mirror of https://github.com/synctv-org/synctv
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
44 lines
1.3 KiB
Rust
44 lines
1.3 KiB
Rust
//! Explicit SSRF policy tests.
|
|
|
|
#![allow(clippy::unwrap_used)]
|
|
/// Verify that the explicit disabled policy has no ACL resolver.
|
|
#[test]
|
|
fn test_disabled_ssrf_policy_has_no_acl_resolver() {
|
|
let guard = synctv_common::ssrf::SsrfGuard::disabled();
|
|
assert!(guard.acl().is_none());
|
|
assert!(guard.dns_resolver().is_none());
|
|
}
|
|
|
|
/// Verify that `strict_policy()` correctly identifies blocked IPs.
|
|
#[test]
|
|
fn test_ssrf_acl_blocks_private_ranges() {
|
|
use std::net::IpAddr;
|
|
|
|
let blocked: Vec<IpAddr> = vec![
|
|
"127.0.0.1".parse().unwrap(),
|
|
"10.0.0.1".parse().unwrap(),
|
|
"192.168.1.1".parse().unwrap(),
|
|
"172.16.0.1".parse().unwrap(),
|
|
"169.254.169.254".parse().unwrap(),
|
|
"::1".parse().unwrap(),
|
|
];
|
|
for ip in &blocked {
|
|
assert!(
|
|
synctv_common::ssrf::SsrfGuard::strict_policy().is_ip_blocked(ip),
|
|
"strict SSRF policy should block {ip}"
|
|
);
|
|
}
|
|
|
|
let allowed: Vec<IpAddr> = vec![
|
|
"1.1.1.1".parse().unwrap(),
|
|
"8.8.8.8".parse().unwrap(),
|
|
"93.184.216.34".parse().unwrap(),
|
|
];
|
|
for ip in &allowed {
|
|
assert!(
|
|
!synctv_common::ssrf::SsrfGuard::strict_policy().is_ip_blocked(ip),
|
|
"IP {ip} should be allowed"
|
|
);
|
|
}
|
|
}
|