Archived
StasonJatham
5c46b47937
Preserve the GitHub history and the newer deployed source from ct_134_karldns. Exclude runtime data, credentials, AppleDouble files and local backup copies. Make Gitea the canonical source for documentation, package metadata and project links.
28 lines
1.7 KiB
Python
28 lines
1.7 KiB
Python
import json
|
|
import logging
|
|
from fastapi.testclient import TestClient
|
|
from karldns import DdnsSettings, make_app
|
|
|
|
|
|
def test_creation_audit_preserves_public_provisioning_and_redacts(tmp_path, caplog):
|
|
app = make_app(DdnsSettings(database_path=tmp_path / 'audit.sqlite3', admin_password='admin', hostname_suffix='example.net'))
|
|
with TestClient(app) as client, caplog.at_level(logging.WARNING, logger='karldns.security'):
|
|
for path, body, code in [('/', '', 303), ('/', '<?php eval("super-secret") ?>', 303), ('/api/v1/hostnames', 'super-secret', 201)]:
|
|
caplog.clear()
|
|
response = client.post(path, content=body, headers={'X-Request-ID': 'a' * 32}, follow_redirects=False)
|
|
assert response.status_code == code
|
|
event = json.loads(next(r.message.removeprefix('KARLDNSSEC ') for r in caplog.records if r.message.startswith('KARLDNSSEC ')))
|
|
assert event['http']['request']['id'] == response.headers['x-request-id'] == 'a' * 32
|
|
assert event['labels']['account_created'] is True
|
|
assert event['labels']['dns_activation'] is False
|
|
assert event['labels']['php_code_marker'] == ('<?php' in body)
|
|
assert event['labels']['unexpected_body'] == bool(body)
|
|
assert 'super-secret' not in json.dumps(event)
|
|
assert response.headers.get('location', 'no-private-url') not in caplog.text
|
|
caplog.clear()
|
|
response = client.post('/', content='x', headers={'X-Request-ID': 'private-invalid-id'}, follow_redirects=False)
|
|
assert len(response.headers['x-request-id']) == 32
|
|
assert 'private-invalid-id' not in caplog.text
|
|
assert app.state.store.count_accounts() == 4
|
|
assert app.state.store.list_records() == []
|