From 09494cb720411b0fae5da5d41a5e94379d263d5f Mon Sep 17 00:00:00 2001 From: Rishi Gupta Date: Wed, 21 Oct 2026 22:28:48 +0530 Subject: [PATCH] test(security): reject URLs with embedded credentials --- tests/test_security.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tests/test_security.py b/tests/test_security.py index b0729acdd..fea7a31a9 100644 --- a/tests/test_security.py +++ b/tests/test_security.py @@ -55,6 +55,15 @@ def test_validate_url_rejects_empty_scheme(): validate_url("//no-scheme.example.com") +@pytest.mark.parametrize("url", [ + "https://user:secret@example.com/path", + "https://user@example.com/path", +]) +def test_validate_url_rejects_embedded_credentials(url): + with pytest.raises(ValueError, match="embedded credentials"): + validate_url(url) + + # --------------------------------------------------------------------------- # safe_fetch - scheme and redirect guards (mocked network) # ---------------------------------------------------------------------------