lee/changedetection.io
1
0
Fork 0
mirror of https://github.com/dgtlmoon/changedetection.io.git synced 2025-12-14 03:56:08 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Unify safe URL checking to the one function, strengthen tests and filters (#3564)
Some checks failed
Build and push containers / metadata (push) Has been cancelled
Details
Build and push containers / build-push-containers (push) Has been cancelled
Details
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Build distribution 📦 (push) Has been cancelled
Details
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Test the built package works basically. (push) Has been cancelled
Details
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Publish Python 🐍 distribution 📦 to PyPI (push) Has been cancelled
Details
ChangeDetection.io Container Build Test / Build linux/amd64 (alpine) (push) Has been cancelled
Details
ChangeDetection.io Container Build Test / Build linux/arm64 (alpine) (push) Has been cancelled
Details
ChangeDetection.io Container Build Test / Build linux/amd64 (main) (push) Has been cancelled
Details
ChangeDetection.io Container Build Test / Build linux/arm/v7 (main) (push) Has been cancelled
Details
ChangeDetection.io Container Build Test / Build linux/arm/v8 (main) (push) Has been cancelled
Details
ChangeDetection.io Container Build Test / Build linux/arm64 (main) (push) Has been cancelled
Details
ChangeDetection.io App Test / lint-code (push) Has been cancelled
Details
ChangeDetection.io App Test / test-application-3-10 (push) Has been cancelled
Details
ChangeDetection.io App Test / test-application-3-11 (push) Has been cancelled
Details
ChangeDetection.io App Test / test-application-3-12 (push) Has been cancelled
Details
ChangeDetection.io App Test / test-application-3-13 (push) Has been cancelled
Details

Browse Source
This commit is contained in:
dgtlmoon
2025-10-28 13:24:37 +01:00
committed by GitHub
parent 66aec365c2
commit ab0b85d088
11 changed files with 151 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
changedetectionio/tests/test_security.py
View File

@@ -25,7 +25,7 @@ def set_original_response():
return None
def test_bad_access(client, live_server, measure_memory_usage):
res = client.post(
url_for("imports.import_page"),
data={"urls": 'https://localhost'},
@@ -48,7 +48,7 @@ def test_bad_access(client, live_server, measure_memory_usage):
follow_redirects=True
)
assert b'Watch protocol is not permitted by SAFE_PROTOCOL_REGEX' in res.data
assert b'Watch protocol is not permitted or invalid URL format' in res.data
res = client.post(
url_for("ui.ui_views.form_quick_watch_add"),
@@ -56,7 +56,7 @@ def test_bad_access(client, live_server, measure_memory_usage):
follow_redirects=True
)
assert b'Watch protocol is not permitted by SAFE_PROTOCOL_REGEX' in res.data
assert b'Watch protocol is not permitted or invalid URL format' in res.data
res = client.post(
url_for("ui.ui_views.form_quick_watch_add"),
@@ -64,7 +64,7 @@ def test_bad_access(client, live_server, measure_memory_usage):
follow_redirects=True
)
assert b'Watch protocol is not permitted by SAFE_PROTOCOL_REGEX' in res.data
assert b'Watch protocol is not permitted or invalid URL format' in res.data
res = client.post(
@@ -73,8 +73,15 @@ def test_bad_access(client, live_server, measure_memory_usage):
follow_redirects=True
)
assert b'Watch protocol is not permitted by SAFE_PROTOCOL_REGEX' in res.data
assert b'Watch protocol is not permitted or invalid URL format' in res.data
res = client.post(
url_for("ui.ui_views.form_quick_watch_add"),
data={"url": 'https://i-wanna-xss-you.com?hereis=<script>alert(1)</script>', "tags": ''},
follow_redirects=True
)
assert b'Watch protocol is not permitted or invalid URL format' in res.data
def _runner_test_various_file_slash(client, file_uri):
@@ -111,8 +118,8 @@ def test_file_slash_access(client, live_server, measure_memory_usage):
test_file_path = os.path.abspath(__file__)
_runner_test_various_file_slash(client, file_uri=f"file://{test_file_path}")
_runner_test_various_file_slash(client, file_uri=f"file:/{test_file_path}")
_runner_test_various_file_slash(client, file_uri=f"file:{test_file_path}") # CVE-2024-56509
# _runner_test_various_file_slash(client, file_uri=f"file:/{test_file_path}")
# _runner_test_various_file_slash(client, file_uri=f"file:{test_file_path}") # CVE-2024-56509
def test_xss(client, live_server, measure_memory_usage):