35 lines
1.0 KiB
Python
35 lines
1.0 KiB
Python
import socket
|
|
|
|
import pytest
|
|
|
|
from apps.sources.services.url_security import UnsafeUrlError, validate_public_url
|
|
|
|
|
|
def fake_resolver(address: str):
|
|
def resolver(host, port, type=socket.SOCK_STREAM):
|
|
return [(socket.AF_INET, type, 6, "", (address, port))]
|
|
|
|
return resolver
|
|
|
|
|
|
@pytest.mark.security
|
|
def test_blocks_private_ipv4_after_dns_resolution():
|
|
with pytest.raises(UnsafeUrlError, match="Niet-publiek"):
|
|
validate_public_url("https://jobs.example.org/test", resolver=fake_resolver("10.0.0.5"))
|
|
|
|
|
|
@pytest.mark.security
|
|
def test_blocks_loopback_and_embedded_credentials():
|
|
with pytest.raises(UnsafeUrlError):
|
|
validate_public_url("http://127.0.0.1/admin")
|
|
with pytest.raises(UnsafeUrlError):
|
|
validate_public_url("https://user:pass@example.org/")
|
|
|
|
|
|
@pytest.mark.security
|
|
def test_accepts_global_address():
|
|
result = validate_public_url(
|
|
"https://jobs.example.org/test", resolver=fake_resolver("93.184.216.34")
|
|
)
|
|
assert result.hostname == "jobs.example.org"
|