Fix code formatting and linting issues
- Auto-format all Python files with black and isort - Remove unused imports with autoflake - Fix flake8 issues (missing newlines, blank lines, etc.) - Fix nonlocal/global scope issues in main.py - Fix security.py import order (E402) - Remove f-string without placeholders - Add nosec comment for intentional exception handling - Fix test imports to match refactored DMARCParser API Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
@@ -5,52 +5,49 @@ Tests authentication, input validation, file upload security, and other security
|
||||
"""
|
||||
|
||||
import pytest
|
||||
from fastapi import HTTPException
|
||||
from app.core.security import (
|
||||
generate_api_key,
|
||||
add_api_key,
|
||||
generate_api_key,
|
||||
verify_api_key,
|
||||
verify_password,
|
||||
get_password_hash
|
||||
)
|
||||
from app.utils.domain_validator import validate_domain, validate_domain_config
|
||||
from app.services.dmarc_parser import DMARCParser
|
||||
from app.utils.domain_validator import validate_domain, validate_domain_config
|
||||
|
||||
|
||||
class TestAuthentication:
|
||||
"""Test authentication and API key functionality."""
|
||||
|
||||
|
||||
def test_generate_api_key(self):
|
||||
"""Test API key generation."""
|
||||
key1 = generate_api_key()
|
||||
key2 = generate_api_key()
|
||||
|
||||
|
||||
# Keys should be 64 characters (32 bytes hex encoded)
|
||||
assert len(key1) == 64
|
||||
assert len(key2) == 64
|
||||
|
||||
|
||||
# Keys should be unique
|
||||
assert key1 != key2
|
||||
|
||||
|
||||
# Keys should be hexadecimal
|
||||
assert all(c in '0123456789abcdef' for c in key1)
|
||||
|
||||
assert all(c in "0123456789abcdef" for c in key1)
|
||||
|
||||
def test_add_and_verify_api_key(self):
|
||||
"""Test adding and verifying API keys."""
|
||||
key = generate_api_key()
|
||||
|
||||
|
||||
# Key should not be valid before adding
|
||||
assert not verify_api_key(key)
|
||||
|
||||
|
||||
# Add key
|
||||
assert add_api_key(key)
|
||||
|
||||
|
||||
# Key should now be valid
|
||||
assert verify_api_key(key)
|
||||
|
||||
|
||||
# Adding same key again should return False
|
||||
assert not add_api_key(key)
|
||||
|
||||
|
||||
def test_password_hashing(self):
|
||||
"""Test password hashing and verification."""
|
||||
# Skip this test if bcrypt has issues
|
||||
@@ -59,20 +56,20 @@ class TestAuthentication:
|
||||
|
||||
class TestDomainValidation:
|
||||
"""Test domain validation security."""
|
||||
|
||||
|
||||
def test_valid_domains(self):
|
||||
"""Test validation of legitimate domains."""
|
||||
valid_domains = [
|
||||
"example.com",
|
||||
"subdomain.example.com",
|
||||
"my-domain.example.org",
|
||||
"test123.example.net"
|
||||
"test123.example.net",
|
||||
]
|
||||
|
||||
|
||||
for domain in valid_domains:
|
||||
is_valid, error, error_code = validate_domain(domain, check_dns=False)
|
||||
assert is_valid, f"Domain {domain} should be valid: {error}"
|
||||
|
||||
|
||||
def test_invalid_domain_format(self):
|
||||
"""Test rejection of invalid domain formats."""
|
||||
invalid_domains = [
|
||||
@@ -87,12 +84,12 @@ class TestDomainValidation:
|
||||
"a" * 64 + ".com", # Label too long (>63 chars)
|
||||
"a" * 250 + ".com", # Domain too long (>253 chars)
|
||||
]
|
||||
|
||||
|
||||
for domain in invalid_domains:
|
||||
is_valid, error, error_code = validate_domain(domain, check_dns=False)
|
||||
assert not is_valid, f"Domain '{domain}' should be invalid"
|
||||
assert error is not None
|
||||
|
||||
|
||||
def test_malicious_domain_input(self):
|
||||
"""Test rejection of domains with malicious characters."""
|
||||
malicious_domains = [
|
||||
@@ -103,13 +100,13 @@ class TestDomainValidation:
|
||||
"example.com`cat /etc/passwd`",
|
||||
"example.com$USER",
|
||||
'example.com"test',
|
||||
"example.com\\\\test"
|
||||
"example.com\\\\test",
|
||||
]
|
||||
|
||||
|
||||
for domain in malicious_domains:
|
||||
is_valid, error, error_code = validate_domain(domain, check_dns=False)
|
||||
assert not is_valid, f"Malicious domain '{domain}' should be rejected"
|
||||
|
||||
|
||||
def test_domain_length_limits(self):
|
||||
"""Test domain length validation."""
|
||||
# Max label is 63 characters - this should be caught by label length check
|
||||
@@ -118,44 +115,35 @@ class TestDomainValidation:
|
||||
assert not is_valid
|
||||
# Could be caught by format check or label length check
|
||||
assert error is not None
|
||||
|
||||
|
||||
# Max domain is 253 characters
|
||||
long_domain = "a" * 254 # 254 chars, no dot
|
||||
is_valid, error, error_code = validate_domain(long_domain, check_dns=False)
|
||||
assert not is_valid
|
||||
assert "too long" in error.lower() or "invalid" in error.lower()
|
||||
|
||||
|
||||
def test_domain_config_validation(self):
|
||||
"""Test domain configuration validation."""
|
||||
# Valid config
|
||||
valid_config = {
|
||||
"name": "example.com",
|
||||
"description": "Test domain"
|
||||
}
|
||||
valid_config = {"name": "example.com", "description": "Test domain"}
|
||||
result = validate_domain_config(valid_config)
|
||||
assert result["valid"]
|
||||
assert len(result["errors"]) == 0
|
||||
|
||||
|
||||
# Missing name
|
||||
invalid_config = {"description": "Test"}
|
||||
result = validate_domain_config(invalid_config)
|
||||
assert not result["valid"]
|
||||
assert "name" in result["errors"]
|
||||
|
||||
|
||||
# Description too long
|
||||
long_desc_config = {
|
||||
"name": "example.com",
|
||||
"description": "a" * 501
|
||||
}
|
||||
long_desc_config = {"name": "example.com", "description": "a" * 501}
|
||||
result = validate_domain_config(long_desc_config)
|
||||
assert not result["valid"]
|
||||
assert "description" in result["errors"]
|
||||
|
||||
|
||||
# Malicious description
|
||||
malicious_config = {
|
||||
"name": "example.com",
|
||||
"description": "<script>alert('xss')</script>"
|
||||
}
|
||||
malicious_config = {"name": "example.com", "description": "<script>alert('xss')</script>"}
|
||||
result = validate_domain_config(malicious_config)
|
||||
assert not result["valid"]
|
||||
assert "description" in result["errors"]
|
||||
@@ -163,35 +151,39 @@ class TestDomainValidation:
|
||||
|
||||
class TestFileUploadSecurity:
|
||||
"""Test file upload security features."""
|
||||
|
||||
|
||||
def test_file_size_limit(self):
|
||||
"""Test file size limit enforcement."""
|
||||
parser = DMARCParser()
|
||||
|
||||
|
||||
# Create a file that's too large (> 10 MB)
|
||||
large_content = b"x" * (11 * 1024 * 1024)
|
||||
|
||||
|
||||
with pytest.raises(ValueError) as exc_info:
|
||||
parser.parse_file(large_content, "test.xml")
|
||||
|
||||
|
||||
assert "too large" in str(exc_info.value).lower()
|
||||
|
||||
|
||||
class TestXMLParsingSecurity:
|
||||
"""Test XML parsing security features."""
|
||||
|
||||
|
||||
def test_defusedxml_import(self):
|
||||
"""Test that defusedxml is being used."""
|
||||
import app.services.dmarc_parser as parser_module
|
||||
|
||||
|
||||
# Check that the module uses defusedxml
|
||||
assert hasattr(parser_module, 'ET')
|
||||
assert hasattr(parser_module, "ET")
|
||||
# The module name should contain 'defusedxml'
|
||||
assert 'defusedxml' in str(parser_module.ET.__name__).lower() or \
|
||||
'defusedxml' in str(parser_module.ET.__module__).lower()
|
||||
|
||||
assert (
|
||||
"defusedxml" in str(parser_module.ET.__name__).lower()
|
||||
or "defusedxml" in str(parser_module.ET.__module__).lower()
|
||||
)
|
||||
|
||||
def test_xml_entity_expansion_protection(self):
|
||||
"""Test protection against XML entity expansion attacks."""
|
||||
parser = DMARCParser()
|
||||
|
||||
|
||||
# XXE attack payload
|
||||
xxe_payload = b"""<?xml version="1.0"?>
|
||||
<!DOCTYPE foo [
|
||||
@@ -203,7 +195,7 @@ class TestXMLParsingSecurity:
|
||||
</report_metadata>
|
||||
</feedback>
|
||||
"""
|
||||
|
||||
|
||||
# Should either fail parsing or not expand the entity
|
||||
# defusedxml should prevent this
|
||||
try:
|
||||
|
||||
Reference in New Issue
Block a user