Fixes

aiohttp/client_reqrep.py

@@ -27,7 +27,7 @@
 from multidict import CIMultiDict, CIMultiDictProxy, MultiDict, MultiDictProxy
 from yarl import URL
 
 from . import hdrs, multipart, payload
 from ._cookie_helpers import (
     parse_cookie_header,
     parse_set_cookie_headers,
@@ -1192,6 +1192,86 @@
                 continue
             headers[key] = value
 
+    def _update_body(self, body: Any) -> None:
+        """Update request body after its already been set."""
+        # Remove existing Content-Length header since body is changing
+        if hdrs.CONTENT_LENGTH in self.headers:
+            del self.headers[hdrs.CONTENT_LENGTH]
+
+        # Remove existing Transfer-Encoding header to avoid conflicts
+        if self.chunked and hdrs.TRANSFER_ENCODING in self.headers:
+            del self.headers[hdrs.TRANSFER_ENCODING]
+
+        # Now update the body using the existing method
+        # Called from _update_body, add 1 to stacklevel from caller
+        self.update_body_from_data(body, _stacklevel=4)
+
+        # Update transfer encoding headers if needed (same logic as __init__)
+        if body is not None or self.method not in self.GET_METHODS:
+            self.update_transfer_encoding()
+
+    async def update_body(self, body: Any) -> None:
+        """
+        Update request body and close previous payload if needed.
+
+        This method safely updates the request body by first closing any existing
+        payload to prevent resource leaks, then setting the new body.
+
+        IMPORTANT: Always use this method instead of setting request.body directly.
+        Direct assignment to request.body will leak resources if the previous body
+        contains file handles, streams, or other resources that need cleanup.
+
+        Args:
+            body: The new body content. Can be:
+                - bytes/bytearray: Raw binary data
+                - str: Text data (will be encoded using charset from Content-Type)
+                - FormData: Form data that will be encoded as multipart/form-data
+                - Payload: A pre-configured payload object
+                - AsyncIterable: An async iterable of bytes chunks
+                - File-like object: Will be read and sent as binary data
+                - None: Clears the body
+
+        Usage:
+            # CORRECT: Use update_body
+            await request.update_body(b"new request data")
+
+            # WRONG: Don't set body directly
+            # request.body = b"new request data"  # This will leak resources!
+
+            # Update with form data
+            form_data = FormData()
+            form_data.add_field('field', 'value')
+            await request.update_body(form_data)
+
+            # Clear body
+            await request.update_body(None)
+
+        Note:
+            This method is async because it may need to close file handles or
+            other resources associated with the previous payload. Always await
+            this method to ensure proper cleanup.
+
+        Warning:
+            Setting request.body directly is highly discouraged and can lead to:
+            - Resource leaks (unclosed file handles, streams)
+            - Memory leaks (unreleased buffers)
+            - Unexpected behavior with streaming payloads
+
+            It is not recommended to change the payload type in middleware. If the
+            body was already set (e.g., as bytes), it's best to keep the same type
+            rather than converting it (e.g., to str) as this may result in unexpected
+            behavior.
+
+        See Also:
+            - update_body_from_data: Synchronous body update without cleanup
+            - body property: Direct body access (STRONGLY DISCOURAGED)
+
+        """
+        # Close existing payload if it exists and needs closing
+        if self._body is not None:
+            await self._body.close()
+        self._update_body(body)
+
     def _update_expect_continue(self, expect: bool = False) -> None:
         if expect:
             self.headers[hdrs.EXPECT] = "100-continue"

tests/test_client_functional.py

@@ -1715,7 +1715,7 @@ async def handler(request: web.Request) -> web.Response:
 
     write_mock = None
     writelines_mock = None
-    original_write_bytes = ClientRequest.write_bytes
+    original_write_bytes = ClientRequest._write_bytes
 
     async def write_bytes(
         self: ClientRequest,
@@ -1745,7 +1745,7 @@ async def write_bytes(
         ):
             await original_write_bytes(self, writer, conn, content_length)
 
-    with mock.patch.object(ClientRequest, "write_bytes", write_bytes):
+    with mock.patch.object(ClientRequest, "_write_bytes", write_bytes):
         app = web.Application()
         app.router.add_get("/", handler)
         client = await aiohttp_client(app)
@@ -1775,7 +1775,7 @@ async def test_GET_DEFLATE_no_body(aiohttp_client: AiohttpClient) -> None:
     async def handler(request: web.Request) -> web.Response:
         return web.json_response({"ok": True})
 
-    with mock.patch.object(ClientRequest, "write_bytes") as mock_write_bytes:
+    with mock.patch.object(ClientRequest, "_write_bytes") as mock_write_bytes:
         app = web.Application()
         app.router.add_get("/", handler)
         client = await aiohttp_client(app)

tests/test_client_middleware.py

@@ -1083,10 +1083,7 @@ def __init__(self, secretkey: str) -> None:
             self.secretkey = secretkey
 
         def get_hash(self, request: ClientRequest) -> str:
-            if request.body:
-                data = request.body.decode("utf-8")
-            else:
-                data = "{}"
+            data = request.body.decode("utf-8") or "{}"
 
             # Simulate authentication hash without using real crypto
             return f"SIGNATURE-{self.secretkey}-{len(data)}-{data[:10]}"

tests/test_client_request.py

@@ -70,7 +70,7 @@ def maker(method: str, url: str, **kwargs: Any) -> ClientRequest:
 
     yield maker
     if request is not None:
-        loop.run_until_complete(request.close())
+        loop.run_until_complete(request._close())
 
 
 @pytest.fixture
@@ -146,13 +146,13 @@ def test_request_info(make_request: _RequestMaker) -> None:
     req = make_request("get", "http://python.org/")
     url = URL("http://python.org/")
     h = CIMultiDictProxy(req.headers)
-    assert req.request_info == aiohttp.RequestInfo(url, "GET", h, url)
+    assert req._request_info == aiohttp.RequestInfo(url, "GET", h, url)
 
 
 def test_request_info_with_fragment(make_request: _RequestMaker) -> None:
     req = make_request("get", "http://python.org/#urlfragment")
     h = CIMultiDictProxy(req.headers)
-    assert req.request_info == aiohttp.RequestInfo(
+    assert req._request_info == aiohttp.RequestInfo(
         URL("http://python.org/"),
         "GET",
         h,
@@ -167,57 +167,57 @@ def test_version_err(make_request: _RequestMaker) -> None:
 
 def test_host_port_default_http(make_request: _RequestMaker) -> None:
     req = make_request("get", "http://python.org/")
-    assert req.host == "python.org"
-    assert req.port == 80
+    assert req.url.host == "python.org"
+    assert req.url.port == 80
     assert not req.is_ssl()
 
 
 def test_host_port_default_https(make_request: _RequestMaker) -> None:
     req = make_request("get", "https://python.org/")
-    assert req.host == "python.org"
-    assert req.port == 443
+    assert req.url.host == "python.org"
+    assert req.url.port == 443
     assert req.is_ssl()
 
 
 def test_host_port_nondefault_http(make_request: _RequestMaker) -> None:
     req = make_request("get", "http://python.org:960/")
-    assert req.host == "python.org"
-    assert req.port == 960
+    assert req.url.host == "python.org"
+    assert req.url.port == 960
     assert not req.is_ssl()
 
 
 def test_host_port_nondefault_https(make_request: _RequestMaker) -> None:
     req = make_request("get", "https://python.org:960/")
-    assert req.host == "python.org"
-    assert req.port == 960
+    assert req.url.host == "python.org"
+    assert req.url.port == 960
     assert req.is_ssl()
 
 
 def test_host_port_default_ws(make_request: _RequestMaker) -> None:
     req = make_request("get", "ws://python.org/")
-    assert req.host == "python.org"
-    assert req.port == 80
+    assert req.url.host == "python.org"
+    assert req.url.port == 80
     assert not req.is_ssl()
 
 
 def test_host_port_default_wss(make_request: _RequestMaker) -> None:
     req = make_request("get", "wss://python.org/")
-    assert req.host == "python.org"
-    assert req.port == 443
+    assert req.url.host == "python.org"
+    assert req.url.port == 443
     assert req.is_ssl()
 
 
 def test_host_port_nondefault_ws(make_request: _RequestMaker) -> None:
     req = make_request("get", "ws://python.org:960/")
-    assert req.host == "python.org"
-    assert req.port == 960
+    assert req.url.host == "python.org"
+    assert req.url.port == 960
     assert not req.is_ssl()
 
 
 def test_host_port_nondefault_wss(make_request: _RequestMaker) -> None:
     req = make_request("get", "wss://python.org:960/")
-    assert req.host == "python.org"
-    assert req.port == 960
+    assert req.url.host == "python.org"
+    assert req.url.port == 960
     assert req.is_ssl()
 
 
@@ -394,29 +394,29 @@ def test_no_path(make_request: _RequestMaker) -> None:
 
 def test_ipv6_default_http_port(make_request: _RequestMaker) -> None:
     req = make_request("get", "http://[2001:db8::1]/")
-    assert req.host == "2001:db8::1"
-    assert req.port == 80
+    assert req.url.host == "2001:db8::1"
+    assert req.url.port == 80
     assert not req.is_ssl()
 
 
 def test_ipv6_default_https_port(make_request: _RequestMaker) -> None:
     req = make_request("get", "https://[2001:db8::1]/")
-    assert req.host == "2001:db8::1"
-    assert req.port == 443
+    assert req.url.host == "2001:db8::1"
+    assert req.url.port == 443
     assert req.is_ssl()
 
 
 def test_ipv6_nondefault_http_port(make_request: _RequestMaker) -> None:
     req = make_request("get", "http://[2001:db8::1]:960/")
-    assert req.host == "2001:db8::1"
-    assert req.port == 960
+    assert req.url.host == "2001:db8::1"
+    assert req.url.port == 960
     assert not req.is_ssl()
 
 
 def test_ipv6_nondefault_https_port(make_request: _RequestMaker) -> None:
     req = make_request("get", "https://[2001:db8::1]:960/")
-    assert req.host == "2001:db8::1"
-    assert req.port == 960
+    assert req.url.host == "2001:db8::1"
+    assert req.url.port == 960
     assert req.is_ssl()
 
 
@@ -445,14 +445,14 @@ def test_basic_auth_from_url(make_request: _RequestMaker) -> None:
     req = make_request("get", "http://nkim:[email protected]")
     assert "AUTHORIZATION" in req.headers
     assert "Basic bmtpbToxMjM0" == req.headers["AUTHORIZATION"]
-    assert "python.org" == req.host
+    assert "python.org" == req.url.host
 
 
 def test_basic_auth_no_user_from_url(make_request: _RequestMaker) -> None:
     req = make_request("get", "http://:[email protected]")
     assert "AUTHORIZATION" in req.headers
     assert "Basic OjEyMzQ=" == req.headers["AUTHORIZATION"]
-    assert "python.org" == req.host
+    assert "python.org" == req.url.host
 
 
 def test_basic_auth_from_url_overridden(make_request: _RequestMaker) -> None:
@@ -461,7 +461,7 @@ def test_basic_auth_from_url_overridden(make_request: _RequestMaker) -> None:
     )
     assert "AUTHORIZATION" in req.headers
     assert "Basic bmtpbToxMjM0" == req.headers["AUTHORIZATION"]
-    assert "python.org" == req.host
+    assert "python.org" == req.url.host
 
 
 def test_path_is_not_double_encoded1(make_request: _RequestMaker) -> None:

tests/test_client_response.py

@@ -1052,7 +1052,7 @@ def test_default_encoding_is_utf8() -> None:
         timer=TimerNoop(),
         traces=[],
         loop=mock.Mock(),
-        session=None,  # type: ignore[arg-type]
+        session=None,
     )
     response._headers = CIMultiDictProxy(CIMultiDict({}))
     response._body = b""

tests/test_client_session.py

@@ -949,7 +949,7 @@ async def on_request_headers_sent(
             context: object,
             params: tracing.TraceRequestHeadersSentParams,
         ) -> None:
-            gathered_req_headers.extend(**params.headers)
+            gathered_req_headers.extend(params.headers)
 
         trace_config = aiohttp.TraceConfig(
             trace_config_ctx_factory=mock.Mock(return_value=trace_config_ctx)