Initial deploy setup

tests/security/test_url_security.py

@@ -0,0 +1,34 @@
+import socket
+
+import pytest
+
+from apps.sources.services.url_security import UnsafeUrlError, validate_public_url
+
+
+def fake_resolver(address: str):
+    def resolver(host, port, type=socket.SOCK_STREAM):
+        return [(socket.AF_INET, type, 6, "", (address, port))]
+
+    return resolver
+
+
+@pytest.mark.security
+def test_blocks_private_ipv4_after_dns_resolution():
+    with pytest.raises(UnsafeUrlError, match="Niet-publiek"):
+        validate_public_url("https://jobs.example.org/test", resolver=fake_resolver("10.0.0.5"))
+
+
+@pytest.mark.security
+def test_blocks_loopback_and_embedded_credentials():
+    with pytest.raises(UnsafeUrlError):
+        validate_public_url("http://127.0.0.1/admin")
+    with pytest.raises(UnsafeUrlError):
+        validate_public_url("https://user:pass@example.org/")
+
+
+@pytest.mark.security
+def test_accepts_global_address():
+    result = validate_public_url(
+        "https://jobs.example.org/test", resolver=fake_resolver("93.184.216.34")
+    )
+    assert result.hostname == "jobs.example.org"