35 lines
1.2 KiB
Python
35 lines
1.2 KiB
Python
"""安全加固：工作流 callbackUrl 与请假 HTTP 回调门禁。"""
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from app.services.workflow_callback import (
|
|
register_local_callback,
|
|
validate_callback_url,
|
|
)
|
|
|
|
|
|
def test_validate_callback_url_rejects_http():
|
|
with pytest.raises(ValueError, match="禁止 HTTP"):
|
|
validate_callback_url("https://evil.example/callback")
|
|
with pytest.raises(ValueError, match="禁止 HTTP"):
|
|
validate_callback_url("http://169.254.169.254/latest/meta-data/")
|
|
|
|
|
|
def test_validate_callback_url_rejects_unregistered_path():
|
|
with pytest.raises(ValueError, match="未注册"):
|
|
validate_callback_url("/api/unknown/callback")
|
|
|
|
|
|
def test_validate_callback_url_allows_registered_local_path():
|
|
path = "/api/test/security-callback"
|
|
register_local_callback(path, lambda db, business_id, event: None)
|
|
assert validate_callback_url(path) == path
|
|
assert validate_callback_url("") is None
|
|
assert validate_callback_url(None) is None
|
|
|
|
|
|
def test_validate_callback_url_rejects_relative_without_slash():
|
|
with pytest.raises(ValueError, match="本地内部路径"):
|
|
validate_callback_url("admin/leave/callback")
|