spb/trouve-ka Public

1# Trouve-KA — tests de prévention SSRF2# Author: Simon-Pierre Boucher3# Contact: contact@spboucher.ai45from trouveka.shared import is_safe_ip, is_safe_url678def test_blocks_loopback_and_private():9    for ip in ("127.0.0.1", "10.0.0.5", "192.168.2.10", "172.16.0.1", "0.0.0.0", "::1", "fc00::1"):10        assert not is_safe_ip(ip), ip111213def test_blocks_link_local_and_metadata():14    assert not is_safe_ip("169.254.169.254")15    assert not is_safe_ip("169.254.1.1")16    assert not is_safe_ip("fe80::1")171819def test_allows_public_ips():20    assert is_safe_ip("142.226.10.10")21    assert is_safe_ip("2607:f8b0::1")222324def test_blocks_localhost_and_schemes():25    assert not is_safe_url("http://localhost/admin", resolve=False)26    assert not is_safe_url("http://foo.localhost/x", resolve=False)27    assert not is_safe_url("http://metadata.google.internal/", resolve=False)28    assert not is_safe_url("file:///etc/passwd", resolve=False)29    assert not is_safe_url("gopher://x.ca", resolve=False)303132def test_blocks_ip_literal_urls():33    assert not is_safe_url("http://127.0.0.1:8080/", resolve=False)34    assert not is_safe_url("http://169.254.169.254/latest/meta-data/", resolve=False)35    assert not is_safe_url("http://[::1]/", resolve=False)363738def test_allows_normal_url_without_resolution():39    assert is_safe_url("https://www.quebec.ca/", resolve=False)40