File size: 742 Bytes
d2fbff3 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | import unittest
from app.sources.scraper import _is_safe_public_url
class ScraperSecurityTests(unittest.IsolatedAsyncioTestCase):
async def test_rejects_private_and_non_http_destinations(self):
unsafe_urls = [
"http://127.0.0.1/admin",
"http://10.0.0.5/internal",
"http://169.254.169.254/latest/meta-data",
"http://[::1]/",
"file:///etc/passwd",
]
for url in unsafe_urls:
with self.subTest(url=url):
self.assertFalse(await _is_safe_public_url(url))
async def test_accepts_public_ip_literal(self):
self.assertTrue(await _is_safe_public_url("https://1.1.1.1/"))
if __name__ == "__main__":
unittest.main()
|