mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-11 14:38:38 +00:00
0f7d8709d3
* feat(sandbox): add controlled egress approvals * Apply batched suggestions from code review * fix(sandbox): harden restricted network policy * fix(sandbox): harden denied egress handling * fix(sandbox): isolate network proxy sidecar * chore: retry sandbox image smoke * fix(sandbox): close remaining network policy gaps * fix(sandbox): harden relay token rejection * fix(sandbox): fence incompatible policy replacement * fix(sandbox): replace containers across network modes * fix(sandbox): close remaining lifecycle gaps --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
39 lines
1.1 KiB
Python
39 lines
1.1 KiB
Python
import pytest
|
|
from pydantic import ValidationError
|
|
|
|
from deerflow.config.sandbox_config import SandboxConfig, SandboxNetworkConfig
|
|
|
|
|
|
def test_sandbox_network_defaults_to_open() -> None:
|
|
config = SandboxConfig(use="test")
|
|
|
|
assert config.network.mode == "open"
|
|
assert config.network.allow_domains == []
|
|
assert config.network.approval == "prompt"
|
|
|
|
|
|
def test_sandbox_network_normalizes_domains() -> None:
|
|
config = SandboxNetworkConfig(allow_domains=["PyPI.org.", "*.PythonHosted.org", "pypi.org"])
|
|
|
|
assert config.allow_domains == ["pypi.org", "*.pythonhosted.org"]
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"domain",
|
|
[
|
|
"*",
|
|
"https://pypi.org",
|
|
"pypi.org:443",
|
|
"foo.*.example.com",
|
|
"../example.com",
|
|
"127.0.0.1",
|
|
"localhost",
|
|
"foo..example.com",
|
|
"-foo.example.com",
|
|
"foo_.example.com",
|
|
],
|
|
)
|
|
def test_sandbox_network_rejects_unsafe_domain_rules(domain: str) -> None:
|
|
with pytest.raises(ValidationError, match="invalid sandbox network allowlist domain"):
|
|
SandboxNetworkConfig(allow_domains=[domain])
|