34 lines
1.3 KiB
Python
34 lines
1.3 KiB
Python
## Copyright © 2026 Olaf Kolkman
|
|
## SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
from unittest.mock import patch
|
|
from urllib.error import HTTPError
|
|
from urllib.request import Request
|
|
|
|
import pytest
|
|
|
|
from backend.app.services.mastodon_security import open_no_redirect, validate_public_instance
|
|
|
|
|
|
@pytest.mark.parametrize('instance', [
|
|
'http://mastodon.example',
|
|
'https://127.0.0.1',
|
|
'https://[::ffff:127.0.0.1]',
|
|
'https://user:password@mastodon.example',
|
|
])
|
|
def test_mastodon_instance_rejects_unsafe_urls(instance):
|
|
with pytest.raises(ValueError):
|
|
validate_public_instance(instance)
|
|
|
|
|
|
def test_mastodon_instance_rejects_private_dns_result():
|
|
with patch('backend.app.services.mastodon_security.socket.getaddrinfo', return_value=[(2, 1, 6, '', ('10.0.0.5', 443))]):
|
|
with pytest.raises(ValueError, match='public IP'):
|
|
validate_public_instance('https://mastodon.example')
|
|
|
|
|
|
def test_mastodon_outbound_redirects_are_rejected():
|
|
request = Request('https://mastodon.example/api/v1/statuses')
|
|
with patch('backend.app.services.mastodon_security.NO_REDIRECT_OPENER.open', side_effect=HTTPError(request.full_url, 302, 'Redirects are not allowed', {}, None)):
|
|
with pytest.raises(HTTPError, match='Redirects are not allowed'):
|
|
open_no_redirect(request) |