lukasandClaude Opus 4.8
a5ec0d21cb
Three-pane webmail client. - Backend: FastAPI + async SQLAlchemy + arq worker (Postgres/Redis), IMAP/SMTP sync, threading, search, drafts/outbox with undo, attachments, 2FA. - Frontend: React 18 + Vite + TypeScript + TanStack Query + Tailwind; three-pane UI with rich-text composer, light/dark themes, resizable panels. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
56 lines
1.7 KiB
Python
56 lines
1.7 KiB
Python
"""SSRF guard for autodiscovery (SPEC §10.6)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from app.accounts import ssrf
|
|
from app.accounts.ssrf import SsrfError, _is_public_ip, assert_host_is_public, guarded_get
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"ip,public",
|
|
[
|
|
("8.8.8.8", True),
|
|
("1.1.1.1", True),
|
|
("2606:4700:4700::1111", True),
|
|
("127.0.0.1", False),
|
|
("10.0.0.1", False),
|
|
("192.168.1.1", False),
|
|
("172.16.5.4", False),
|
|
("169.254.1.1", False), # link-local
|
|
("::1", False),
|
|
("fe80::1", False), # link-local v6
|
|
("0.0.0.0", False),
|
|
],
|
|
)
|
|
def test_is_public_ip(ip: str, public: bool) -> None:
|
|
assert _is_public_ip(ip) is public
|
|
|
|
|
|
async def test_assert_host_public_accepts_public(monkeypatch) -> None: # type: ignore[no-untyped-def]
|
|
async def fake_resolve(_host: str) -> list[str]:
|
|
return ["8.8.8.8"]
|
|
|
|
monkeypatch.setattr(ssrf, "_resolve_all", fake_resolve)
|
|
await assert_host_is_public("mail.example.com") # no raise
|
|
|
|
|
|
async def test_assert_host_rejects_private(monkeypatch) -> None: # type: ignore[no-untyped-def]
|
|
async def fake_resolve(_host: str) -> list[str]:
|
|
return ["8.8.8.8", "127.0.0.1"] # one private address is enough to reject
|
|
|
|
monkeypatch.setattr(ssrf, "_resolve_all", fake_resolve)
|
|
with pytest.raises(SsrfError):
|
|
await assert_host_is_public("evil.example.com")
|
|
|
|
|
|
async def test_guarded_get_rejects_non_https() -> None:
|
|
with pytest.raises(SsrfError):
|
|
await guarded_get("http://example.com/config.xml")
|
|
|
|
|
|
async def test_guarded_get_rejects_missing_host() -> None:
|
|
with pytest.raises(SsrfError):
|
|
await guarded_get("https:///config.xml")
|