JiriUhlirandClaude Opus 5
156289fe2d
Sluzba prijme adresu HTML dokumentu nebo HTML v tele requestu a vrati PDF. Navrzena pro dokumenty o stovkach az tisicich stranek. Rendering: - WeasyPrint jako vychozi engine, spravne CSS Paged Media, nizka pametova narocnost, bez JavaScriptu - Chromium pres Playwright pro dokumenty dokreslovane skripty - rezim auto s detekci skriptu a fallbackem pri selhani WeasyPrintu Velke dokumenty: - deleni na casti na strukturalnich hranicich, rez nikdy uvnitr tabulky nebo odstavce - dvoupruchodovy render obsahu se skutecnymi cisly stranek, pozice nadpisu se ctou z kotev hlasenych u kazde stranky - cislovani stranek bud pres CSS countery, nebo pres cislovaci vrstvu nastampovanou na hotove PDF, rozmer stranky se cte z vysledneho souboru - Chromium se restartuje po N jobech, nikdy vsak behem beziciho renderu API: - POST /convert synchronne, POST /jobs asynchronne se sledovanim stavu, stahovanim vysledku, rusenim a volitelnym callbackem - GET /health s overenim dostupnosti obou enginu a stavem fronty - OpenAPI respektuje prefix reverse proxy pres root_path Bezpecnost a provoz: - SSRF kontrola po DNS resolvu, na kazdem presmerovani a u vsech pozadavku prohlizece - nedostupne assety render nezastavi, ale hlasi se v odpovedi i v logu - fronta s omezenym poctem workeru, rozpracovane joby se pri ukonceni oznaci jako failed, nezmizi potichu - strukturovane JSON logovani s job_id - vsechny limity vypnute ve vychozim stavu Dockerfile je dvoufazovy, obsahuje zavislosti WeasyPrintu, Chromium a fonty s ceskou diakritikou. Autentizace zamerne neni implementovana, zpusob predavani neni domluveny. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
66 lines
2.1 KiB
Python
66 lines
2.1 KiB
Python
"""SSRF protection.
|
|
|
|
The important case is a public hostname that resolves to a loopback address.
|
|
Checking the URL string alone would let it through.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import socket
|
|
|
|
import pytest
|
|
|
|
from app.config import Settings
|
|
from app.errors import BlockedTargetError
|
|
from app.services.security import UrlGuard
|
|
|
|
|
|
@pytest.fixture
|
|
def guard() -> UrlGuard:
|
|
return UrlGuard(Settings())
|
|
|
|
|
|
def test_literal_loopback_is_blocked(guard: UrlGuard) -> None:
|
|
with pytest.raises(BlockedTargetError):
|
|
guard.check("http://127.0.0.1:8000/dokument.html")
|
|
|
|
|
|
def test_private_range_is_blocked(guard: UrlGuard) -> None:
|
|
with pytest.raises(BlockedTargetError):
|
|
guard.check("http://192.168.1.10/dokument.html")
|
|
|
|
|
|
def test_link_local_metadata_endpoint_is_blocked(guard: UrlGuard) -> None:
|
|
with pytest.raises(BlockedTargetError):
|
|
guard.check("http://169.254.169.254/latest/meta-data/")
|
|
|
|
|
|
def test_hostname_resolving_to_loopback_is_blocked(guard: UrlGuard, monkeypatch) -> None:
|
|
def fake_getaddrinfo(host, *args, **kwargs): # noqa: ARG001
|
|
return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("127.0.0.1", 80))]
|
|
|
|
monkeypatch.setattr(socket, "getaddrinfo", fake_getaddrinfo)
|
|
|
|
with pytest.raises(BlockedTargetError):
|
|
guard.check("http://vlastni-domena.example.com/dokument.html")
|
|
|
|
|
|
def test_file_scheme_is_blocked(guard: UrlGuard) -> None:
|
|
with pytest.raises(BlockedTargetError):
|
|
guard.check("file:///etc/passwd")
|
|
|
|
|
|
def test_public_address_passes(guard: UrlGuard, monkeypatch) -> None:
|
|
def fake_getaddrinfo(host, *args, **kwargs): # noqa: ARG001
|
|
return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", ("93.184.216.34", 80))]
|
|
|
|
monkeypatch.setattr(socket, "getaddrinfo", fake_getaddrinfo)
|
|
assert guard.check("https://example.com/dokument.html") == "example.com"
|
|
|
|
|
|
def test_allowlisted_host_skips_the_check() -> None:
|
|
settings = Settings()
|
|
object.__setattr__(settings, "ssrf_allowed_hosts", ["localhost"])
|
|
guard = UrlGuard(settings)
|
|
assert guard.check("http://localhost:9000/dokument.html") == "localhost"
|