There's no XSS protection whatsoever

[plq]

    @rpc(Unicode, Unicode, Unicode, Unicode, File, Unicode, Unicode, Unicode,
         Unicode, Unicode, Unicode, Unicode, Unicode, Unicode, Unicode,
         Unicode, Unicode, String, _patterns=[HttpPattern("/",verb="POST")])
    def register(ctx, name, license, author, home_page, content, comment,
            download_url, platform, description, metadata_version, author_email,
            md5_digest, filetype, pyversion, summary, version, protcol_version):

The type declarations in the above block must be revised with max_len and pattern constraints.

Regexes and other validation code could be stolen from: https://bitbucket.org/loewis/pypi/src/7ffa1f091b87dd58eb3770abc6af30ec37943ba1/verlib.py?at=default

One could define, e.g.:

PackageName = Unicode(64, pattern='[a-zA-Z_][0-9A-Za-z_]*')

And use it in database declarations, rpc decorators and ComplexModel subclasses.

[plq]

unless we do this, it's won't be possible to run spynepi open to the public.