Security: Replace urllib.request with httpx in WebDAV testing

Browse Source

The `_test_webdav_connection` function previously used `urllib.request.urlopen`
to verify connection credentials. This triggers a Bandit B310 warning because
`urllib` supports multiple schemes (like file://, ftp://) and implicitly follows
redirects.

Although scheme checking and a basic `is_private_ip` validation were implemented,
using `urllib.request` remains risky because a public URL could return an
HTTP redirect to a private IP (e.g., 127.0.0.1) which `urllib` would blindly follow,
causing an SSRF (Server-Side Request Forgery) bypass.

This commit replaces `urllib.request` with `httpx.request` using explicitly
`follow_redirects=False`. This eliminates the B310 vulnerability, ensures
requests only hit the specified URL without following potentially malicious
redirects, and standardizes the application on `httpx` for safer HTTP connections.

In addition to fixing the vulnerability, test coverage is added for the
new WebDAV connections logic.

CI issues (missing imports / unformatted code) are resolved.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

...

This commit is contained in:

google-labs-jules[bot]

2026-03-22 05:02:06 +00:00

parent 8f0905033c

commit d89f18edd8

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

Diff Content Not Available