From b5ed16c1c8d0a678225f5acd3eea7942a07ae805 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 22 Mar 2026 03:58:07 +0000 Subject: [PATCH 1/4] Security: Replace urllib.request with httpx in WebDAV testing The `_test_webdav_connection` function previously used `urllib.request.urlopen` to verify connection credentials. This triggers a Bandit B310 warning because `urllib` supports multiple schemes (like file://, ftp://) and implicitly follows redirects. Although scheme checking and a basic `is_private_ip` validation were implemented, using `urllib.request` remains risky because a public URL could return an HTTP redirect to a private IP (e.g., 127.0.0.1) which `urllib` would blindly follow, causing an SSRF (Server-Side Request Forgery) bypass. This commit replaces `urllib.request` with `httpx.request` using explicitly `follow_redirects=False`. This eliminates the B310 vulnerability, ensures requests only hit the specified URL without following potentially malicious redirects, and standardizes the application on `httpx` for safer HTTP connections. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ app/api/integrations.py | 19 ++++++++----------- 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 7833fd12..fa35a57f 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -2,3 +2,7 @@ **Vulnerability:** The `_test_webdav_connection` function had a custom SSRF check that failed to resolve DNS names, allowing attackers to bypass the check by providing a domain that resolves to an internal IP (e.g., `127.0.0.1`). **Learning:** DNS resolution is required for robust SSRF protection when validating URLs provided by users. **Prevention:** Use a centralized `is_private_ip` function (now in `app/utils/network.py`) that resolves the hostname to its IPs and checks if any are private. +## 2026-03-22 - B310: urllib.request.urlopen replaced with httpx +**Vulnerability:** The `_test_webdav_connection` function used `urllib.request.urlopen`, which natively supports dangerous schemes like `file://` or `ftp://` and follows redirects by default, potentially allowing SSRF bypasses or Local File Inclusion. +**Learning:** `urllib.request` should be avoided for user-supplied URLs. Even when URL schemes are manually validated, `urllib`'s default redirect following behavior can bypass SSRF protections (e.g. redirecting to `127.0.0.1`). +**Prevention:** Use a modern, safer HTTP client like `httpx` with `follow_redirects=False` when testing user-provided URLs. diff --git a/app/api/integrations.py b/app/api/integrations.py index c0d58893..f5b11a16 100644 --- a/app/api/integrations.py +++ b/app/api/integrations.py @@ -608,7 +608,7 @@ def _test_dropbox_connection(config: dict[str, Any] | None, credentials: dict[st def _test_webdav_connection(config: dict[str, Any] | None, credentials: dict[str, Any] | None) -> dict[str, Any]: """Test a WebDAV/Nextcloud connection by issuing an HTTP PROPFIND.""" - import urllib.request + import httpx cfg = config or {} creds = credentials or {} @@ -635,17 +635,14 @@ def _test_webdav_connection(config: dict[str, Any] | None, credentials: dict[str return {"success": False, "message": "URLs pointing to internal or private networks are not allowed"} try: - import base64 + auth = (username, password) if username and password else None + headers = {"Depth": "0"} - req = urllib.request.Request(url, method="PROPFIND") # noqa: S310 - if username and password: - token = base64.b64encode(f"{username}:{password}".encode()).decode() - req.add_header("Authorization", f"Basic {token}") - req.add_header("Depth", "0") - with urllib.request.urlopen(req, timeout=10) as resp: # noqa: S310 - if resp.status < 400: - return {"success": True, "message": "WebDAV connection successful"} - return {"success": False, "message": f"WebDAV returned HTTP {resp.status}"} + # Use httpx for secure connection testing, avoiding urllib vulnerabilities + resp = httpx.request("PROPFIND", url, auth=auth, headers=headers, timeout=10.0, follow_redirects=False) + if resp.status_code < 400: + return {"success": True, "message": "WebDAV connection successful"} + return {"success": False, "message": f"WebDAV returned HTTP {resp.status_code}"} except Exception as exc: # noqa: BLE001 logger.warning("WebDAV connection error for %s: %s", hostname, exc) return {"success": False, "message": "WebDAV connection failed — check URL and credentials"} From cb0fe938123d7e30324b1679b0c786879dc63203 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 22 Mar 2026 04:57:26 +0000 Subject: [PATCH 2/4] Security: Replace urllib.request with httpx in WebDAV testing The `_test_webdav_connection` function previously used `urllib.request.urlopen` to verify connection credentials. This triggers a Bandit B310 warning because `urllib` supports multiple schemes (like file://, ftp://) and implicitly follows redirects. Although scheme checking and a basic `is_private_ip` validation were implemented, using `urllib.request` remains risky because a public URL could return an HTTP redirect to a private IP (e.g., 127.0.0.1) which `urllib` would blindly follow, causing an SSRF (Server-Side Request Forgery) bypass. This commit replaces `urllib.request` with `httpx.request` using explicitly `follow_redirects=False`. This eliminates the B310 vulnerability, ensures requests only hit the specified URL without following potentially malicious redirects, and standardizes the application on `httpx` for safer HTTP connections. In addition to fixing the vulnerability, test coverage is added for the new WebDAV connections logic. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- tests/test_api_integrations.py | 64 ++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) diff --git a/tests/test_api_integrations.py b/tests/test_api_integrations.py index 45336b2d..b6b9009a 100644 --- a/tests/test_api_integrations.py +++ b/tests/test_api_integrations.py @@ -1,5 +1,6 @@ """Tests for the per-user integrations API (app/api/integrations.py).""" +import unittest.mock import pytest from fastapi.testclient import TestClient from sqlalchemy import create_engine @@ -1061,6 +1062,69 @@ class TestConnectionTestEndpoint: assert data["success"] is False assert "scheme" in data["message"].lower() + @unittest.mock.patch("httpx.request") + def test_test_webdav_success(self, mock_request, int_client): + """WebDAV test succeeds with valid credentials and a valid status code.""" + mock_response = unittest.mock.MagicMock() + mock_response.status_code = 207 # Typical WebDAV success for PROPFIND + mock_request.return_value = mock_response + + payload = { + "integration_type": "WEBDAV", + "config": {"url": "https://example.com/webdav"}, + "credentials": {"username": "user1", "password": "password123"}, + } + resp = int_client.post("/api/integrations/test", json=payload) + + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is True + + mock_request.assert_called_once_with( + "PROPFIND", + "https://example.com/webdav", + auth=("user1", "password123"), + headers={"Depth": "0"}, + timeout=10.0, + follow_redirects=False, + ) + + @unittest.mock.patch("httpx.request") + def test_test_webdav_failure_status(self, mock_request, int_client): + """WebDAV test fails if the server returns a 4xx or 5xx status code.""" + mock_response = unittest.mock.MagicMock() + mock_response.status_code = 401 + mock_request.return_value = mock_response + + payload = { + "integration_type": "WEBDAV", + "config": {"url": "https://example.com/webdav"}, + "credentials": {"username": "user1", "password": "wrong"}, + } + resp = int_client.post("/api/integrations/test", json=payload) + + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is False + assert "401" in data["message"] + + @unittest.mock.patch("httpx.request") + def test_test_webdav_exception(self, mock_request, int_client): + """WebDAV test fails gracefully if an exception occurs during the request.""" + mock_request.side_effect = Exception("Connection error") + + payload = { + "integration_type": "WEBDAV", + "config": {"url": "https://example.com/webdav"}, + "credentials": {}, + } + resp = int_client.post("/api/integrations/test", json=payload) + + assert resp.status_code == 200 + data = resp.json() + assert data["success"] is False + assert "failed" in data["message"].lower() + # --------------------------------------------------------------------------- # Quota endpoint tests From 8f0905033c4cd4269717dde64c4830c482407e41 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sun, 22 Mar 2026 04:57:41 +0000 Subject: [PATCH 3/4] style: apply ruff auto-fix - Auto-formatted code with ruff format - Applied ruff linting fixes with --fix Co-authored-by: github-actions[bot] --- tests/test_api_integrations.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/test_api_integrations.py b/tests/test_api_integrations.py index b6b9009a..958a1a86 100644 --- a/tests/test_api_integrations.py +++ b/tests/test_api_integrations.py @@ -1,6 +1,7 @@ """Tests for the per-user integrations API (app/api/integrations.py).""" import unittest.mock + import pytest from fastapi.testclient import TestClient from sqlalchemy import create_engine From d89f18edd885bc49ac6430a797d21e0c4d5e9d36 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 22 Mar 2026 05:02:06 +0000 Subject: [PATCH 4/4] Security: Replace urllib.request with httpx in WebDAV testing The `_test_webdav_connection` function previously used `urllib.request.urlopen` to verify connection credentials. This triggers a Bandit B310 warning because `urllib` supports multiple schemes (like file://, ftp://) and implicitly follows redirects. Although scheme checking and a basic `is_private_ip` validation were implemented, using `urllib.request` remains risky because a public URL could return an HTTP redirect to a private IP (e.g., 127.0.0.1) which `urllib` would blindly follow, causing an SSRF (Server-Side Request Forgery) bypass. This commit replaces `urllib.request` with `httpx.request` using explicitly `follow_redirects=False`. This eliminates the B310 vulnerability, ensures requests only hit the specified URL without following potentially malicious redirects, and standardizes the application on `httpx` for safer HTTP connections. In addition to fixing the vulnerability, test coverage is added for the new WebDAV connections logic. CI issues (missing imports / unformatted code) are resolved. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>