diff options
| author | Dennis Fink | 2026-08-10 19:36:49 +0200 |
|---|---|---|
| committer | Dennis Fink | 2026-08-10 19:36:49 +0200 |
| commit | 8350bef3e3baea6042ed3780a054cc65707e9f8d (patch) | |
| tree | 81ab5f102045f53d23f89e22a41b2f6a2eef9b52 /tests/test_forms.py | |
| parent | afcdb411882a6c157c3b5008e1c633d3e40cd984 (diff) | |
| download | webmentions-ssg-8350bef3e3baea6042ed3780a054cc65707e9f8d.tar.gz webmentions-ssg-8350bef3e3baea6042ed3780a054cc65707e9f8d.zip | |
fix(receiver): prevent requests to non-public addresses
Resolve source hostnames before fetching and reject addresses that are
not globally routable to prevent SSRF against local or private services.
Repeat the check for every HTTP request so redirects cannot bypass the
initial source validation. Treat DNS resolution failures during
verification as temporary fetch errors.
Diffstat (limited to 'tests/test_forms.py')
| -rw-r--r-- | tests/test_forms.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/tests/test_forms.py b/tests/test_forms.py index 9be6ca8..2d5fc01 100644 --- a/tests/test_forms.py +++ b/tests/test_forms.py @@ -89,6 +89,7 @@ VALID_TARGET = "https://dennisfink.me/blog/example/" ) def test_endpoint_form_rejects_invalid_data( app: Flask, + public_dns: None, form_data: dict[str, str], invalid_field: str, expected_error: str | None, @@ -111,6 +112,7 @@ def test_endpoint_form_rejects_invalid_data( def test_endpoint_form_accepts_valid_data( app: Flask, + public_dns: None, ) -> None: with app.test_request_context( "/endpoint", |