wizardchen
8325dac738
Use SSRF-safe HTTP clients in chat pipeline web_fetch and Feishu/Yuque/Notion connectors, validating tenant-supplied base_url values before outbound requests.
27 lines
674 B
Go
27 lines
674 B
Go
package datasource
|
|
|
|
import (
|
|
"testing"
|
|
|
|
secutils "github.com/Tencent/WeKnora/internal/utils"
|
|
)
|
|
|
|
func TestValidateConnectorBaseURLBlocksLoopback(t *testing.T) {
|
|
secutils.ResetSSRFWhitelistForTest()
|
|
t.Cleanup(secutils.ResetSSRFWhitelistForTest)
|
|
|
|
err := ValidateConnectorBaseURL("http://127.0.0.1:8000")
|
|
if err == nil {
|
|
t.Fatal("expected loopback base_url to be rejected")
|
|
}
|
|
}
|
|
|
|
func TestValidateConnectorBaseURLAllowsPublicHTTPS(t *testing.T) {
|
|
secutils.ResetSSRFWhitelistForTest()
|
|
t.Cleanup(secutils.ResetSSRFWhitelistForTest)
|
|
|
|
if err := ValidateConnectorBaseURL("https://open.feishu.cn"); err != nil {
|
|
t.Fatalf("expected public base_url to pass: %v", err)
|
|
}
|
|
}
|