silentparams 0.1.0__tar.gz

silentparams-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 novasdiego1
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

silentparams-0.1.0/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: silentparams
+Version: 0.1.0
+Summary: Find HTTP APIs that silently ignore misspelled query parameters
+Author: novasdiego1
+License: MIT
+Project-URL: Homepage, https://github.com/novasdiego1/silentparams
+Project-URL: Issues, https://github.com/novasdiego1/silentparams/issues
+Keywords: api,http,testing,query parameters,silent failures,ci
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# silentparams
+
+Find HTTP APIs that silently ignore misspelled query parameters.
+
+You call `GET /issues?states=closed`. The API only knows `state`. It does not
+answer "unknown parameter": it answers **200 with every open issue**, and your
+code (or your agent) believes it filtered. Nothing failed, so nothing alerts.
+
+`silentparams` sends a handful of read-only requests with plausible misspellings
+of each parameter in your URL and tells you, per name, whether the API rejects
+it, accepts it as an alias, or ignores it without a word.
+
+```console
+$ silentparams "https://api.github.com/repos/python/cpython/issues?state=closed&per_page=3"
+Parameter 'state=closed': removing it changes the response
+  states                   HTTP 200  IGNORED silently (2xx, same as without the parameter)
+  STATE                    HTTP 200  IGNORED silently (2xx, same as without the parameter)
+  zzb22fbb9f               HTTP 200  IGNORED silently (2xx, same as without the parameter)
+...
+RESULT: this API silently ignores unknown parameter names. A typo in a filter returns unfiltered data with HTTP 200.
+```
+
+That is not a bug in GitHub. Ignoring unknown parameters is a common design
+choice. It just means **a typo in your client is invisible**, so you should know
+which APIs behave this way before you trust a filtered result.
+
+## Install
+
+```console
+pip install silentparams   # no dependencies, Python 3.10+
+# or the latest code: pip install git+https://github.com/novasdiego1/silentparams
+```
+
+## How it works
+
+For each query parameter `p` in the URL:
+
+| Request | Purpose |
+|---|---|
+| the URL as given, twice | baseline, and a check that the response is stable |
+| the URL without `p` | what the API returns when `p` is absent |
+| `p` renamed (plural/singular, trailing `_`, case, `snake`/`kebab`/`camel`, doubled letter) and one nonsense name | the decoys |
+
+Each decoy is classified by comparing normalized response bodies (JSON is
+canonicalized, so key order does not matter):
+
+| Verdict | Meaning |
+|---|---|
+| `IGNORED silently` | 2xx and the same response as without `p`: the name was dropped without a word |
+| `rejected` | 4xx: the API refuses unknown names (the safe behaviour) |
+| `alias` | 2xx and the same response as the baseline: the variant is accepted |
+| `different` | 2xx with some other response: inconclusive |
+
+It also tells you when removing `p` changes nothing, which usually means `p`
+itself is being ignored.
+
+## Options
+
+```text
+-H 'Name: value'     extra header (repeatable), e.g. an Authorization token
+--ignore-key KEY     JSON key to ignore when comparing (timestamps, request ids)
+--decoys N           decoy names per parameter (default 6)
+--max-requests N     hard cap on requests sent (default 60)
+--delay S            seconds between requests (default 0.5)
+--json               machine-readable report
+```
+
+Exit code: `1` if the API silently ignores unknown names, `0` if not, `2` on
+usage errors. That makes it usable as a CI check for an API you own.
+
+If the same request returns different bodies (a timestamp, a request id), the
+report warns that results are unreliable: add `--ignore-key` for those fields.
+
+## Be polite
+
+It only sends `GET` requests, waits between them, and stops at
+`--max-requests`. Point it at APIs you are allowed to query, and mind their
+rate limits.
+
+## Why this exists
+
+An auditor reported reaching a wrong conclusion this way. They tried four
+spellings of a per-author filter (`author`, `agent`, `agent_id`, `pubkey`) on an
+API that only declared `authors`. Every request returned 200 with unfiltered
+rows, so they wrote that no such filter existed. The same API rejected a bad
+`limit` value with 422: it checked values carefully and never checked names.
+
+## License
+
+MIT

silentparams-0.1.0/README.md

@@ -0,0 +1,90 @@
+# silentparams
+
+Find HTTP APIs that silently ignore misspelled query parameters.
+
+You call `GET /issues?states=closed`. The API only knows `state`. It does not
+answer "unknown parameter": it answers **200 with every open issue**, and your
+code (or your agent) believes it filtered. Nothing failed, so nothing alerts.
+
+`silentparams` sends a handful of read-only requests with plausible misspellings
+of each parameter in your URL and tells you, per name, whether the API rejects
+it, accepts it as an alias, or ignores it without a word.
+
+```console
+$ silentparams "https://api.github.com/repos/python/cpython/issues?state=closed&per_page=3"
+Parameter 'state=closed': removing it changes the response
+  states                   HTTP 200  IGNORED silently (2xx, same as without the parameter)
+  STATE                    HTTP 200  IGNORED silently (2xx, same as without the parameter)
+  zzb22fbb9f               HTTP 200  IGNORED silently (2xx, same as without the parameter)
+...
+RESULT: this API silently ignores unknown parameter names. A typo in a filter returns unfiltered data with HTTP 200.
+```
+
+That is not a bug in GitHub. Ignoring unknown parameters is a common design
+choice. It just means **a typo in your client is invisible**, so you should know
+which APIs behave this way before you trust a filtered result.
+
+## Install
+
+```console
+pip install silentparams   # no dependencies, Python 3.10+
+# or the latest code: pip install git+https://github.com/novasdiego1/silentparams
+```
+
+## How it works
+
+For each query parameter `p` in the URL:
+
+| Request | Purpose |
+|---|---|
+| the URL as given, twice | baseline, and a check that the response is stable |
+| the URL without `p` | what the API returns when `p` is absent |
+| `p` renamed (plural/singular, trailing `_`, case, `snake`/`kebab`/`camel`, doubled letter) and one nonsense name | the decoys |
+
+Each decoy is classified by comparing normalized response bodies (JSON is
+canonicalized, so key order does not matter):
+
+| Verdict | Meaning |
+|---|---|
+| `IGNORED silently` | 2xx and the same response as without `p`: the name was dropped without a word |
+| `rejected` | 4xx: the API refuses unknown names (the safe behaviour) |
+| `alias` | 2xx and the same response as the baseline: the variant is accepted |
+| `different` | 2xx with some other response: inconclusive |
+
+It also tells you when removing `p` changes nothing, which usually means `p`
+itself is being ignored.
+
+## Options
+
+```text
+-H 'Name: value'     extra header (repeatable), e.g. an Authorization token
+--ignore-key KEY     JSON key to ignore when comparing (timestamps, request ids)
+--decoys N           decoy names per parameter (default 6)
+--max-requests N     hard cap on requests sent (default 60)
+--delay S            seconds between requests (default 0.5)
+--json               machine-readable report
+```
+
+Exit code: `1` if the API silently ignores unknown names, `0` if not, `2` on
+usage errors. That makes it usable as a CI check for an API you own.
+
+If the same request returns different bodies (a timestamp, a request id), the
+report warns that results are unreliable: add `--ignore-key` for those fields.
+
+## Be polite
+
+It only sends `GET` requests, waits between them, and stops at
+`--max-requests`. Point it at APIs you are allowed to query, and mind their
+rate limits.
+
+## Why this exists
+
+An auditor reported reaching a wrong conclusion this way. They tried four
+spellings of a per-author filter (`author`, `agent`, `agent_id`, `pubkey`) on an
+API that only declared `authors`. Every request returned 200 with unfiltered
+rows, so they wrote that no such filter existed. The same API rejected a bad
+`limit` value with 422: it checked values carefully and never checked names.
+
+## License
+
+MIT

silentparams-0.1.0/pyproject.toml

@@ -0,0 +1,41 @@
+[build-system]
+requires = ["setuptools>=69"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "silentparams"
+version = "0.1.0"
+description = "Find HTTP APIs that silently ignore misspelled query parameters"
+readme = "README.md"
+requires-python = ">=3.10"
+license = {text = "MIT"}
+authors = [{name = "novasdiego1"}]
+keywords = ["api", "http", "testing", "query parameters", "silent failures", "ci"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Internet :: WWW/HTTP",
+    "Topic :: Software Development :: Testing",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/novasdiego1/silentparams"
+Issues = "https://github.com/novasdiego1/silentparams/issues"
+
+[project.scripts]
+silentparams = "silentparams.cli:main"
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]
+testpaths = ["tests"]
+
+[tool.ruff]
+line-length = 120
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "UP", "B", "SIM"]

silentparams-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

silentparams-0.1.0/src/silentparams/__init__.py

@@ -0,0 +1,2 @@
+"""Find HTTP APIs that silently ignore misspelled query parameters."""
+__version__ = "0.1.0"

silentparams-0.1.0/src/silentparams/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from silentparams.cli import main
+
+sys.exit(main())

silentparams-0.1.0/src/silentparams/cli.py

@@ -0,0 +1,76 @@
+"""Command line: silentparams URL [-H 'Name: value'] [--json]."""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from dataclasses import asdict
+
+from silentparams import __version__
+from silentparams.core import Report, http_fetch, probe
+
+VERDICT_TEXT = {
+    "ignored": "IGNORED silently (2xx, same as without the parameter)",
+    "rejected": "rejected (4xx)",
+    "alias": "accepted as an alias",
+    "different": "2xx, different response (inconclusive)",
+    "error": "server error or no response",
+}
+
+
+def render(report: Report) -> str:
+    lines = [f"URL: {report.url}", f"Baseline: HTTP {report.baseline.status}, {report.baseline.size} bytes"
+             + (f", {report.baseline.items} items" if report.baseline.items is not None else ""),
+             f"Requests sent: {report.requests}"]
+    if not report.stable:
+        lines.append("WARNING: the same request gave two different responses. Results are unreliable; "
+                     "use --ignore-key for volatile fields (timestamps, request ids).")
+    for p in report.params:
+        effect = "changes the response" if p.effective else "does NOT change the response (ignored or no-op?)"
+        lines += ["", f"Parameter '{p.name}={p.value}': removing it {effect}"]
+        for d in p.decoys:
+            lines.append(f"  {d.name:<24} HTTP {d.response.status:<4} {VERDICT_TEXT[d.verdict]}")
+    verdict = report.ignores_unknown_names
+    lines.append("")
+    if verdict is True:
+        lines.append("RESULT: this API silently ignores unknown parameter names. A typo in a filter returns "
+                     "unfiltered data with HTTP 200.")
+    elif verdict is False:
+        lines.append("RESULT: this API rejects unknown parameter names. Typos fail loudly.")
+    else:
+        lines.append("RESULT: inconclusive. See the per-decoy lines above.")
+    return "\n".join(lines)
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(prog="silentparams", description=__doc__)
+    ap.add_argument("url", help="a GET URL with at least one query parameter")
+    ap.add_argument("-H", "--header", action="append", default=[], help="extra header, 'Name: value'")
+    ap.add_argument("--decoys", type=int, default=6, help="decoy names per parameter (default 6)")
+    ap.add_argument("--max-requests", type=int, default=60, help="hard cap on requests sent (default 60)")
+    ap.add_argument("--delay", type=float, default=0.5, help="seconds between requests (default 0.5)")
+    ap.add_argument("--ignore-key", action="append", default=[], help="JSON key to ignore when comparing")
+    ap.add_argument("--json", action="store_true", help="machine-readable output")
+    ap.add_argument("--version", action="version", version=__version__)
+    args = ap.parse_args(argv)
+    headers = {}
+    for h in args.header:
+        name, sep, value = h.partition(":")
+        if not sep:
+            ap.error(f"bad header {h!r}; use 'Name: value'")
+        headers[name.strip()] = value.strip()
+    try:
+        report = probe(args.url, http_fetch(headers), decoys_per_param=args.decoys,
+                       max_requests=args.max_requests, delay=args.delay, ignore_keys=args.ignore_key)
+    except (ValueError, RuntimeError) as exc:
+        print(f"silentparams: {exc}", file=sys.stderr)
+        return 2
+    if args.json:
+        print(json.dumps({**asdict(report), "ignores_unknown_names": report.ignores_unknown_names}, indent=2))
+    else:
+        print(render(report))
+    return 1 if report.ignores_unknown_names else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

silentparams-0.1.0/src/silentparams/core.py

@@ -0,0 +1,232 @@
+"""Probe an HTTP API for query parameters it silently ignores.
+
+The failure this catches: a client sends `?author=alice` to an API that only
+knows `authors`. Instead of rejecting the unknown name, the API answers 200
+with the unfiltered result, and the client believes it filtered.
+
+Method, per query parameter in the URL you give:
+
+1. baseline  - the URL as given.
+2. without   - the same URL with that parameter removed.
+3. decoys    - the parameter renamed (typos, plural/singular, case, separators)
+               and one nonsense name, each with the same value.
+
+A decoy that answers 2xx with the same response as `without` was ignored
+silently. A decoy answered with 4xx was rejected (the safe behaviour). A decoy
+that answers like `baseline` is an accepted alias.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import secrets
+import time
+import urllib.error
+import urllib.request
+from collections.abc import Callable, Iterable
+from dataclasses import dataclass, field
+from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
+
+USER_AGENT = "silentparams/0.1 (read-only API probe)"
+
+
+@dataclass(frozen=True)
+class Response:
+    status: int
+    fingerprint: str  # hash of the normalized body
+    size: int
+    items: int | None = None  # number of records, when the body is a JSON list or wraps one
+
+
+@dataclass
+class DecoyResult:
+    name: str
+    response: Response
+    verdict: str  # "ignored", "rejected", "alias", "different", "error"
+
+
+@dataclass
+class ParamReport:
+    name: str
+    value: str
+    effective: bool  # removing it changes the response
+    without: Response
+    decoys: list[DecoyResult] = field(default_factory=list)
+
+    @property
+    def silently_ignored(self) -> list[str]:
+        return [d.name for d in self.decoys if d.verdict == "ignored"]
+
+
+@dataclass
+class Report:
+    url: str
+    baseline: Response
+    stable: bool  # the same request twice gave the same response
+    params: list[ParamReport]
+    requests: int
+
+    @property
+    def ignores_unknown_names(self) -> bool | None:
+        """True if any decoy was silently ignored, False if all were rejected, None if inconclusive."""
+        verdicts = [d.verdict for p in self.params for d in p.decoys]
+        if "ignored" in verdicts:
+            return True
+        if verdicts and all(v == "rejected" for v in verdicts):
+            return False
+        return None
+
+
+# --- Decoy names ------------------------------------------------------------------------------
+
+def _split_words(name: str) -> list[str]:
+    out, word = [], ""
+    for ch in name:
+        if ch in "_-.":
+            if word:
+                out.append(word)
+            word = ""
+        elif ch.isupper() and word and not word[-1].isupper():
+            out.append(word)
+            word = ch
+        else:
+            word += ch
+    if word:
+        out.append(word)
+    return [w.lower() for w in out]
+
+
+def decoy_names(name: str, limit: int = 6, rng: Callable[[int], str] = secrets.token_hex) -> list[str]:
+    """Plausible mistakes for `name`, most likely first, plus one nonsense name. Never returns `name`."""
+    words = _split_words(name) or [name.lower()]
+    candidates = [
+        name[:-1] if name.endswith("s") and len(name) > 2 else name + "s",  # authors <-> author
+        name + "_" if not name.endswith("_") else name.rstrip("_"),
+        name.upper() if name != name.upper() else name.lower(),
+        "_".join(words),
+        "-".join(words),
+        words[0] + "".join(w.capitalize() for w in words[1:]),  # camelCase
+        name[:-1] + name[-1] * 2 if len(name) > 1 else name * 2,  # doubled last letter
+    ]
+    seen, out = {name}, []
+    for c in candidates:
+        if c and c not in seen:
+            seen.add(c)
+            out.append(c)
+    out = out[: max(limit - 1, 0)]
+    out.append("zz" + rng(4))  # nonsense: no API should know it
+    return out
+
+
+# --- HTTP -------------------------------------------------------------------------------------
+
+def normalize(body: bytes, content_type: str, ignore_keys: Iterable[str] = ()) -> tuple[str, int | None]:
+    """Fingerprint a body. JSON is canonicalized and volatile keys dropped; anything else is hashed as is."""
+    ignore = set(ignore_keys)
+    items = None
+    if "json" in content_type or body[:1] in (b"{", b"["):
+        try:
+            data = json.loads(body)
+        except ValueError:
+            data = None
+        if data is not None:
+            def strip(x):
+                if isinstance(x, dict):
+                    return {k: strip(v) for k, v in x.items() if k not in ignore}
+                if isinstance(x, list):
+                    return [strip(v) for v in x]
+                return x
+            data = strip(data)
+            if isinstance(data, list):
+                items = len(data)
+            elif isinstance(data, dict):
+                lists = [v for v in data.values() if isinstance(v, list)]
+                if len(lists) == 1:
+                    items = len(lists[0])
+            body = json.dumps(data, sort_keys=True, separators=(",", ":")).encode()
+    return hashlib.sha256(body).hexdigest()[:16], items
+
+
+Fetcher = Callable[[str], tuple[int, bytes, str]]
+
+
+def http_fetch(headers: dict[str, str] | None = None, timeout: float = 20.0) -> Fetcher:
+    """A GET-only fetcher. Returns (status, body, content-type); HTTP errors are answers, not exceptions."""
+    base = {"User-Agent": USER_AGENT, "Accept": "application/json, */*;q=0.5", **(headers or {})}
+
+    def fetch(url: str) -> tuple[int, bytes, str]:
+        req = urllib.request.Request(url, headers=base, method="GET")
+        try:
+            with urllib.request.urlopen(req, timeout=timeout) as r:
+                return r.status, r.read(), r.headers.get("Content-Type", "")
+        except urllib.error.HTTPError as e:
+            return e.code, e.read(), e.headers.get("Content-Type", "") if e.headers else ""
+
+    return fetch
+
+
+def with_params(url: str, params: list[tuple[str, str]]) -> str:
+    parts = urlsplit(url)
+    return urlunsplit(parts._replace(query=urlencode(params)))
+
+
+# --- Probe ------------------------------------------------------------------------------------
+
+def classify(decoy: Response, baseline: Response, without: Response) -> str:
+    if decoy.status >= 500 or decoy.status == 0:
+        return "error"
+    if 400 <= decoy.status < 500:
+        return "rejected"
+    same_as_without = decoy.fingerprint == without.fingerprint
+    same_as_baseline = decoy.fingerprint == baseline.fingerprint
+    if same_as_baseline and not same_as_without:
+        return "alias"
+    if same_as_without:
+        return "ignored"
+    return "different"
+
+
+def probe(
+    url: str,
+    fetch: Fetcher,
+    *,
+    decoys_per_param: int = 6,
+    max_requests: int = 60,
+    delay: float = 0.5,
+    ignore_keys: Iterable[str] = (),
+    rng: Callable[[int], str] = secrets.token_hex,
+) -> Report:
+    params = parse_qsl(urlsplit(url).query, keep_blank_values=True)
+    if not params:
+        raise ValueError("the URL has no query parameters to probe")
+    ignore = list(ignore_keys)
+    count = 0
+
+    def get(u: str) -> Response:
+        nonlocal count
+        if count >= max_requests:
+            raise RuntimeError(f"request budget exhausted ({max_requests}); raise --max-requests")
+        if count and delay:
+            time.sleep(delay)
+        count += 1
+        try:
+            status, body, ctype = fetch(u)
+        except OSError:
+            return Response(0, "", 0)
+        fp, items = normalize(body, ctype, ignore)
+        return Response(status, fp, len(body), items)
+
+    baseline = get(url)
+    stable = get(url).fingerprint == baseline.fingerprint
+    reports = []
+    for i, (name, value) in enumerate(params):
+        rest = params[:i] + params[i + 1:]
+        without = get(with_params(url, rest))
+        report = ParamReport(name, value, effective=without.fingerprint != baseline.fingerprint, without=without)
+        for decoy in decoy_names(name, decoys_per_param, rng):
+            if any(decoy == n for n, _ in params):
+                continue
+            r = get(with_params(url, rest[:i] + [(decoy, value)] + rest[i:]))
+            report.decoys.append(DecoyResult(decoy, r, classify(r, baseline, without)))
+        reports.append(report)
+    return Report(url, baseline, stable, reports, count)

silentparams-0.1.0/src/silentparams.egg-info/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: silentparams
+Version: 0.1.0
+Summary: Find HTTP APIs that silently ignore misspelled query parameters
+Author: novasdiego1
+License: MIT
+Project-URL: Homepage, https://github.com/novasdiego1/silentparams
+Project-URL: Issues, https://github.com/novasdiego1/silentparams/issues
+Keywords: api,http,testing,query parameters,silent failures,ci
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# silentparams
+
+Find HTTP APIs that silently ignore misspelled query parameters.
+
+You call `GET /issues?states=closed`. The API only knows `state`. It does not
+answer "unknown parameter": it answers **200 with every open issue**, and your
+code (or your agent) believes it filtered. Nothing failed, so nothing alerts.
+
+`silentparams` sends a handful of read-only requests with plausible misspellings
+of each parameter in your URL and tells you, per name, whether the API rejects
+it, accepts it as an alias, or ignores it without a word.
+
+```console
+$ silentparams "https://api.github.com/repos/python/cpython/issues?state=closed&per_page=3"
+Parameter 'state=closed': removing it changes the response
+  states                   HTTP 200  IGNORED silently (2xx, same as without the parameter)
+  STATE                    HTTP 200  IGNORED silently (2xx, same as without the parameter)
+  zzb22fbb9f               HTTP 200  IGNORED silently (2xx, same as without the parameter)
+...
+RESULT: this API silently ignores unknown parameter names. A typo in a filter returns unfiltered data with HTTP 200.
+```
+
+That is not a bug in GitHub. Ignoring unknown parameters is a common design
+choice. It just means **a typo in your client is invisible**, so you should know
+which APIs behave this way before you trust a filtered result.
+
+## Install
+
+```console
+pip install silentparams   # no dependencies, Python 3.10+
+# or the latest code: pip install git+https://github.com/novasdiego1/silentparams
+```
+
+## How it works
+
+For each query parameter `p` in the URL:
+
+| Request | Purpose |
+|---|---|
+| the URL as given, twice | baseline, and a check that the response is stable |
+| the URL without `p` | what the API returns when `p` is absent |
+| `p` renamed (plural/singular, trailing `_`, case, `snake`/`kebab`/`camel`, doubled letter) and one nonsense name | the decoys |
+
+Each decoy is classified by comparing normalized response bodies (JSON is
+canonicalized, so key order does not matter):
+
+| Verdict | Meaning |
+|---|---|
+| `IGNORED silently` | 2xx and the same response as without `p`: the name was dropped without a word |
+| `rejected` | 4xx: the API refuses unknown names (the safe behaviour) |
+| `alias` | 2xx and the same response as the baseline: the variant is accepted |
+| `different` | 2xx with some other response: inconclusive |
+
+It also tells you when removing `p` changes nothing, which usually means `p`
+itself is being ignored.
+
+## Options
+
+```text
+-H 'Name: value'     extra header (repeatable), e.g. an Authorization token
+--ignore-key KEY     JSON key to ignore when comparing (timestamps, request ids)
+--decoys N           decoy names per parameter (default 6)
+--max-requests N     hard cap on requests sent (default 60)
+--delay S            seconds between requests (default 0.5)
+--json               machine-readable report
+```
+
+Exit code: `1` if the API silently ignores unknown names, `0` if not, `2` on
+usage errors. That makes it usable as a CI check for an API you own.
+
+If the same request returns different bodies (a timestamp, a request id), the
+report warns that results are unreliable: add `--ignore-key` for those fields.
+
+## Be polite
+
+It only sends `GET` requests, waits between them, and stops at
+`--max-requests`. Point it at APIs you are allowed to query, and mind their
+rate limits.
+
+## Why this exists
+
+An auditor reported reaching a wrong conclusion this way. They tried four
+spellings of a per-author filter (`author`, `agent`, `agent_id`, `pubkey`) on an
+API that only declared `authors`. Every request returned 200 with unfiltered
+rows, so they wrote that no such filter existed. The same API rejected a bad
+`limit` value with 422: it checked values carefully and never checked names.
+
+## License
+
+MIT

silentparams-0.1.0/src/silentparams.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/silentparams/__init__.py
+src/silentparams/__main__.py
+src/silentparams/cli.py
+src/silentparams/core.py
+src/silentparams.egg-info/PKG-INFO
+src/silentparams.egg-info/SOURCES.txt
+src/silentparams.egg-info/dependency_links.txt
+src/silentparams.egg-info/entry_points.txt
+src/silentparams.egg-info/top_level.txt
+tests/test_probe.py

silentparams-0.1.0/src/silentparams.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

silentparams-0.1.0/src/silentparams.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+silentparams = silentparams.cli:main

silentparams-0.1.0/src/silentparams.egg-info/top_level.txt

@@ -0,0 +1 @@
+silentparams

silentparams-0.1.0/tests/test_probe.py

@@ -0,0 +1,117 @@
+"""End-to-end tests against a local server with one lax and one strict endpoint.
+
+The lax endpoint reproduces the case that motivated the tool: it knows `authors`
+and `limit`, validates their values, and silently drops any other name.
+"""
+import json
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import parse_qsl, urlsplit
+
+import pytest
+
+from silentparams.cli import main
+from silentparams.core import Response, classify, decoy_names, http_fetch, normalize, probe
+
+ROWS = [{"id": i, "author": ("alice" if i % 2 else "bob")} for i in range(10)]
+KNOWN = {"authors", "limit"}
+
+
+class Handler(BaseHTTPRequestHandler):
+    def log_message(self, *args):
+        pass
+
+    def do_GET(self):
+        parts = urlsplit(self.path)
+        q = dict(parse_qsl(parts.query))
+        if parts.path == "/strict" and set(q) - KNOWN:
+            return self._send(422, {"error": f"unknown parameter: {sorted(set(q) - KNOWN)[0]}"})
+        rows = ROWS
+        if "authors" in q:
+            rows = [r for r in rows if r["author"] in q["authors"].split(",")]
+        if "limit" in q:
+            if not q["limit"].isdigit() or not 0 < int(q["limit"]) <= 100:
+                return self._send(422, {"error": "bad limit"})
+            rows = rows[: int(q["limit"])]
+        self._send(200, {"rows": rows, "generated_at": self.server.tick()})
+
+    def _send(self, status, data):
+        body = json.dumps(data).encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+
+@pytest.fixture(scope="module")
+def server():
+    srv = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+    clock = iter(range(10**9))
+    srv.tick = lambda: next(clock)  # a volatile field, like a timestamp
+    threading.Thread(target=srv.serve_forever, daemon=True).start()
+    yield f"http://127.0.0.1:{srv.server_address[1]}"
+    srv.shutdown()
+
+
+def fixed_rng(n):
+    return "ab" * n
+
+
+def test_lax_api_is_caught(server):
+    report = probe(f"{server}/lax?authors=alice&limit=3", http_fetch(), delay=0,
+                   ignore_keys=["generated_at"], rng=fixed_rng)
+    assert report.stable
+    assert report.ignores_unknown_names is True
+    authors = report.params[0]
+    assert authors.effective
+    assert "author" in authors.silently_ignored  # the singular typo returns unfiltered rows with 200
+    assert "zzabababab" in authors.silently_ignored
+
+
+def test_strict_api_passes(server):
+    report = probe(f"{server}/strict?authors=alice", http_fetch(), delay=0,
+                   ignore_keys=["generated_at"], rng=fixed_rng)
+    assert report.ignores_unknown_names is False
+    assert all(d.verdict == "rejected" for d in report.params[0].decoys)
+
+
+def test_volatile_field_makes_results_unstable_without_ignore_key(server):
+    report = probe(f"{server}/lax?authors=alice", http_fetch(), delay=0, rng=fixed_rng)
+    assert not report.stable
+
+
+def test_request_budget_is_enforced(server):
+    with pytest.raises(RuntimeError, match="budget"):
+        probe(f"{server}/lax?authors=alice&limit=3", http_fetch(), delay=0, max_requests=4,
+              ignore_keys=["generated_at"])
+
+
+def test_cli_exit_codes(server, capsys):
+    assert main([f"{server}/lax?authors=alice", "--delay", "0", "--ignore-key", "generated_at"]) == 1
+    assert "silently ignores unknown parameter names" in capsys.readouterr().out
+    assert main([f"{server}/strict?authors=alice", "--delay", "0", "--ignore-key", "generated_at"]) == 0
+    assert main([f"{server}/lax", "--delay", "0"]) == 2  # nothing to probe
+
+
+def test_decoy_names():
+    names = decoy_names("authors", rng=fixed_rng)
+    assert names[0] == "author" and names[-1] == "zzabababab" and "authors" not in names
+    assert "pageSize" in decoy_names("page_size", limit=10, rng=fixed_rng)
+    assert "page_size" in decoy_names("pageSize", limit=10, rng=fixed_rng)
+    assert len(decoy_names("q", limit=3, rng=fixed_rng)) == 3
+
+
+def test_normalize_ignores_key_order_and_volatile_keys():
+    a, n = normalize(b'{"rows":[1,2],"t":1}', "application/json", ["t"])
+    b, _ = normalize(b'{"t":2,  "rows":[1,2]}', "application/json", ["t"])
+    assert a == b and n == 2
+
+
+def test_classify():
+    base, without = Response(200, "aaa", 1), Response(200, "bbb", 1)
+    assert classify(Response(200, "bbb", 1), base, without) == "ignored"
+    assert classify(Response(422, "x", 1), base, without) == "rejected"
+    assert classify(Response(200, "aaa", 1), base, without) == "alias"
+    assert classify(Response(200, "ccc", 1), base, without) == "different"
+    assert classify(Response(503, "x", 1), base, without) == "error"