Archived
27 lines
1.7 KiB
Python
27 lines
1.7 KiB
Python
|
import json
|
||
|
|
import logging
|
||
|
|
from fastapi.testclient import TestClient
|
||
|
|
from karldns import DdnsSettings, make_app
|
||
|
|
|
||
|
|
|
||
|
|
def test_creation_audit_preserves_public_provisioning_and_redacts(tmp_path, caplog):
|
||
|
|
app = make_app(DdnsSettings(database_path=tmp_path / 'audit.sqlite3', admin_password='admin', hostname_suffix='example.net'))
|
||
|
|
with TestClient(app) as client, caplog.at_level(logging.WARNING, logger='karldns.security'):
|
||
|
|
for path, body, code in [('/', '', 303), ('/', '<?php eval("super-secret") ?>', 303), ('/api/v1/hostnames', 'super-secret', 201)]:
|
||
|
|
caplog.clear()
|
||
|
|
response = client.post(path, content=body, headers={'X-Request-ID': 'a' * 32}, follow_redirects=False)
|
||
|
|
assert response.status_code == code
|
||
|
|
event = json.loads(next(r.message.removeprefix('KARLDNSSEC ') for r in caplog.records if r.message.startswith('KARLDNSSEC ')))
|
||
|
|
assert event['http']['request']['id'] == response.headers['x-request-id'] == 'a' * 32
|
||
|
|
assert event['labels']['account_created'] is True
|
||
|
|
assert event['labels']['dns_activation'] is False
|
||
|
|
assert event['labels']['php_code_marker'] == ('<?php' in body)
|
||
|
|
assert event['labels']['unexpected_body'] == bool(body)
|
||
|
|
assert 'super-secret' not in json.dumps(event)
|
||
|
|
assert response.headers.get('location', 'no-private-url') not in caplog.text
|
||
|
|
caplog.clear()
|
||
|
|
response = client.post('/', content='x', headers={'X-Request-ID': 'private-invalid-id'}, follow_redirects=False)
|
||
|
|
assert len(response.headers['x-request-id']) == 32
|
||
|
|
assert 'private-invalid-id' not in caplog.text
|
||
|
|
assert app.state.store.count_accounts() == 4
|
||
|
|
assert app.state.store.list_records() == []
|