Initial public release

backend/tests/test_request_target_security.py

@@ -0,0 +1,55 @@
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+client = TestClient(app)
+
+
+@pytest.mark.parametrize(
+    "host",
+    [
+        "trusted.example/@admin",
+        "trusted.example?shadow=admin",
+        "trusted.example#shadow",
+    ],
+)
+def test_invalid_host_request_target_is_rejected_canonically(host: str) -> None:
+    response = client.get("/health/live", headers={"host": host})
+
+    assert response.status_code == 400
+    assert response.headers["x-request-id"]
+    assert response.json()["error"] == "INVALID_REQUEST_TARGET"
+    assert response.json()["request_id"] == response.headers["x-request-id"]
+
+
+@pytest.mark.parametrize(
+    "host",
+    ["localhost:1202", "127.0.0.1:8000", "[::1]:8000", "testserver"],
+)
+def test_normal_host_forms_remain_available(host: str) -> None:
+    response = client.get("/health/live", headers={"host": host})
+
+    assert response.status_code == 200
+
+
+def test_urlencoded_form_body_is_rejected_before_starlette_form_parsing() -> None:
+    response = client.post(
+        "/api/v1/datasets/upload",
+        headers={"content-type": "application/x-www-form-urlencoded"},
+        content="dataset_type=vector&field=" + ("x" * 10_000),
+    )
+
+    assert response.status_code == 415
+    assert response.json()["error"] == "UNSUPPORTED_CONTENT_TYPE"
+
+
+def test_multipart_upload_contract_remains_available() -> None:
+    response = client.post(
+        "/health/live",
+        files={"file": ("empty.geojson", b"{}", "application/geo+json")},
+        data={"dataset_type": "vector"},
+    )
+
+    assert response.status_code == 405