feat: Support urllib3 >= 2.6.0

[chandra-siri]

feat: Support urllib3 >= 2.6.0

Context:

• This library implements a custom decoders ( _GzipDecoder , _BrotliDecoder ) which inherit from urllib3.response.ContentDecoder
• Interface of urllib3.response.ContentDecoder was changed in 2.6.0 to fix security vulnerability for highly compressed data reads. (Decompression bombs)

Hence we need to change our interfaces as well.

Changes

• Add max_length param on decompress method, provide default value of -1 (same as urllib3's decompress)
• Provide backwards compatibility ( ie urllib3 <= 2.5.0)

[gemini-code-assist]

Summary of Changes

Hello @chandra-siri, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the download functionality by integrating support for urllib3's custom decoder, specifically by introducing a max_length parameter to control decompression limits. It also includes a robust backward compatibility mechanism to ensure smooth operation across different urllib3 versions.

Highlights

• urllib3 custom decoder support: The decompress methods in _BaseDecoder and _BrotliDecoder have been updated to support urllib3's custom decoder by accepting a new max_length parameter.
• Backward compatibility: A try-except TypeError block has been introduced to ensure backward compatibility with urllib3 versions older than 2.6.0, which do not support the max_length parameter in their decompress method.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request adds support for urllib3's max_length parameter in the custom _GzipDecoder and _BrotliDecoder to align with newer urllib3 APIs. The implementation correctly maintains backward compatibility with older urllib3 versions (pre-2.6.0) by using a try...except TypeError block. The changes are logical and well-implemented. My feedback is focused on improving the clarity of comments within these compatibility blocks to enhance long-term code maintainability.

[chandra-siri]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the custom Gzip and Brotli decoders to be compatible with urllib3 v2.x, which introduced a max_length parameter to the decompress method to mitigate decompression bomb vulnerabilities. The changes add this parameter to the custom decoders and use a try-except block for backward compatibility with older urllib3 versions.

My review focuses on improving the implementation of this backward compatibility. I've suggested replacing the try-except blocks with an explicit version check at import time, which is cleaner and more performant. I also identified a bug in the new has_unconsumed_tail property for the Brotli decoder that would cause an AttributeError with older urllib3 versions and provided a fix. Overall, the changes are in the right direction to support modern urllib3 versions.