gitea-admin/gh-christianlouis-dmarq
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Address code review feedback: improve XSS prevention, structured errors, API key logging, CSP warnings

Browse Source 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-09 11:51:58 +00:00
parent 2e22941927
commit 8550799bf8
6 changed files with 77 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/tests/test_security.py
+5 -5
View File
@@ -70,7 +70,7 @@ class TestDomainValidation:
]
for domain in valid_domains:
is_valid, error = validate_domain(domain, check_dns=False)
is_valid, error, error_code = validate_domain(domain, check_dns=False)
assert is_valid, f"Domain {domain} should be valid: {error}"
def test_invalid_domain_format(self):
@@ -89,7 +89,7 @@ class TestDomainValidation:
]
for domain in invalid_domains:
is_valid, error = validate_domain(domain, check_dns=False)
is_valid, error, error_code = validate_domain(domain, check_dns=False)
assert not is_valid, f"Domain '{domain}' should be invalid"
assert error is not None
@@ -107,21 +107,21 @@ class TestDomainValidation:
]
for domain in malicious_domains:
is_valid, error = validate_domain(domain, check_dns=False)
is_valid, error, error_code = validate_domain(domain, check_dns=False)
assert not is_valid, f"Malicious domain '{domain}' should be rejected"
def test_domain_length_limits(self):
"""Test domain length validation."""
# Max label is 63 characters - this should be caught by label length check
long_label = "a" * 64 + ".example.com"
is_valid, error = validate_domain(long_label, check_dns=False)
is_valid, error, error_code = validate_domain(long_label, check_dns=False)
assert not is_valid
# Could be caught by format check or label length check
assert error is not None
# Max domain is 253 characters
long_domain = "a" * 254 # 254 chars, no dot
is_valid, error = validate_domain(long_domain, check_dns=False)
is_valid, error, error_code = validate_domain(long_domain, check_dns=False)
assert not is_valid
assert "too long" in error.lower() or "invalid" in error.lower()