From d89f18edd885bc49ac6430a797d21e0c4d5e9d36 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 22 Mar 2026 05:02:06 +0000
Subject: [PATCH] Security: Replace urllib.request with httpx in WebDAV testing

The `_test_webdav_connection` function previously used `urllib.request.urlopen`
to verify connection credentials. This triggers a Bandit B310 warning because
`urllib` supports multiple schemes (like file://, ftp://) and implicitly follows
redirects.

Although scheme checking and a basic `is_private_ip` validation were implemented,
using `urllib.request` remains risky because a public URL could return an
HTTP redirect to a private IP (e.g., 127.0.0.1) which `urllib` would blindly follow,
causing an SSRF (Server-Side Request Forgery) bypass.

This commit replaces `urllib.request` with `httpx.request` using explicitly
`follow_redirects=False`. This eliminates the B310 vulnerability, ensures
requests only hit the specified URL without following potentially malicious
redirects, and standardizes the application on `httpx` for safer HTTP connections.

In addition to fixing the vulnerability, test coverage is added for the
new WebDAV connections logic.

CI issues (missing imports / unformatted code) are resolved.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>