mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-10-27 16:02:05 +00:00
google-labs-jules[bot]andPR0M3TH3AN
4a1529fd1a
- Apply code formatting fixes (black) to resolve test workflow failures. - Update `pyproject.toml`, `src/requirements.txt`, and lock files to upgrade vulnerable dependencies: - aiohttp -> 3.13.3 - cryptography -> 46.0.5 - orjson -> 3.11.7 (CVE-2025-67221) - pillow -> 12.1.1 (CVE-2026-25990) - pynacl -> 1.6.2 (CVE-2025-69277) - starlette -> 0.52.1 (CVE-2025-62727) - urllib3 -> 2.6.3 (CVE-2025-66418, etc.) - cbor2 -> 5.8.0 (CVE-2025-68131) - pyasn1 -> 0.6.2 (CVE-2026-23490) - python-multipart -> 0.0.22 (CVE-2026-24486) - Manually sync `requirements.lock` from `poetry.lock` as `pip-compile` is unavailable in the environment. Co-authored-by: PR0M3TH3AN <[email protected]>
53 lines
1.5 KiB
Python
53 lines
1.5 KiB
Python
import sys
|
|
import os
|
|
from unittest.mock import MagicMock
|
|
from fastapi.testclient import TestClient
|
|
from pathlib import Path
|
|
|
|
# Add src to sys.path
|
|
sys.path.insert(0, os.path.abspath("src"))
|
|
|
|
# Mock seedpass.api._pm before importing api
|
|
import seedpass.api
|
|
|
|
seedpass.api._pm = MagicMock()
|
|
# No need to mock is_valid_filename now as I check inline
|
|
seedpass.api._token = "testtoken" # Set a dummy token
|
|
|
|
from seedpass.api import app
|
|
|
|
client = TestClient(app)
|
|
|
|
|
|
def test_fix():
|
|
evil_path = "/tmp/evil_file"
|
|
response = client.post(
|
|
"/api/v1/vault/backup-parent-seed",
|
|
json={"path": evil_path},
|
|
headers={"Authorization": "Bearer testtoken"},
|
|
)
|
|
|
|
assert response.status_code == 400, f"Expected 400, got {response.status_code}"
|
|
assert response.json() == {"detail": "Invalid filename"}
|
|
|
|
# Check that handle_backup_reveal_parent_seed was NOT called
|
|
seedpass.api._pm.handle_backup_reveal_parent_seed.assert_not_called()
|
|
print("Fix verified: Rejected arbitrary path.")
|
|
|
|
# Test valid filename
|
|
valid_file = "backup.enc"
|
|
response = client.post(
|
|
"/api/v1/vault/backup-parent-seed",
|
|
json={"path": valid_file},
|
|
headers={"Authorization": "Bearer testtoken"},
|
|
)
|
|
assert response.status_code == 200, f"Expected 200, got {response.status_code}"
|
|
seedpass.api._pm.handle_backup_reveal_parent_seed.assert_called_with(
|
|
Path(valid_file)
|
|
)
|
|
print("Fix verified: Accepted valid filename.")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
test_fix()
|