mirror of
https://github.com/we-promise/sure.git
synced 2026-05-24 21:14:56 +00:00
73b6077ac3
* Constrain Lunchflow base URL to trusted endpoint Prevent SSRF by ignoring user-provided Lunchflow base_url values unless they match the canonical Lunchflow HTTPS endpoint. Add model tests covering invalid host/scheme and valid canonicalization behavior. * Linter
32 lines
1.0 KiB
Ruby
32 lines
1.0 KiB
Ruby
require "test_helper"
|
|
|
|
class LunchflowItemTest < ActiveSupport::TestCase
|
|
def setup
|
|
@lunchflow_item = lunchflow_items(:one)
|
|
end
|
|
|
|
test "effective_base_url returns default when base_url blank" do
|
|
@lunchflow_item.base_url = nil
|
|
|
|
assert_equal LunchflowItem::DEFAULT_BASE_URL, @lunchflow_item.effective_base_url
|
|
end
|
|
|
|
test "effective_base_url returns default for non-lunchflow host" do
|
|
@lunchflow_item.base_url = "https://169.254.169.254/latest/meta-data"
|
|
|
|
assert_equal LunchflowItem::DEFAULT_BASE_URL, @lunchflow_item.effective_base_url
|
|
end
|
|
|
|
test "effective_base_url returns default for non-https scheme" do
|
|
@lunchflow_item.base_url = "http://lunchflow.app/api/v1"
|
|
|
|
assert_equal LunchflowItem::DEFAULT_BASE_URL, @lunchflow_item.effective_base_url
|
|
end
|
|
|
|
test "effective_base_url returns canonical default for valid lunchflow url" do
|
|
@lunchflow_item.base_url = "https://lunchflow.app/api/v1/"
|
|
|
|
assert_equal LunchflowItem::DEFAULT_BASE_URL, @lunchflow_item.effective_base_url
|
|
end
|
|
end
|