--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Node / ReticulumProjects / MeshChatX.git / files / tests / backend / test_rnode_download_url_oracle.py
Displaying Raw • Download
tests/backend/test_rnode_download_url_oracle.py dev (4e4ef052) Text, 1.17 KB
T8b949e# SPDX-License-Identifier: 0BSD
T8b949e"""Oracle: RNode firmware download URL allowlist rejects lookalike hosts."""
Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations
Tff7b72def Td2a8ff_url_allowedTb4b4b4(Te6edf3urlTb4b4b4: Tffa657strTb4b4b4, Te6edf3allowed_prefixesTb4b4b4: Tffa657listTb4b4b4[Tffa657strTb4b4b4]Tb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:
Tff7b72return Tffa657anyTb4b4b4(Te6edf3urlTff7b72.Td2a8ffstartswithTb4b4b4(Te6edf3aTb4b4b4) Tff7b72for Te6edf3a Tff7b72in Te6edf3allowed_prefixesTb4b4b4)
Tff7b72def Td2a8fftest_rnode_download_prefix_oracle_rejects_lookalike_hostsTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3allowed Tff7b72= Tb4b4b4[
Ta5d6ff"Ta5d6ffhttps://github.com/Ta5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffhttps://codeload.github.com/Ta5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffhttps://objects.githubusercontent.com/Ta5d6ff"Tb4b4b4,
Ta5d6ff"Ta5d6ffhttps://release-assets.githubusercontent.com/Ta5d6ff"Tb4b4b4,
Tb4b4b4]
T8b949e# Accept
Tff7b72assert Te6edf3_url_allowedTb4b4b4(
Ta5d6ff"Ta5d6ffhttps://github.com/markqvist/RNode_Firmware/releases/download/v1/x.zipTa5d6ff"Tb4b4b4,
Te6edf3allowedTb4b4b4,
Tb4b4b4)
Tff7b72assert Te6edf3_url_allowedTb4b4b4(
Ta5d6ff"Ta5d6ffhttps://objects.githubusercontent.com/github-production-release-asset-2e65be/1/xTa5d6ff"Tb4b4b4,
Te6edf3allowedTb4b4b4,
Tb4b4b4)
T8b949e# Reject lookalikes / SSRF bait
Tff7b72assert Tff7b72not Te6edf3_url_allowedTb4b4b4(Ta5d6ff"Ta5d6ffhttps://github.com.evil.example/markqvist/x.zipTa5d6ff"Tb4b4b4, Te6edf3allowedTb4b4b4)
Tff7b72assert Tff7b72not Te6edf3_url_allowedTb4b4b4(Ta5d6ff"Ta5d6ffhttps://evil.example/https://github.com/x.zipTa5d6ff"Tb4b4b4, Te6edf3allowedTb4b4b4)
Tff7b72assert Tff7b72not Te6edf3_url_allowedTb4b4b4(Ta5d6ff"Ta5d6ffhttp://127.0.0.1/firmware.zipTa5d6ff"Tb4b4b4, Te6edf3allowedTb4b4b4)
Tff7b72assert Tff7b72not Te6edf3_url_allowedTb4b4b4(Ta5d6ff"Ta5d6ffhttps://github.com.attacker/xTa5d6ff"Tb4b4b4, Te6edf3allowedTb4b4b4)
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────