Files
geointel/backend/tests/test_request_target_security.py
Jens faeb58ef6d
GeoIntel release gates / Compile, test, contracts and builds (push) Successful in 1m49s
GeoIntel release gates / Python and npm vulnerability policy (push) Successful in 21s
GeoIntel release gates / Production AI image, SBOM and container scan (push) Successful in 5m39s
GeoIntel release gates / Deploy exact gated revision to Unraid (push) Failing after 58m43s
Initial public release
2026-08-31 21:56:53 +02:00

56 lines
1.6 KiB
Python

import pytest
from fastapi.testclient import TestClient
from app.main import app
client = TestClient(app)
@pytest.mark.parametrize(
"host",
[
"trusted.example/@admin",
"trusted.example?shadow=admin",
"trusted.example#shadow",
],
)
def test_invalid_host_request_target_is_rejected_canonically(host: str) -> None:
response = client.get("/health/live", headers={"host": host})
assert response.status_code == 400
assert response.headers["x-request-id"]
assert response.json()["error"] == "INVALID_REQUEST_TARGET"
assert response.json()["request_id"] == response.headers["x-request-id"]
@pytest.mark.parametrize(
"host",
["localhost:1202", "127.0.0.1:8000", "[::1]:8000", "testserver"],
)
def test_normal_host_forms_remain_available(host: str) -> None:
response = client.get("/health/live", headers={"host": host})
assert response.status_code == 200
def test_urlencoded_form_body_is_rejected_before_starlette_form_parsing() -> None:
response = client.post(
"/api/v1/datasets/upload",
headers={"content-type": "application/x-www-form-urlencoded"},
content="dataset_type=vector&field=" + ("x" * 10_000),
)
assert response.status_code == 415
assert response.json()["error"] == "UNSUPPORTED_CONTENT_TYPE"
def test_multipart_upload_contract_remains_available() -> None:
response = client.post(
"/health/live",
files={"file": ("empty.geojson", b"{}", "application/geo+json")},
data={"dataset_type": "vector"},
)
assert response.status_code == 405