Node / reticulum_mirror / MeshChatX / files / tests / backend / test_map_geo_sanitizer.py

Displaying Raw • Download

T8b949e# SPDX-License-Identifier: 0BSD

Tff7b72import T7ee787io

Tff7b72import T7ee787json

Tff7b72import T7ee787zipfile

Tff7b72import T7ee787pytest

Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787map_geo_sanitizer Tff7b72import Tb4b4b4(

Te6edf3is_allowed_data_image_hrefTb4b4b4,

Te6edf3is_remote_hrefTb4b4b4,

Te6edf3sanitize_geo_bytesTb4b4b4,

Tb4b4b4)

Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787map_geo_validator Tff7b72import Te6edf3GeoValidationError

Te6edf3TINY_PNG Tff7b72= Tb4b4b4(

Ta5d6ffbTa5d6ff"Tffea00\x89Ta5d6ffPNGTffea00\rTffea00\nTffea00\x1aTffea00\nTffea00\x00Tffea00\x00Tffea00\x00Tffea00\rTa5d6ffIHDRTffea00\x00Tffea00\x00Tffea00\x00Tffea00\x01Tffea00\x00Tffea00\x00Tffea00\x00Tffea00\x01Ta5d6ff"

Ta5d6ffbTa5d6ff"Tffea00\x08Tffea00\x02Tffea00\x00Tffea00\x00Tffea00\x00Tffea00\x90Ta5d6ffwSTffea00\xdeTffea00\x00Tffea00\x00Tffea00\x00Tffea00\nTa5d6ffIDATxTffea00\x9cTa5d6ffcTffea00\xf8Tffea00\x0fTffea00\x00Ta5d6ff"

Ta5d6ffbTa5d6ff"Tffea00\x00Tffea00\x01Tffea00\x01Tffea00\x00Tffea00\x05Tffea00\x18Tffea00\xd8Ta5d6ffNTffea00\x00Tffea00\x00Tffea00\x00Tffea00\x00Ta5d6ffIENDTffea00\xaeTa5d6ffB`Tffea00\x82Ta5d6ff"

Tb4b4b4)

Te6edf3TINY_PNG_DATA Tff7b72= Tb4b4b4(

Ta5d6ff"Ta5d6ffdata:image/png;base64,Ta5d6ff"

Ta5d6ff"Ta5d6ffiVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYAAAAAYAAjCB0C8=Ta5d6ff"

Tb4b4b4)

Tff7b72def Td2a8ff_kmzTb4b4b4(Te6edf3filesTb4b4b4: Tffa657dictTb4b4b4[Tffa657strTb4b4b4, Tffa657bytesTb4b4b4]Tb4b4b4) Tff7b72-Tff7b72> Tffa657bytesTb4b4b4:

Te6edf3buf Tff7b72= Te6edf3ioTff7b72.Td2a8ffBytesIOTb4b4b4(Tb4b4b4)

Tff7b72with Te6edf3zipfileTff7b72.Td2a8ffZipFileTb4b4b4(Te6edf3bufTb4b4b4, Ta5d6ff"Ta5d6ffwTa5d6ff"Tb4b4b4) Tff7b72as Te6edf3zfTb4b4b4:

Tff7b72for Te6edf3nameTb4b4b4, Te6edf3payload Tff7b72in Te6edf3filesTff7b72.Td2a8ffitemsTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3zfTff7b72.Td2a8ffwritestrTb4b4b4(Te6edf3nameTb4b4b4, Te6edf3payloadTb4b4b4)

Tff7b72return Te6edf3bufTff7b72.Td2a8ffgetvalueTb4b4b4(Tb4b4b4)

Tff7b72def Td2a8fftest_oracle_remote_href_is_remoteTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3is_remote_hrefTb4b4b4(Ta5d6ff"Ta5d6ffhttps://evil.example/icon.pngTa5d6ff"Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72assert Te6edf3is_remote_hrefTb4b4b4(Ta5d6ff"Ta5d6ffhttp://evil.example/xTa5d6ff"Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72assert Te6edf3is_remote_hrefTb4b4b4(Ta5d6ff"Ta5d6ff//cdn.example/x.pngTa5d6ff"Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72assert Te6edf3is_remote_hrefTb4b4b4(Ta5d6ff"Ta5d6fffile:///etc/passwdTa5d6ff"Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72assert Te6edf3is_remote_hrefTb4b4b4(Ta5d6ff"Ta5d6ffjavascript:alert(1)Ta5d6ff"Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72assert Te6edf3is_remote_hrefTb4b4b4(Ta5d6ff"Ta5d6ffvbscript:msgbox(1)Ta5d6ff"Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72assert Te6edf3is_remote_hrefTb4b4b4(Ta5d6ff"Ta5d6fffiles/icon.pngTa5d6ff"Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72assert Te6edf3is_remote_hrefTb4b4b4(Te6edf3TINY_PNG_DATATb4b4b4) Tff7b72is Tff7b72False

Tff7b72def Td2a8fftest_oracle_data_image_allowlistTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3is_allowed_data_image_hrefTb4b4b4(Te6edf3TINY_PNG_DATATb4b4b4) Tff7b72is Tff7b72True

Tff7b72assert Te6edf3is_allowed_data_image_hrefTb4b4b4(Ta5d6ff"Ta5d6ffdata:text/html;base64,PHNjcmlwdD4=Ta5d6ff"Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72assert Te6edf3is_allowed_data_image_hrefTb4b4b4(Ta5d6ff"Ta5d6ffdata:image/svg+xml;base64,PHN2Zz4=Ta5d6ff"Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72def Td2a8fftest_sanitize_kml_strips_remote_icon_keeps_placemarkTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3kml Tff7b72= Ta5d6ffbTa5d6ff"""Ta5d6ff<?xml version=Ta5d6ff"Ta5d6ff1.0Ta5d6ff"Ta5d6ff?>

Ta5d6ff <kml xmlns=Ta5d6ff"Ta5d6ffhttp://www.opengis.net/kml/2.2Ta5d6ff"Ta5d6ff><Document>

Ta5d6ff <Placemark><name>P</name>

Ta5d6ff <Style><IconStyle><Icon><href>https://evil.example/i.png</href></Icon></IconStyle></Style>

Ta5d6ff <Point><coordinates>1,2,0</coordinates></Point>

Ta5d6ff </Placemark>

Ta5d6ff </Document></kml>Ta5d6ff"""

Te6edf3result Tff7b72= Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3kmlTb4b4b4)

Tff7b72assert Te6edf3resultTff7b72.Td2a8ffformat Tff7b72== Ta5d6ff"Ta5d6ffkmlTa5d6ff"

Tff7b72assert Te6edf3resultTff7b72.Td2a8fffeature_count Tff7b72== T79c0ff1

Tff7b72assert Ta5d6ff"Ta5d6ffremote_hrefTa5d6ff" Tff7b72in Te6edf3resultTff7b72.Td2a8ffstripped

Tff7b72assert Ta5d6ffbTa5d6ff"Ta5d6ffhttps://evil.exampleTa5d6ff" Tff7b72not Tff7b72in Te6edf3resultTff7b72.Td2a8ffdata

Tff7b72def Td2a8fftest_sanitize_kml_network_link_only_rejectedTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3kml Tff7b72= Ta5d6ffbTa5d6ff"""Ta5d6ff<?xml version=Ta5d6ff"Ta5d6ff1.0Ta5d6ff"Ta5d6ff?>

Ta5d6ff <kml xmlns=Ta5d6ff"Ta5d6ffhttp://www.opengis.net/kml/2.2Ta5d6ff"Ta5d6ff><Document>

Ta5d6ff <NetworkLink><Link><href>https://evil.example/layer.kml</href></Link></NetworkLink>

Ta5d6ff </Document></kml>Ta5d6ff"""

Tff7b72with Te6edf3pytestTff7b72.Td2a8ffraisesTb4b4b4(Te6edf3GeoValidationErrorTb4b4b4) Tff7b72as Te6edf3excTb4b4b4:

Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3kmlTb4b4b4)

Tff7b72assert Te6edf3excTff7b72.Td2a8ffvalueTff7b72.Td2a8ffcode Tff7b72== Ta5d6ff"Ta5d6ffremote_contentTa5d6ff"

Tff7b72def Td2a8fftest_sanitize_kml_rejects_dtdTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3kml Tff7b72= Ta5d6ffbTa5d6ff"""Ta5d6ff<?xml version=Ta5d6ff"Ta5d6ff1.0Ta5d6ff"Ta5d6ff?>

Ta5d6ff <!DOCTYPE kml [<!ENTITY xxe SYSTEM Ta5d6ff"Ta5d6fffile:///etc/passwdTa5d6ff"Ta5d6ff>]>

Ta5d6ff <kml xmlns=Ta5d6ff"Ta5d6ffhttp://www.opengis.net/kml/2.2Ta5d6ff"Ta5d6ff><Document>

Ta5d6ff <Placemark><name>&xxe;</name>

Ta5d6ff <Point><coordinates>1,2,0</coordinates></Point>

Ta5d6ff </Placemark>

Ta5d6ff </Document></kml>Ta5d6ff"""

Tff7b72with Te6edf3pytestTff7b72.Td2a8ffraisesTb4b4b4(Te6edf3GeoValidationErrorTb4b4b4) Tff7b72as Te6edf3excTb4b4b4:

Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3kmlTb4b4b4)

Tff7b72assert Te6edf3excTff7b72.Td2a8ffvalueTff7b72.Td2a8ffcode Tff7b72== Ta5d6ff"Ta5d6ffdtd_forbiddenTa5d6ff"

Tff7b72def Td2a8fftest_sanitize_kml_keeps_data_png_iconTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3kml Tff7b72= Ta5d6fffTa5d6ff"""Ta5d6ff<?xml version=Ta5d6ff"Ta5d6ff1.0Ta5d6ff"Ta5d6ff?>

Ta5d6ff <kml xmlns=Ta5d6ff"Ta5d6ffhttp://www.opengis.net/kml/2.2Ta5d6ff"Ta5d6ff><Document>

Ta5d6ff <Placemark><name>P</name>

Ta5d6ff <Style><IconStyle><Icon><href>Tffd700{Te6edf3TINY_PNG_DATATffd700}Ta5d6ff</href></Icon></IconStyle></Style>

Ta5d6ff <Point><coordinates>1,2,0</coordinates></Point>

Ta5d6ff </Placemark>

Ta5d6ff </Document></kml>Ta5d6ff"""Tff7b72.Td2a8ffencodeTb4b4b4(Tb4b4b4)

Te6edf3result Tff7b72= Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3kmlTb4b4b4)

Tff7b72assert Te6edf3resultTff7b72.Td2a8fffeature_count Tff7b72== T79c0ff1

Tff7b72assert Ta5d6ffbTa5d6ff"Ta5d6ffdata:image/pngTa5d6ff" Tff7b72in Te6edf3resultTff7b72.Td2a8ffdata

Tff7b72def Td2a8fftest_sanitize_kml_flattens_cdata_html_descriptionTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3kml Tff7b72= Ta5d6ffbTa5d6ff"""Ta5d6ff<?xml version=Ta5d6ff"Ta5d6ff1.0Ta5d6ff"Ta5d6ff encoding=Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Ta5d6ff?>

Ta5d6ff <kml xmlns=Ta5d6ff"Ta5d6ffhttp://www.opengis.net/kml/2.2Ta5d6ff"Ta5d6ff><Document>

Ta5d6ff <Placemark><name>Leaking Tanks</name>

Ta5d6ff <description><![CDATA[<h2>Hostile</h2><script>alert(1)</script>]]></description>

Ta5d6ff <Point><coordinates>-117.99,33.78,0</coordinates></Point>

Ta5d6ff </Placemark>

Ta5d6ff </Document></kml>Ta5d6ff"""

Te6edf3result Tff7b72= Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3kmlTb4b4b4)

Tff7b72assert Te6edf3resultTff7b72.Td2a8fffeature_count Tff7b72== T79c0ff1

Tff7b72assert Ta5d6ff"Ta5d6ffhtml_descriptionTa5d6ff" Tff7b72in Te6edf3resultTff7b72.Td2a8ffstripped

Te6edf3lower Tff7b72= Te6edf3resultTff7b72.Td2a8ffdataTff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4)

Tff7b72assert Ta5d6ffbTa5d6ff"Ta5d6ff<scriptTa5d6ff" Tff7b72not Tff7b72in Te6edf3lower

Tff7b72assert Ta5d6ffbTa5d6ff"Ta5d6ff<h2Ta5d6ff" Tff7b72not Tff7b72in Te6edf3lower

Tff7b72assert Ta5d6ffbTa5d6ff"Ta5d6ffhostileTa5d6ff" Tff7b72in Te6edf3lower

Tff7b72def Td2a8fftest_sanitize_kmz_skips_unreferenced_svg_keeps_placemarkTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3kml Tff7b72= Ta5d6ffbTa5d6ff"""Ta5d6ff<?xml version=Ta5d6ff"Ta5d6ff1.0Ta5d6ff"Ta5d6ff?>

Ta5d6ff <kml xmlns=Ta5d6ff"Ta5d6ffhttp://www.opengis.net/kml/2.2Ta5d6ff"Ta5d6ff><Document>

Ta5d6ff <Placemark><Point><coordinates>1,2,0</coordinates></Point></Placemark>

Ta5d6ff </Document></kml>Ta5d6ff"""

Te6edf3data Tff7b72= Te6edf3_kmzTb4b4b4(Tb4b4b4{Ta5d6ff"Ta5d6ffdoc.kmlTa5d6ff"Tb4b4b4: Te6edf3kmlTb4b4b4, Ta5d6ff"Ta5d6fficon.svgTa5d6ff"Tb4b4b4: Ta5d6ffbTa5d6ff"Ta5d6ff<svg></svg>Ta5d6ff"Tb4b4b4}Tb4b4b4)

Te6edf3result Tff7b72= Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3dataTb4b4b4)

Tff7b72assert Te6edf3resultTff7b72.Td2a8ffformat Tff7b72== Ta5d6ff"Ta5d6ffkmzTa5d6ff"

Tff7b72assert Te6edf3resultTff7b72.Td2a8fffeature_count Tff7b72== T79c0ff1

Tff7b72assert Ta5d6ff"Ta5d6ffskipped_kmz_entryTa5d6ff" Tff7b72in Te6edf3resultTff7b72.Td2a8ffstripped

Tff7b72with Te6edf3zipfileTff7b72.Td2a8ffZipFileTb4b4b4(Te6edf3ioTff7b72.Td2a8ffBytesIOTb4b4b4(Te6edf3resultTff7b72.Td2a8ffdataTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3zfTb4b4b4:

Te6edf3names Tff7b72= Tb4b4b4[

Te6edf3nTff7b72.Td2a8ffreplaceTb4b4b4(Ta5d6ff"Tffea00\\Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)Tff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4) Tff7b72for Te6edf3n Tff7b72in Te6edf3zfTff7b72.Td2a8ffnamelistTb4b4b4(Tb4b4b4) Tff7b72if Tff7b72not Te6edf3nTff7b72.Td2a8ffendswithTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)

Tb4b4b4]

Tff7b72assert Ta5d6ff"Ta5d6ffdoc.kmlTa5d6ff" Tff7b72in Te6edf3names

Tff7b72assert Ta5d6ff"Ta5d6fficon.svgTa5d6ff" Tff7b72not Tff7b72in Te6edf3names

Tff7b72def Td2a8fftest_sanitize_kmz_skips_arcgis_xsl_sidecarTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3kml Tff7b72= Ta5d6ffbTa5d6ff"""Ta5d6ff<?xml version=Ta5d6ff"Ta5d6ff1.0Ta5d6ff"Ta5d6ff?>

Ta5d6ff <kml xmlns=Ta5d6ff"Ta5d6ffhttp://www.opengis.net/kml/2.2Ta5d6ff"Ta5d6ff><Document>

Ta5d6ff <Style><IconStyle><Icon><href>Layer0_Symbol.png</href></Icon></IconStyle></Style>

Ta5d6ff <Placemark><name>ArcGIS Point</name>

Ta5d6ff <styleUrl>#s</styleUrl>

Ta5d6ff <Point><coordinates>1,2,0</coordinates></Point>

Ta5d6ff </Placemark>

Ta5d6ff </Document></kml>Ta5d6ff"""

Te6edf3data Tff7b72= Te6edf3_kmzTb4b4b4(

Tb4b4b4{

Ta5d6ff"Ta5d6ffdoc.kmlTa5d6ff"Tb4b4b4: Te6edf3kmlTb4b4b4,

Ta5d6ff"Ta5d6ffF2E8A9CB2E0A446C9BCA87742DD683E5.xslTa5d6ff"Tb4b4b4: Tb4b4b4(

Ta5d6ffbTa5d6ff"Ta5d6ff<?xml version=Ta5d6ff'Ta5d6ff1.0Ta5d6ff'Ta5d6ff?>Ta5d6ff"

Ta5d6ffbTa5d6ff"Ta5d6ff<xsl:stylesheet xmlns:xsl=Ta5d6ff'Ta5d6ffhttp://www.w3.org/1999/XSL/TransformTa5d6ff'Ta5d6ff version=Ta5d6ff'Ta5d6ff1.0Ta5d6ff'Ta5d6ff/>Ta5d6ff"

Tb4b4b4)Tb4b4b4,

Ta5d6ff"Ta5d6ffLayer0_Symbol.pngTa5d6ff"Tb4b4b4: Te6edf3TINY_PNGTb4b4b4,

Tb4b4b4}

Tb4b4b4)

Te6edf3result Tff7b72= Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3dataTb4b4b4)

Tff7b72assert Te6edf3resultTff7b72.Td2a8ffformat Tff7b72== Ta5d6ff"Ta5d6ffkmzTa5d6ff"

Tff7b72assert Te6edf3resultTff7b72.Td2a8fffeature_count Tff7b72== T79c0ff1

Tff7b72assert Ta5d6ff"Ta5d6ffskipped_kmz_entryTa5d6ff" Tff7b72in Te6edf3resultTff7b72.Td2a8ffstripped

Tff7b72with Te6edf3zipfileTff7b72.Td2a8ffZipFileTb4b4b4(Te6edf3ioTff7b72.Td2a8ffBytesIOTb4b4b4(Te6edf3resultTff7b72.Td2a8ffdataTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3zfTb4b4b4:

Te6edf3names Tff7b72= Tb4b4b4[Te6edf3nTff7b72.Td2a8ffreplaceTb4b4b4(Ta5d6ff"Tffea00\\Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4) Tff7b72for Te6edf3n Tff7b72in Te6edf3zfTff7b72.Td2a8ffnamelistTb4b4b4(Tb4b4b4) Tff7b72if Tff7b72not Te6edf3nTff7b72.Td2a8ffendswithTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)Tb4b4b4]

Tff7b72assert Ta5d6ff"Ta5d6ffdoc.kmlTa5d6ff" Tff7b72in Te6edf3names

Tff7b72assert Ta5d6ff"Ta5d6ffLayer0_Symbol.pngTa5d6ff" Tff7b72in Te6edf3names

Tff7b72assert Tff7b72not Tffa657anyTb4b4b4(Te6edf3nTff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4)Tff7b72.Td2a8ffendswithTb4b4b4(Ta5d6ff"Ta5d6ff.xslTa5d6ff"Tb4b4b4) Tff7b72for Te6edf3n Tff7b72in Te6edf3namesTb4b4b4)

Tff7b72def Td2a8fftest_sanitize_kmz_keeps_zip_local_pngTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3kml Tff7b72= Ta5d6ffbTa5d6ff"""Ta5d6ff<?xml version=Ta5d6ff"Ta5d6ff1.0Ta5d6ff"Ta5d6ff?>

Ta5d6ff <kml xmlns=Ta5d6ff"Ta5d6ffhttp://www.opengis.net/kml/2.2Ta5d6ff"Ta5d6ff><Document>

Ta5d6ff <Placemark><name>Z</name>

Ta5d6ff <Style><IconStyle><Icon><href>files/icon.png</href></Icon></IconStyle></Style>

Ta5d6ff <Point><coordinates>1,2,0</coordinates></Point>

Ta5d6ff </Placemark>

Ta5d6ff </Document></kml>Ta5d6ff"""

Te6edf3data Tff7b72= Te6edf3_kmzTb4b4b4(Tb4b4b4{Ta5d6ff"Ta5d6ffdoc.kmlTa5d6ff"Tb4b4b4: Te6edf3kmlTb4b4b4, Ta5d6ff"Ta5d6fffiles/icon.pngTa5d6ff"Tb4b4b4: Te6edf3TINY_PNGTb4b4b4}Tb4b4b4)

Te6edf3result Tff7b72= Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3dataTb4b4b4)

Tff7b72assert Te6edf3resultTff7b72.Td2a8ffformat Tff7b72== Ta5d6ff"Ta5d6ffkmzTa5d6ff"

Tff7b72assert Te6edf3resultTff7b72.Td2a8fffeature_count Tff7b72== T79c0ff1

Tff7b72with Te6edf3zipfileTff7b72.Td2a8ffZipFileTb4b4b4(Te6edf3ioTff7b72.Td2a8ffBytesIOTb4b4b4(Te6edf3resultTff7b72.Td2a8ffdataTb4b4b4)Tb4b4b4) Tff7b72as Te6edf3zfTb4b4b4:

Te6edf3names Tff7b72= Tb4b4b4[Te6edf3nTff7b72.Td2a8ffreplaceTb4b4b4(Ta5d6ff"Tffea00\\Ta5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4) Tff7b72for Te6edf3n Tff7b72in Te6edf3zfTff7b72.Td2a8ffnamelistTb4b4b4(Tb4b4b4) Tff7b72if Tff7b72not Te6edf3nTff7b72.Td2a8ffendswithTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)Tb4b4b4]

Tff7b72assert Ta5d6ff"Ta5d6ffdoc.kmlTa5d6ff" Tff7b72in Te6edf3names

Tff7b72assert Ta5d6ff"Ta5d6fffiles/icon.pngTa5d6ff" Tff7b72in Te6edf3names

Tff7b72def Td2a8fftest_sanitize_kmz_path_traversal_rejectedTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3data Tff7b72= Te6edf3_kmzTb4b4b4(Tb4b4b4{Ta5d6ff"Ta5d6ff../evil.kmlTa5d6ff"Tb4b4b4: Ta5d6ffbTa5d6ff"Ta5d6ff<kml></kml>Ta5d6ff"Tb4b4b4}Tb4b4b4)

Tff7b72with Te6edf3pytestTff7b72.Td2a8ffraisesTb4b4b4(Te6edf3GeoValidationErrorTb4b4b4) Tff7b72as Te6edf3excTb4b4b4:

Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3dataTb4b4b4)

Tff7b72assert Te6edf3excTff7b72.Td2a8ffvalueTff7b72.Td2a8ffcode Tff7b72in Tb4b4b4(Ta5d6ff"Ta5d6ffpath_traversalTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffkmz_missing_kmlTa5d6ff"Tb4b4b4)

Tff7b72def Td2a8fftest_sanitize_kml_strips_remote_groundoverlayTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3kml Tff7b72= Ta5d6ffbTa5d6ff"""Ta5d6ff<?xml version=Ta5d6ff"Ta5d6ff1.0Ta5d6ff"Ta5d6ff?>

Ta5d6ff <kml xmlns=Ta5d6ff"Ta5d6ffhttp://www.opengis.net/kml/2.2Ta5d6ff"Ta5d6ff><Document>

Ta5d6ff <Placemark><name>P</name>

Ta5d6ff <Point><coordinates>1,2,0</coordinates></Point>

Ta5d6ff </Placemark>

Ta5d6ff <GroundOverlay>

Ta5d6ff <Icon><href>https://evil.example/overlay.png</href></Icon>

Ta5d6ff <LatLonBox><north>1</north><south>0</south><east>1</east><west>0</west></LatLonBox>

Ta5d6ff </GroundOverlay>

Ta5d6ff </Document></kml>Ta5d6ff"""

Te6edf3result Tff7b72= Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3kmlTb4b4b4)

Tff7b72assert Te6edf3resultTff7b72.Td2a8fffeature_count Tff7b72== T79c0ff1

Tff7b72assert Ta5d6ff"Ta5d6ffremote_overlayTa5d6ff" Tff7b72in Te6edf3resultTff7b72.Td2a8ffstripped

Tff7b72assert Ta5d6ffbTa5d6ff"Ta5d6ffhttps://evil.exampleTa5d6ff" Tff7b72not Tff7b72in Te6edf3resultTff7b72.Td2a8ffdata

Tff7b72def Td2a8fftest_sanitize_geojson_strips_http_iconTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3payload Tff7b72= Te6edf3jsonTff7b72.Td2a8ffdumpsTb4b4b4(

Tb4b4b4{

Ta5d6ff"Ta5d6fftypeTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffFeatureCollectionTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6fffeaturesTa5d6ff"Tb4b4b4: Tb4b4b4[

Tb4b4b4{

Ta5d6ff"Ta5d6fftypeTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffFeatureTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffpropertiesTa5d6ff"Tb4b4b4: Tb4b4b4{

Ta5d6ff"Ta5d6ffnameTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffATa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffhrefTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffhttps://evil.example/i.pngTa5d6ff"Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Ta5d6ff"Ta5d6ffgeometryTa5d6ff"Tb4b4b4: Tb4b4b4{Ta5d6ff"Ta5d6fftypeTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ffPointTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffcoordinatesTa5d6ff"Tb4b4b4: Tb4b4b4[T79c0ff1.0Tb4b4b4, T79c0ff2.0Tb4b4b4]Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4]Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4)Tff7b72.Td2a8ffencodeTb4b4b4(Tb4b4b4)

Te6edf3result Tff7b72= Te6edf3sanitize_geo_bytesTb4b4b4(Te6edf3payloadTb4b4b4)

Te6edf3obj Tff7b72= Te6edf3jsonTff7b72.Td2a8ffloadsTb4b4b4(Te6edf3resultTff7b72.Td2a8ffdataTb4b4b4)

Tff7b72assert Ta5d6ff"Ta5d6ffhrefTa5d6ff" Tff7b72not Tff7b72in Te6edf3objTb4b4b4[Ta5d6ff"Ta5d6fffeaturesTa5d6ff"Tb4b4b4]Tb4b4b4[T79c0ff0Tb4b4b4]Tb4b4b4[Ta5d6ff"Ta5d6ffpropertiesTa5d6ff"Tb4b4b4]

Tff7b72assert Te6edf3objTb4b4b4[Ta5d6ff"Ta5d6fffeaturesTa5d6ff"Tb4b4b4]Tb4b4b4[T79c0ff0Tb4b4b4]Tb4b4b4[Ta5d6ff"Ta5d6ffpropertiesTa5d6ff"Tb4b4b4]Tb4b4b4[Ta5d6ff"Ta5d6ffnameTa5d6ff"Tb4b4b4] Tff7b72== Ta5d6ff"Ta5d6ffATa5d6ff"

Tff7b72assert Ta5d6ff"Ta5d6ffremote_hrefTa5d6ff" Tff7b72in Te6edf3resultTff7b72.Td2a8ffstripped