At a very quick look, no evidence is given that the "bugs" found in requests are in fact reachable, i.e. not prevented by construction. And sure enough, the very first one is impossible because of a validating guard[1]: `address_in_network` only gets called after `is_valid_cidr`, which enforces the presence of a slash.
I think we should hold claims about effective static analysis and/or program verification to a higher standard than this.
I think we should hold claims about effective static analysis and/or program verification to a higher standard than this.
[1]: https://github.com/psf/requests/blob/4bd79e397304d46dfccd76f...