[dmp990]

Fixes #845, #947

Problem

In _find_p, if anno is dict: return data sits right above if _is_body(anno)::

if anno is dict: return data
if _is_body(anno):
    if 'session'.startswith(arg.lower()): return conn.scope.get('session', {})
    return await _from_body(conn, p, data)

Because anno is dict returns early before _is_body(anno) is run, type annotating session: dict returns parsed query or form data instead of conn.scope.get('session', {}). Also, the 'session'.startswith(arg.lower()) check inside _is_body(anno) only ever triggers for non-dict body types, so a handler param like s: Search receives the session dict instead of a Search instance from _from_body.

Proposed fix

Move 'session'.startswith(arg.lower()) check into if anno is dict.

Reproduction

from fasthtml.common import *

app, rt = fast_app()
@dataclass
class Search: q:str = ''

@rt
def typed(session:dict): return session.get('user')
@rt
def search(s:Search): return repr(s)

cli = app.get_testclient(user='alice')
cli.get('/typed?user=evil').text  # before: 'evil'              | after: 'alice'
cli.get('/search?q=hi').text      # before: "{'user': 'alice'}" | after: "Search(q='hi')"

Types of changes

What types of changes does your code introduce? Put an x in all the boxes that apply:

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

Go over all the following points, and put an x in all the boxes that apply:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.
• I am aware that this is an nbdev project, and I have edited, cleaned, and synced the source notebooks instead of editing .py or .md files directly.