From 2b07311b0d6eda87b5762ea3d1d83f7796be4033 Mon Sep 17 00:00:00 2001 From: Rishi Gupta Date: Wed, 21 Oct 2026 22:28:48 +0530 Subject: [PATCH] test(security): reject URLs with embedded credentials (cherry picked from commit 09494cb720411b0fae5da5d41a5e94379d263d5f) --- tests/test_security.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tests/test_security.py b/tests/test_security.py index 93de72d79..3d9e5e555 100644 --- a/tests/test_security.py +++ b/tests/test_security.py @@ -75,6 +75,15 @@ def test_validate_url_rejects_invalid_port(url): validate_url(url) +@pytest.mark.parametrize("url", [ + "https://user:secret@example.com/path", + "https://user@example.com/path", +]) +def test_validate_url_rejects_embedded_credentials(url): + with pytest.raises(ValueError, match="embedded credentials"): + validate_url(url) + + # --------------------------------------------------------------------------- # safe_fetch - scheme and redirect guards (mocked network) # ---------------------------------------------------------------------------