Remote clients can call hidden or private methods

[defnull]

There is no check if a requested handler function starts with an underscore, which means an attacker could request /_my_private_method and even pass arbitrary string parameters to it via query parameters. There are public methods on the Server class that can also be called that way.

[patx]

I added a check for private methods, they will now not be routed 11bcbae. As for the public methods in Server class, not sure what you mean could you please clarify? Thanks!!

[defnull]

For example GET /render_template?name=foo. You probably want to add more features soon, so the name clash between framework functionality and application route functions will get in your way eventually.