From 1794c4d6ea428c63d4163d1d1878ba81c325c95e Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Wed, 29 Jul 2026 08:54:01 +0000 Subject: [PATCH] :bug: Mock DNS resolution in SSRF tests for environments without public DNS The validate-url-allows-public-{https,http} tests relied on real DNS resolution of example.com, which fails in containers without public DNS access. Mock resolve-host to return a known public IP, consistent with the pattern used by other tests in the same file. AI-assisted-by: mimo-v2.5-pro --- backend/test/backend_tests/util_ssrf_test.clj | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/backend/test/backend_tests/util_ssrf_test.clj b/backend/test/backend_tests/util_ssrf_test.clj index 2dadb8282a..c3b5b435bb 100644 --- a/backend/test/backend_tests/util_ssrf_test.clj +++ b/backend/test/backend_tests/util_ssrf_test.clj @@ -13,11 +13,25 @@ [clojure.test :as t])) (t/deftest validate-url-allows-public-https - (t/is (true? (ssrf/safe-url? "https://example.com/foo"))) - (t/is (true? (ssrf/safe-url? "https://example.com:8080/path?q=1")))) + (let [original ssrf/resolve-host] + (with-redefs [ssrf/resolve-host + (fn [hostname] + (if (= hostname "example.com") + (into-array java.net.InetAddress + [(java.net.InetAddress/getByName "93.184.216.34")]) + (original hostname)))] + (t/is (true? (ssrf/safe-url? "https://example.com/foo"))) + (t/is (true? (ssrf/safe-url? "https://example.com:8080/path?q=1")))))) (t/deftest validate-url-allows-public-http - (t/is (true? (ssrf/safe-url? "http://example.com/foo")))) + (let [original ssrf/resolve-host] + (with-redefs [ssrf/resolve-host + (fn [hostname] + (if (= hostname "example.com") + (into-array java.net.InetAddress + [(java.net.InetAddress/getByName "93.184.216.34")]) + (original hostname)))] + (t/is (true? (ssrf/safe-url? "http://example.com/foo")))))) (t/deftest validate-url-blocks-disallowed-schemes (t/is (false? (ssrf/safe-url? "file:///etc/passwd")))