jedarden/pdftract
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test(bf-2rwx6): verify SSRF_BLOCKED assertion applied to all SSRF URL tests

Browse source
This commit is contained in:
jedarden 2026-07-06 18:33:31 -04:00
parent 6541c4bc43
commit b6cdc6b558
1 changed files with 57 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

57
notes/bf-2rwx6.md Normal file
View file

@ -0,0 +1,57 @@
# bf-2rwx6: Verify SSRF_BLOCKED assertion applied to all SSRF URL tests
## Task
Apply SSRF_BLOCKED assertion to all SSRF URL tests
## Summary
Verified that all 5 SSRF URL test cases in `crates/pdftract-cli/tests/TH-05-ssrf-block.rs` correctly use the `assert_ssrf_blocked_error` assertion helper.
## Verification Details
### All 5 SSRF URL tests verified:
1. **test_ipv4_loopback_blocked** (line 229)
- Calls: `assert_ssrf_blocked_error(&response, "IPv4 loopback (127.0.0.1)")`
- URL tested: `http://127.0.0.1:9999/doc.pdf`
- Status: ✓ PASS
2. **test_ipv4_wildcard_blocked** (line 266)
- Calls: `assert_ssrf_blocked_error(&response, "IPv4 wildcard (0.0.0.0)")`
- URL tested: `http://0.0.0.0/doc.pdf`
- Status: ✓ PASS
3. **test_cloud_metadata_blocked** (line 303)
- Calls: `assert_ssrf_blocked_error(&response, "Cloud metadata endpoint (169.254.169.254)")`
- URL tested: `http://169.254.169.254/latest/meta-data/`
- Status: ✓ PASS
4. **test_rfc1918_private_blocked** (line 340)
- Calls: `assert_ssrf_blocked_error(&response, "RFC 1918 private network (10.0.0.1)")`
- URL tested: `http://10.0.0.1/internal/doc.pdf`
- Status: ✓ PASS
5. **test_ipv6_loopback_blocked** (line 377)
- Calls: `assert_ssrf_blocked_error(&response, "IPv6 loopback ([::1])")`
- URL tested: `http://[::1]/doc.pdf`
- Status: ✓ PASS
### Additional Verification
- No SSRF URL tests use the stub-accepting helper `assert_ssrf_blocked_or_stub`
- The stub-accepting helper exists in the file (lines 402-460) for backward compatibility during Phase 1.8 development, but none of the SSRF URL tests use it
- All tests correctly pass the response JSON string and test description to the assertion helper
- The `assert_ssrf_blocked_error` helper is implemented at lines 472-518 and performs strict SSRF_BLOCKED error checking
## Acceptance Criteria
- [x] All 5 SSRF URL tests call `assert_ssrf_blocked_error`
- [x] Each test passes response JSON and description correctly
- [x] No tests use stub-accepting helper (`assert_ssrf_blocked_or_stub`)
- [x] Verification note created at notes/bf-2rwx6.md
## Test Status: PASS
All 5 SSRF URL tests correctly use the assertion helper. The implementation properly enforces SSRF blocking verification without accepting stub responses.
## File Verified
- `/home/coding/pdftract/crates/pdftract-cli/tests/TH-05-ssrf-block.rs`