nessi
dfec7976c4
Add ALLOWED_HOSTS configuration to restrict trusted hosts in TrustedHostMiddleware. Enhance SSRF protection to block all private, loopback, link-local, multicast, reserved, and unspecified IP addresses using ipaddress module and DNS resolution checks. Add encrypt_value/decrypt_value aliases for encryption functions. Upgrade PostgreSQL from 16 to 18.4 in Docker Compose with updated data directory path (/var/lib/postgresql). Add security_opt no
34 lines
1.1 KiB
Python
34 lines
1.1 KiB
Python
from apps.api.src.security.password import hash_password, verify_password
|
|
from apps.api.src.security.encryption import encrypt_value, decrypt_value, mask_secret
|
|
from apps.api.src.security.ssrf import is_safe_url
|
|
|
|
|
|
def test_password_hash():
|
|
pw = "super-secret-password"
|
|
hashed = hash_password(pw)
|
|
assert verify_password(pw, hashed)
|
|
assert not verify_password("wrong", hashed)
|
|
|
|
|
|
def test_encryption():
|
|
value = "api-token-secret"
|
|
encrypted = encrypt_value(value)
|
|
decrypted = decrypt_value(encrypted)
|
|
assert decrypted == value
|
|
|
|
|
|
def test_mask_secret():
|
|
assert mask_secret("1234567890", 4) == "******7890"
|
|
|
|
|
|
def test_ssrf_protection():
|
|
assert not is_safe_url("http://localhost:8000")
|
|
assert not is_safe_url("http://127.0.0.1/admin")
|
|
assert not is_safe_url("http://10.0.0.1/admin")
|
|
assert not is_safe_url("http://172.16.0.1/admin")
|
|
assert not is_safe_url("http://192.168.1.1/admin")
|
|
assert not is_safe_url("http://[::1]/admin")
|
|
assert not is_safe_url("http://169.254.169.254")
|
|
assert not is_safe_url("ftp://example.com")
|
|
assert is_safe_url("https://example.com/api")
|