mirror of
https://github.com/karust/openserp.git
synced 2026-08-05 16:53:54 +08:00
04db5347a8
- breaker: stop counting client cancellations/deadlines (incl. bare rate-limiter wait errors) and circuit-open as engine failures - rate limiting: cache limiters in SearchEngineOptions and rawEngine so pacing applies on raw/library paths; pool wrapper delegates - /extract SSRF guard: public-IP-only policy with dial-time IP pinning, redirect re-validation, rendered-mode preflight, http/https allow-list, ErrTargetNotAllowed -> HTTP 400, extract.allow_private_networks escape hatch (default off) - browser: no rod Must* on the request path; CLI parses block_resources without panicking
43 lines
1.0 KiB
Go
43 lines
1.0 KiB
Go
package core
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestValidatePublicHTTPURLRejectsPrivateTargets(t *testing.T) {
|
|
tests := []string{
|
|
"http://127.0.0.1/",
|
|
"http://[::1]/",
|
|
"http://10.0.0.1/",
|
|
"http://172.16.0.1/",
|
|
"http://192.168.1.1/",
|
|
"http://169.254.169.254/",
|
|
"http://100.64.0.1/",
|
|
}
|
|
|
|
for _, rawURL := range tests {
|
|
t.Run(rawURL, func(t *testing.T) {
|
|
err := ValidatePublicHTTPURL(context.Background(), rawURL)
|
|
if !errors.Is(err, ErrTargetNotAllowed) {
|
|
t.Fatalf("expected ErrTargetNotAllowed, got %v", err)
|
|
}
|
|
if !strings.Contains(strings.ToLower(err.Error()), "non-public") {
|
|
t.Fatalf("expected non-public error, got %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestValidatePublicHTTPURLRejectsUnsupportedScheme(t *testing.T) {
|
|
err := ValidatePublicHTTPURL(context.Background(), "file:///etc/passwd")
|
|
if !errors.Is(err, ErrTargetNotAllowed) {
|
|
t.Fatalf("expected ErrTargetNotAllowed, got %v", err)
|
|
}
|
|
if !strings.Contains(err.Error(), "only http and https") {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
}
|