33 lines
919 B
Python
33 lines
919 B
Python
from __future__ import annotations
|
|
|
|
import pytest
|
|
from backup_tool.security.ssrf import (
|
|
SSRFError,
|
|
resolve_public_addresses,
|
|
validate_webhook_url,
|
|
)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_private_or_mixed_answers_are_rejected() -> None:
|
|
async def private(_host: str, _port: int) -> tuple[str, ...]:
|
|
return ("8.8.8.8", "127.0.0.1")
|
|
|
|
with pytest.raises(SSRFError, match="non-public"):
|
|
await resolve_public_addresses("hooks.example.test", 443, private)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"value",
|
|
[
|
|
"https://127.0.0.1/callback",
|
|
"https://user:pass@hooks.example.test/callback",
|
|
"https://hooks.example.test/callback#fragment",
|
|
"ftp://hooks.example.test/callback",
|
|
"https://hooks.example.test:22/callback",
|
|
],
|
|
)
|
|
def test_webhook_url_rejects_bypasses(value: str) -> None:
|
|
with pytest.raises(SSRFError):
|
|
validate_webhook_url(value)
|