github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-19 03:08:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Mock DNS resolution in SSRF tests for environments without public DNS (#11040)

Browse Source 
The validate-url-allows-public-{https,http} tests relied on real DNS
resolution of example.com, which fails in containers without public
DNS access. Mock resolve-host to return a known public IP, consistent
with the pattern used by other tests in the same file.

AI-assisted-by: mimo-v2.5-pro
This commit is contained in:
Andrey Antukh 2026-08-17 11:21:25 +02:00 committed by GitHub
parent 68e1db984d
commit c688cba8d8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
backend/test/backend_tests/util_ssrf_test.clj
View File

@ -13,11 +13,25 @@
[clojure.test :as t])) [clojure.test :as t]))
(t/deftest validate-url-allows-public-https (t/deftest validate-url-allows-public-https
(t/is (true? (ssrf/safe-url? "https://example.com/foo"))) (let [original ssrf/resolve-host]
(t/is (true? (ssrf/safe-url? "https://example.com:8080/path?q=1")))) (with-redefs [ssrf/resolve-host
(fn [hostname]
(if (= hostname "example.com")
(into-array java.net.InetAddress
[(java.net.InetAddress/getByName "93.184.216.34")])
(original hostname)))]
(t/is (true? (ssrf/safe-url? "https://example.com/foo")))
(t/is (true? (ssrf/safe-url? "https://example.com:8080/path?q=1"))))))
(t/deftest validate-url-allows-public-http (t/deftest validate-url-allows-public-http
(t/is (true? (ssrf/safe-url? "http://example.com/foo")))) (let [original ssrf/resolve-host]
(with-redefs [ssrf/resolve-host
(fn [hostname]
(if (= hostname "example.com")
(into-array java.net.InetAddress
[(java.net.InetAddress/getByName "93.184.216.34")])
(original hostname)))]
(t/is (true? (ssrf/safe-url? "http://example.com/foo"))))))
(t/deftest validate-url-blocks-disallowed-schemes (t/deftest validate-url-blocks-disallowed-schemes
(t/is (false? (ssrf/safe-url? "file:///etc/passwd"))) (t/is (false? (ssrf/safe-url? "file:///etc/passwd")))