提交

backend/tests/test_security_hardening.py

@@ -0,0 +1,34 @@
+"""安全加固：工作流 callbackUrl 与请假 HTTP 回调门禁。"""
+from __future__ import annotations
+
+import pytest
+
+from app.services.workflow_callback import (
+    register_local_callback,
+    validate_callback_url,
+)
+
+
+def test_validate_callback_url_rejects_http():
+    with pytest.raises(ValueError, match="禁止 HTTP"):
+        validate_callback_url("https://evil.example/callback")
+    with pytest.raises(ValueError, match="禁止 HTTP"):
+        validate_callback_url("http://169.254.169.254/latest/meta-data/")
+
+
+def test_validate_callback_url_rejects_unregistered_path():
+    with pytest.raises(ValueError, match="未注册"):
+        validate_callback_url("/api/unknown/callback")
+
+
+def test_validate_callback_url_allows_registered_local_path():
+    path = "/api/test/security-callback"
+    register_local_callback(path, lambda db, business_id, event: None)
+    assert validate_callback_url(path) == path
+    assert validate_callback_url("") is None
+    assert validate_callback_url(None) is None
+
+
+def test_validate_callback_url_rejects_relative_without_slash():
+    with pytest.raises(ValueError, match="本地内部路径"):
+        validate_callback_url("admin/leave/callback")