mirror of
https://github.com/github/spec-kit.git
synced 2026-08-03 06:26:30 +08:00
5601830ba3
* harden: bound HTTP reads and enforce strict redirects Add a shared _download_security module (read_response_limited, is_https_or_localhost_http, size constants) and route the GitHub release and Azure DevOps token network reads through bounded reads so an oversized response can't exhaust memory. Add a strict_redirects mode to authentication.open_url: the redirect handler now rejects any redirect whose target isn't HTTPS (or HTTP to localhost), composing with the existing per-hop redirect_validator and auth-stripping. The Azure DevOps token POST is routed through that handler so a 307/308 cannot forward the client_secret body to a non-HTTPS host. Assisted-by: Codex (model: GPT-5, autonomous) * test: align HTTP fakes with bounded reads Assisted-by: Codex (model: GPT-5, autonomous) * fix: tolerate invalid token response encoding Assisted-by: Codex (model: GPT-5, autonomous) * test: align GHES fakes with bounded reads Assisted-by: Codex (model: GPT-5, autonomous) * test: reuse shared upgrade HTTP response helper Assisted-by: Codex (model: GPT-5, autonomous) * fix: include rejected redirect target in error Assisted-by: Codex (model: GPT-5, autonomous) * fix: enforce strict redirects by default Assisted-by: Codex (model: GPT-5, autonomous) * fix: close redirect credential and SSRF gaps Assisted-by: Codex (model: GPT-5, autonomous)
47 lines
1.5 KiB
Python
47 lines
1.5 KiB
Python
"""HTTP test helpers shared by CLI tests."""
|
|
|
|
import io
|
|
import json
|
|
import urllib.request
|
|
from unittest.mock import MagicMock
|
|
|
|
import pytest
|
|
|
|
|
|
def mock_urlopen_response(payload: dict) -> MagicMock:
|
|
"""Build a urlopen context-manager mock whose read returns JSON."""
|
|
body = json.dumps(payload).encode("utf-8")
|
|
resp = MagicMock()
|
|
resp.read.side_effect = io.BytesIO(body).read
|
|
cm = MagicMock()
|
|
cm.__enter__.return_value = resp
|
|
cm.__exit__.return_value = False
|
|
return cm
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def route_opener_open_through_urlopen(monkeypatch):
|
|
"""Route build_opener().open through urllib.request.urlopen.
|
|
|
|
``open_url(...)`` fetches via ``build_opener(...).open()``, which bypasses
|
|
``urllib.request.urlopen`` — and with it the urlopen patches these test
|
|
modules are built on.
|
|
Delegating ``open()`` to urlopen at call time keeps those patches
|
|
effective; the redirect handler's own behavior is covered by
|
|
``TestRedirectStripping`` in test_authentication.py.
|
|
|
|
Import this fixture into a test module to activate it there.
|
|
"""
|
|
|
|
class _UrlopenDelegatingOpener:
|
|
def open(self, req, data=None, timeout=None):
|
|
if data is None:
|
|
return urllib.request.urlopen(req, timeout=timeout)
|
|
return urllib.request.urlopen(req, data=data, timeout=timeout)
|
|
|
|
monkeypatch.setattr(
|
|
urllib.request,
|
|
"build_opener",
|
|
lambda *handlers: _UrlopenDelegatingOpener(),
|
|
)
|