1 files changed, 42 insertions, 0 deletions
diff --git a/tests/test_url_security.py b/tests/test_url_security.py
new file mode 100644
index 0000000..fba6d7d
--- /dev/null
+++ b/tests/test_url_security.py
@@ -0,0 +1,42 @@
+import pytest
+
+from webmentions_ssg.url_security import (
+    NonPublicAddressError,
+    ensure_public_url,
+)
+
+
+class FakeAnswers:
+    def __init__(self, *addresses: str):
+        self._addresses = addresses
+
+    def addresses(self):
+        return iter(self._addresses)
+
+
+@pytest.mark.parametrize(
+    ("url", "resolved_addresses"),
+    [
+        ("http://127.0.0.1/", ["127.0.0.1"]),
+        ("http://127.0.0.1:8080/test", ["127.0.0.1"]),
+        ("http://[::1]/", ["::1"]),
+        ("http://10.0.0.1/", ["10.0.0.1"]),
+        ("http://172.16.0.1/", ["172.16.0.1"]),
+        ("http://192.168.1.1/", ["192.168.1.1"]),
+        ("http://169.254.169.254/", ["169.254.169.254"]),
+        ("http://localhost/", ["127.0.0.1", "::1"]),
+        ("http://internal.example/", ["192.168.1.10"]),
+    ],
+)
+def test_ensure_public_url_rejects_non_public_addresses(
+    monkeypatch: pytest.MonkeyPatch,
+    url: str,
+    resolved_addresses: list[str],
+) -> None:
+    monkeypatch.setattr(
+        "webmentions_ssg.url_security.dns.resolver.resolve_name",
+        lambda hostname: FakeAnswers(*resolved_addresses),
+    )
+
+    with pytest.raises(NonPublicAddressError):
+        ensure_public_url(url)