mirror of
https://github.com/github/spec-kit.git
synced 2026-08-03 06:26:30 +08:00
5601830ba3
* harden: bound HTTP reads and enforce strict redirects Add a shared _download_security module (read_response_limited, is_https_or_localhost_http, size constants) and route the GitHub release and Azure DevOps token network reads through bounded reads so an oversized response can't exhaust memory. Add a strict_redirects mode to authentication.open_url: the redirect handler now rejects any redirect whose target isn't HTTPS (or HTTP to localhost), composing with the existing per-hop redirect_validator and auth-stripping. The Azure DevOps token POST is routed through that handler so a 307/308 cannot forward the client_secret body to a non-HTTPS host. Assisted-by: Codex (model: GPT-5, autonomous) * test: align HTTP fakes with bounded reads Assisted-by: Codex (model: GPT-5, autonomous) * fix: tolerate invalid token response encoding Assisted-by: Codex (model: GPT-5, autonomous) * test: align GHES fakes with bounded reads Assisted-by: Codex (model: GPT-5, autonomous) * test: reuse shared upgrade HTTP response helper Assisted-by: Codex (model: GPT-5, autonomous) * fix: include rejected redirect target in error Assisted-by: Codex (model: GPT-5, autonomous) * fix: enforce strict redirects by default Assisted-by: Codex (model: GPT-5, autonomous) * fix: close redirect credential and SSRF gaps Assisted-by: Codex (model: GPT-5, autonomous)
66 lines
1.9 KiB
Python
66 lines
1.9 KiB
Python
"""Shared fixtures and helpers for `specify self upgrade` tests.
|
|
|
|
These helpers patch subprocess, PATH lookup, and release-tag resolution so
|
|
the focused test modules stay isolated from the real environment.
|
|
"""
|
|
|
|
import os
|
|
import subprocess
|
|
|
|
import pytest
|
|
from typer.testing import CliRunner
|
|
|
|
from specify_cli._version import (
|
|
_InstallMethod,
|
|
_UpgradePlan,
|
|
_assemble_installer_argv,
|
|
_detect_install_method,
|
|
_verify_upgrade,
|
|
)
|
|
from tests.conftest import strip_ansi
|
|
from tests.http_helpers import mock_urlopen_response, route_opener_open_through_urlopen
|
|
|
|
__all__ = (
|
|
"SENTINEL_GH_TOKEN",
|
|
"SENTINEL_GITHUB_TOKEN",
|
|
"_InstallMethod",
|
|
"_UpgradePlan",
|
|
"_assemble_installer_argv",
|
|
"_completed_process",
|
|
"_detect_install_method",
|
|
"_verify_upgrade",
|
|
"mock_urlopen_response",
|
|
"requires_posix",
|
|
"route_opener_open_through_urlopen",
|
|
"runner",
|
|
"strip_ansi",
|
|
)
|
|
|
|
runner = CliRunner()
|
|
|
|
# Some installer error-path tests create a relative `./uv` fixture, `chdir`
|
|
# into the tmp dir, and assert POSIX executable-bit semantics (chmod / X_OK).
|
|
# None of that maps cleanly onto Windows: `os.access(path, X_OK)` ignores the
|
|
# mode bits, and pytest cannot rmtree a tmp dir that is still the cwd, so the
|
|
# fixtures raise PermissionError during teardown. Skip these on Windows — the
|
|
# realistic absolute-path and bare-PATH-command branches stay covered there.
|
|
requires_posix = pytest.mark.skipif(
|
|
os.name == "nt",
|
|
reason="relative-path / executable-bit semantics are POSIX-only",
|
|
)
|
|
|
|
SENTINEL_GH_TOKEN = "SENTINEL-GH-TOKEN-VALUE"
|
|
SENTINEL_GITHUB_TOKEN = "SENTINEL-GITHUB-TOKEN-VALUE"
|
|
|
|
|
|
def _completed_process(
|
|
returncode: int, stdout: str = "", stderr: str = ""
|
|
) -> subprocess.CompletedProcess:
|
|
"""Build a subprocess.CompletedProcess for installer / verification calls."""
|
|
return subprocess.CompletedProcess(
|
|
args=["mocked"],
|
|
returncode=returncode,
|
|
stdout=stdout,
|
|
stderr=stderr,
|
|
)
|