The patch looks like it also adds support for individual script file names in cgi_directories. If that is the case, I suspect it would be tricked by a query string (e.g. /some.cgi?query).

I object to removing the final “return False”. The return value of is_cgi() is significant, and it good to be explicit about what it is returning.

It would be helpful to get a test case. Or multiple test cases if I am right about the individual file support.

And the documentation needs updating saying what is supported, with a “Version changed” notice. It would also be good to be specific about the syntax for cgi_directories. E.g. must start with a slash, cannot use Windows backslashes, must be a normalized path, not URL encoded. Is the root directory allowed?