bytes | str, signature: str, secret: str) ->
 
 _GZIP_MAGIC = b"\x1f\x8b"
 
+# Caps the decompressed size of a gzip webhook body. gunzip_payload runs before
+# the signature check, so without a cap an unsigned gzip bomb could exhaust
+# memory. Raise it if your events are larger.
+MAX_WEBHOOK_PAYLOAD_BYTES = 10 * 1024 * 1024
+
 
 def gunzip_payload(body: bytes) -> bytes:
     """Decompress body if gzip-prefixed, else pass through.
@@ -658,13 +662,8 @@ def gunzip_payload(body: bytes) -> bytes:
     Stream webhook bodies are always JSON, and JSON cannot start with 0x1F.
 
     Raises InvalidWebhookError if body has the gzip magic prefix but isn't a
-    valid gzip stream. gzip.decompress can fail with at least three different
-    exception types depending on where decoding breaks:
-      * gzip.BadGzipFile (subclass of OSError) - malformed header.
-      * zlib.error                              - corrupt compressed stream.
-      * EOFError                                - stream truncated mid-block.
-    The first is OSError-derived; the latter two are not. Catch all three so
-    every "looks like gzip but isn't" failure mode surfaces as InvalidWebhookError.
+    valid gzip stream (corrupt or truncated), or decompresses to more than
+    MAX_WEBHOOK_PAYLOAD_BYTES.
     """
     if not isinstance(body, (bytes, bytearray)):
         raise InvalidWebhookError(
@@ -672,10 +671,25 @@ def gunzip_payload(body: bytes) -> bytes:
         )
     if len(body) < 2 or bytes(body[:2]) != _GZIP_MAGIC:
         return bytes(body)
+    limit = MAX_WEBHOOK_PAYLOAD_BYTES
+    decompressor = zlib.decompressobj(wbits=31)
     try:
-        return gzip.decompress(bytes(body))
-    except (OSError, zlib.error, EOFError) as e:
+        out = decompressor.decompress(bytes(body), limit + 1)
+    except zlib.error as e:
         raise InvalidWebhookError(f"{InvalidWebhookError.GZIP_FAILED}: {e}") from e
+    if len(out) > limit:
+        raise InvalidWebhookError(
+            f"{InvalidWebhookError.GZIP_FAILED}: payload exceeds {limit} bytes"
+        )
+    if not decompressor.eof:
+        raise InvalidWebhookError(
+            f"{InvalidWebhookError.GZIP_FAILED}: truncated gzip stream"
+        )
+    if decompressor.unused_data:
+        raise InvalidWebhookError(
+            f"{InvalidWebhookError.GZIP_FAILED}: trailing data after gzip stream"
+        )
+    return out
 
 
 def decode_sqs_payload(message_body: str) -> bytes:

{getstream-7.1.0 → getstream-7.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "getstream"
-version = "7.1.0"
+version = "7.2.0"
 description = "GetStream Python SDK - Build scalable activity feeds, chat, and video calling applications"
 authors = [
     { name = "sachaarbonel", email = "sacha.arbonel@hotmail.fr" },

{getstream-7.1.0 → getstream-7.2.0}/uv.lock

@@ -863,7 +863,7 @@ wheels = [
 
 [[package]]
 name = "getstream"
-version = "7.1.0"
+version = "7.2.0"
 source = { editable = "." }
 dependencies = [
     { name = "dataclasses-json" },