tests/test_scraper_security.py

import unittest

from app.sources.scraper import _is_safe_public_url


class ScraperSecurityTests(unittest.IsolatedAsyncioTestCase):
    async def test_rejects_private_and_non_http_destinations(self):
        unsafe_urls = [
            "http://127.0.0.1/admin",
            "http://10.0.0.5/internal",
            "http://169.254.169.254/latest/meta-data",
            "http://[::1]/",
            "file:///etc/passwd",
        ]

        for url in unsafe_urls:
            with self.subTest(url=url):
                self.assertFalse(await _is_safe_public_url(url))

    async def test_accepts_public_ip_literal(self):
        self.assertTrue(await _is_safe_public_url("https://1.1.1.1/"))


if __name__ == "__main__":
    unittest.main()