568 lines
23 KiB
Python
Executable File
568 lines
23 KiB
Python
Executable File
"""url_security 单测.
|
||
|
||
domain 层 URL 安全校验纯逻辑模块，0 网络依赖。
|
||
覆盖 SSRF 防护、主机名校验、IP 检查、魔数校验等。
|
||
"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import pytest
|
||
|
||
from packages.domain.url_security import (
|
||
ALLOWED_IMAGE_MIME_TYPES,
|
||
ALLOWED_PORTS,
|
||
ALLOWED_SCHEMES,
|
||
ALLOWED_VIDEO_MIME_TYPES,
|
||
MAGIC_NUMBERS,
|
||
MAX_URL_LENGTH,
|
||
UrlSecurityError,
|
||
check_internal_hostname,
|
||
check_ssrf_ip,
|
||
is_ip_address,
|
||
is_trusted_domain,
|
||
is_url_basic_safe,
|
||
validate_magic_number,
|
||
validate_url_basic,
|
||
)
|
||
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
# 常量与异常类
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
|
||
|
||
class TestConstants:
|
||
"""常量测试."""
|
||
|
||
def test_allowed_schemes(self):
|
||
"""允许的 scheme 包含 http 和 https."""
|
||
assert "http" in ALLOWED_SCHEMES
|
||
assert "https" in ALLOWED_SCHEMES
|
||
|
||
def test_allowed_ports(self):
|
||
"""允许的端口：80, 443."""
|
||
assert 80 in ALLOWED_PORTS
|
||
assert 443 in ALLOWED_PORTS
|
||
|
||
def test_max_url_length(self):
|
||
"""最大 URL 长度 2048."""
|
||
assert MAX_URL_LENGTH == 2048
|
||
|
||
def test_magic_numbers_has_common_formats(self):
|
||
"""魔数表包含常见格式."""
|
||
assert "image/jpeg" in MAGIC_NUMBERS
|
||
assert "image/png" in MAGIC_NUMBERS
|
||
assert "image/gif" in MAGIC_NUMBERS
|
||
assert "video/mp4" in MAGIC_NUMBERS
|
||
assert "audio/mpeg" in MAGIC_NUMBERS
|
||
|
||
|
||
class TestUrlSecurityError:
|
||
"""异常类测试."""
|
||
|
||
def test_is_value_error(self):
|
||
"""UrlSecurityError 继承 ValueError."""
|
||
assert issubclass(UrlSecurityError, ValueError)
|
||
|
||
def test_raise_with_message(self):
|
||
"""抛出时携带错误信息."""
|
||
with pytest.raises(UrlSecurityError, match="test error"):
|
||
raise UrlSecurityError("test error")
|
||
|
||
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
# check_internal_hostname
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
|
||
|
||
class TestCheckInternalHostname:
|
||
"""内部主机名检查测试."""
|
||
|
||
def test_normal_domain_passes(self):
|
||
"""普通外部域名通过."""
|
||
check_internal_hostname("example.com")
|
||
check_internal_hostname("www.google.com")
|
||
|
||
def test_localhost_blocked(self):
|
||
"""localhost 被拦截."""
|
||
with pytest.raises(UrlSecurityError, match="内部主机名"):
|
||
check_internal_hostname("localhost")
|
||
|
||
def test_localhost_case_insensitive(self):
|
||
"""大小写不敏感."""
|
||
with pytest.raises(UrlSecurityError):
|
||
check_internal_hostname("LOCALHOST")
|
||
with pytest.raises(UrlSecurityError):
|
||
check_internal_hostname("LocalHost")
|
||
|
||
def test_localhost_localdomain_blocked(self):
|
||
"""localhost.localdomain 被拦截."""
|
||
with pytest.raises(UrlSecurityError):
|
||
check_internal_hostname("localhost.localdomain")
|
||
|
||
def test_metadata_blocked(self):
|
||
"""metadata 被拦截."""
|
||
with pytest.raises(UrlSecurityError):
|
||
check_internal_hostname("metadata")
|
||
|
||
def test_metadata_google_internal_blocked(self):
|
||
"""GCP 元数据服务被拦截."""
|
||
with pytest.raises(UrlSecurityError):
|
||
check_internal_hostname("metadata.google.internal")
|
||
|
||
def test_cloud_metadata_ip_blocked(self):
|
||
"""云元数据 IP 169.254.169.254 被拦截."""
|
||
with pytest.raises(UrlSecurityError):
|
||
check_internal_hostname("169.254.169.254")
|
||
|
||
def test_local_suffix_blocked(self):
|
||
""".local 后缀域名被拦截."""
|
||
with pytest.raises(UrlSecurityError, match="内网域名"):
|
||
check_internal_hostname("myhost.local")
|
||
|
||
def test_internal_suffix_blocked(self):
|
||
""".internal 后缀被拦截."""
|
||
with pytest.raises(UrlSecurityError):
|
||
check_internal_hostname("svc.cluster.internal")
|
||
|
||
def test_localdomain_suffix_blocked(self):
|
||
""".localdomain 后缀被拦截."""
|
||
with pytest.raises(UrlSecurityError):
|
||
check_internal_hostname("host.localdomain")
|
||
|
||
def test_com_domain_not_blocked(self):
|
||
""".com 域名不被拦截."""
|
||
check_internal_hostname("example.com")
|
||
check_internal_hostname("sub.example.com")
|
||
|
||
def test_subdomain_of_public_domain_ok(self):
|
||
"""公网域名的子域名正常."""
|
||
check_internal_hostname("api.example.com")
|
||
check_internal_hostname("cdn.assets.example.org")
|
||
|
||
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
# is_trusted_domain
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
|
||
|
||
class TestIsTrustedDomain:
|
||
"""可信域名匹配测试."""
|
||
|
||
def test_empty_trusted_domains_allows_all(self):
|
||
"""空集合允许所有域名."""
|
||
assert is_trusted_domain("anything.com", set()) is True
|
||
assert is_trusted_domain("anywhere.org", set()) is True
|
||
|
||
def test_exact_match(self):
|
||
"""精确匹配."""
|
||
trusted = {"example.com", "example.org"}
|
||
assert is_trusted_domain("example.com", trusted) is True
|
||
assert is_trusted_domain("example.org", trusted) is True
|
||
|
||
def test_subdomain_match(self):
|
||
"""子域名匹配."""
|
||
trusted = {"example.com"}
|
||
assert is_trusted_domain("api.example.com", trusted) is True
|
||
assert is_trusted_domain("cdn.assets.example.com", trusted) is True
|
||
|
||
def test_no_match(self):
|
||
"""不匹配."""
|
||
trusted = {"example.com"}
|
||
assert is_trusted_domain("other.com", trusted) is False
|
||
assert is_trusted_domain("example.net", trusted) is False
|
||
|
||
def test_case_insensitive(self):
|
||
"""大小写不敏感."""
|
||
trusted = {"Example.COM"}
|
||
assert is_trusted_domain("example.com", trusted) is True
|
||
assert is_trusted_domain("API.EXAMPLE.COM", trusted) is True
|
||
|
||
def test_partial_match_no(self):
|
||
"""域名部分相同但不是子域名不匹配."""
|
||
trusted = {"example.com"}
|
||
# fakeexample.com 不是 example.com 的子域名
|
||
assert is_trusted_domain("fakeexample.com", trusted) is False
|
||
|
||
def test_none_trusted_domains(self):
|
||
"""trusted_domains 为 None 时由调用方处理，空 set 全允许."""
|
||
# 传空集合时全允许
|
||
assert is_trusted_domain("a.com", set()) is True
|
||
|
||
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
# check_ssrf_ip
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
|
||
|
||
class TestCheckSsrIp:
|
||
"""IP SSRF 检查测试."""
|
||
|
||
def test_public_ip_passes(self):
|
||
"""公网 IP 通过."""
|
||
check_ssrf_ip("8.8.8.8")
|
||
check_ssrf_ip("1.1.1.1")
|
||
check_ssrf_ip("114.114.114.114")
|
||
|
||
def test_loopback_blocked(self):
|
||
"""回环地址被拦截."""
|
||
with pytest.raises(UrlSecurityError, match="回环"):
|
||
check_ssrf_ip("127.0.0.1")
|
||
with pytest.raises(UrlSecurityError):
|
||
check_ssrf_ip("127.0.0.53")
|
||
|
||
def test_private_ip_blocked(self):
|
||
"""私有内网 IP 被拦截."""
|
||
with pytest.raises(UrlSecurityError, match="内网"):
|
||
check_ssrf_ip("192.168.1.1")
|
||
with pytest.raises(UrlSecurityError):
|
||
check_ssrf_ip("10.0.0.1")
|
||
with pytest.raises(UrlSecurityError):
|
||
check_ssrf_ip("172.16.0.1")
|
||
|
||
def test_link_local_blocked(self):
|
||
"""链路本地地址被拦截."""
|
||
with pytest.raises(UrlSecurityError, match="链路本地"):
|
||
check_ssrf_ip("169.254.169.254")
|
||
with pytest.raises(UrlSecurityError):
|
||
check_ssrf_ip("169.254.1.1")
|
||
|
||
def test_multicast_blocked(self):
|
||
"""组播地址被拦截."""
|
||
with pytest.raises(UrlSecurityError, match="组播"):
|
||
check_ssrf_ip("224.0.0.1")
|
||
with pytest.raises(UrlSecurityError):
|
||
check_ssrf_ip("239.255.255.250")
|
||
|
||
def test_unspecified_blocked(self):
|
||
"""未指定地址被拦截."""
|
||
with pytest.raises(UrlSecurityError, match="未指定"):
|
||
check_ssrf_ip("0.0.0.0")
|
||
|
||
def test_ipv6_loopback_blocked(self):
|
||
"""IPv6 回环地址被拦截."""
|
||
with pytest.raises(UrlSecurityError):
|
||
check_ssrf_ip("::1")
|
||
|
||
def test_ipv6_private_blocked(self):
|
||
"""IPv6 内网地址被拦截."""
|
||
with pytest.raises(UrlSecurityError):
|
||
check_ssrf_ip("fc00::1")
|
||
with pytest.raises(UrlSecurityError):
|
||
check_ssrf_ip("fe80::1")
|
||
|
||
def test_ipv6_public_passes(self):
|
||
"""IPv6 公网地址通过."""
|
||
check_ssrf_ip("2001:4860:4860::8888")
|
||
|
||
def test_invalid_ip_raises_value_error(self):
|
||
"""非法 IP 抛出 ValueError（不是 UrlSecurityError）."""
|
||
with pytest.raises(ValueError):
|
||
check_ssrf_ip("not-an-ip")
|
||
with pytest.raises(ValueError):
|
||
check_ssrf_ip("999.999.999.999")
|
||
|
||
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
# is_ip_address
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
|
||
|
||
class TestIsIpAddress:
|
||
"""IP 地址判断测试."""
|
||
|
||
def test_ipv4_true(self):
|
||
"""IPv4 地址返回 True."""
|
||
assert is_ip_address("127.0.0.1") is True
|
||
assert is_ip_address("8.8.8.8") is True
|
||
assert is_ip_address("0.0.0.0") is True
|
||
|
||
def test_ipv6_true(self):
|
||
"""IPv6 地址返回 True."""
|
||
assert is_ip_address("::1") is True
|
||
assert is_ip_address("2001:db8::1") is True
|
||
|
||
def test_hostname_false(self):
|
||
"""主机名返回 False."""
|
||
assert is_ip_address("example.com") is False
|
||
assert is_ip_address("localhost") is False
|
||
assert is_ip_address("sub.domain.org") is False
|
||
|
||
def test_empty_string_false(self):
|
||
"""空字符串返回 False."""
|
||
assert is_ip_address("") is False
|
||
|
||
def test_invalid_ip_false(self):
|
||
"""非法 IP 返回 False."""
|
||
assert is_ip_address("999.999.999.999") is False
|
||
assert is_ip_address("1234") is False
|
||
assert is_ip_address("abc.def") is False
|
||
|
||
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
# validate_url_basic
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
|
||
|
||
class TestValidateUrlBasic:
|
||
"""URL 基础校验测试."""
|
||
|
||
def test_normal_https_url_passes(self):
|
||
"""正常 HTTPS URL 通过."""
|
||
result = validate_url_basic("https://example.com/path")
|
||
assert result == "https://example.com/path"
|
||
|
||
def test_normal_http_url_passes(self):
|
||
"""正常 HTTP URL 通过."""
|
||
result = validate_url_basic("http://example.com/path")
|
||
assert result == "http://example.com/path"
|
||
|
||
def test_empty_url_rejected(self):
|
||
"""空 URL 被拒."""
|
||
with pytest.raises(UrlSecurityError, match="为空"):
|
||
validate_url_basic("")
|
||
|
||
def test_none_url_not_passed_as_str(self):
|
||
"""None 作为 URL（这里只测空字符串）."""
|
||
# 空字符串被拒
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_url_basic("")
|
||
|
||
def test_too_long_url_rejected(self):
|
||
"""超长 URL 被拒."""
|
||
long_url = "https://example.com/" + "a" * 3000
|
||
with pytest.raises(UrlSecurityError, match="过长"):
|
||
validate_url_basic(long_url)
|
||
|
||
def test_invalid_scheme_rejected(self):
|
||
"""非法 scheme 被拒."""
|
||
with pytest.raises(UrlSecurityError, match="scheme"):
|
||
validate_url_basic("ftp://example.com/file")
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_url_basic("file:///etc/passwd")
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_url_basic("javascript:alert(1)")
|
||
|
||
def test_missing_hostname_rejected(self):
|
||
"""缺少主机名被拒."""
|
||
with pytest.raises(UrlSecurityError, match="主机名"):
|
||
validate_url_basic("https:///path")
|
||
|
||
def test_localhost_rejected(self):
|
||
"""localhost 被拒."""
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_url_basic("https://localhost/api")
|
||
|
||
def test_internal_domain_rejected(self):
|
||
"""内网域名被拒."""
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_url_basic("http://server.local/api")
|
||
|
||
def test_non_standard_port_rejected(self):
|
||
"""非标准端口被拒."""
|
||
with pytest.raises(UrlSecurityError, match="端口"):
|
||
validate_url_basic("https://example.com:8080/")
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_url_basic("http://example.com:3000/")
|
||
|
||
def test_port_80_ok(self):
|
||
"""80 端口允许."""
|
||
validate_url_basic("http://example.com:80/path")
|
||
|
||
def test_port_443_ok(self):
|
||
"""443 端口允许."""
|
||
validate_url_basic("https://example.com:443/path")
|
||
|
||
def test_no_port_ok(self):
|
||
"""无端口默认允许."""
|
||
validate_url_basic("https://example.com/path")
|
||
|
||
def test_direct_ip_rejected_by_default(self):
|
||
"""默认禁止直接 IP 访问."""
|
||
with pytest.raises(UrlSecurityError, match="直接 IP"):
|
||
validate_url_basic("https://8.8.8.8/path")
|
||
|
||
def test_direct_ip_allowed_when_enabled(self):
|
||
"""allow_direct_ip=True 时允许公网 IP."""
|
||
validate_url_basic("https://8.8.8.8/path", allow_direct_ip=True)
|
||
|
||
def test_direct_ip_private_still_blocked(self):
|
||
"""即使 allow_direct_ip，内网 IP 仍被拒."""
|
||
with pytest.raises(UrlSecurityError, match="内网"):
|
||
validate_url_basic("https://192.168.1.1/", allow_direct_ip=True)
|
||
|
||
def test_direct_ip_loopback_still_blocked(self):
|
||
"""回环 IP 即使开启 direct_ip 也被拒."""
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_url_basic("https://127.0.0.1/", allow_direct_ip=True)
|
||
|
||
def test_trusted_domains_pass(self):
|
||
"""可信域名列表内的域名通过."""
|
||
trusted = {"example.com", "cdn.com"}
|
||
validate_url_basic("https://api.example.com/path", trusted_domains=trusted)
|
||
validate_url_basic("https://cdn.com/asset.jpg", trusted_domains=trusted)
|
||
|
||
def test_untrusted_domain_rejected(self):
|
||
"""不在可信域名列表中的域名被拒."""
|
||
trusted = {"example.com"}
|
||
with pytest.raises(UrlSecurityError, match="白名单"):
|
||
validate_url_basic("https://evil.com/malware", trusted_domains=trusted)
|
||
|
||
def test_trusted_domain_subdomain_pass(self):
|
||
"""可信域名的子域名通过."""
|
||
trusted = {"example.com"}
|
||
validate_url_basic("https://sub.example.com/a", trusted_domains=trusted)
|
||
validate_url_basic("https://a.b.example.com/b", trusted_domains=trusted)
|
||
|
||
def test_return_value_is_original_url(self):
|
||
"""返回原始 URL 字符串."""
|
||
url = "https://example.com/path?query=value#frag"
|
||
assert validate_url_basic(url) == url
|
||
|
||
def test_metadata_ip_rejected(self):
|
||
"""云元数据 IP 被内部主机名检查拦截."""
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_url_basic("http://169.254.169.254/latest/meta-data/")
|
||
|
||
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
# is_url_basic_safe
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
|
||
|
||
class TestIsUrlBasicSafe:
|
||
"""便捷函数 is_url_basic_safe 测试."""
|
||
|
||
def test_safe_url_returns_true(self):
|
||
"""安全 URL 返回 True."""
|
||
assert is_url_basic_safe("https://example.com/") is True
|
||
assert is_url_basic_safe("http://example.org/path") is True
|
||
|
||
def test_unsafe_url_returns_false(self):
|
||
"""不安全 URL 返回 False."""
|
||
assert is_url_basic_safe("https://localhost/") is False
|
||
assert is_url_basic_safe("ftp://example.com/") is False
|
||
assert is_url_basic_safe("") is False
|
||
|
||
def test_trusted_domains_param(self):
|
||
"""支持 trusted_domains 参数."""
|
||
trusted = {"example.com"}
|
||
assert is_url_basic_safe("https://other.com/", trusted_domains=trusted) is False
|
||
assert is_url_basic_safe("https://example.com/", trusted_domains=trusted) is True
|
||
|
||
def test_allow_direct_ip_param(self):
|
||
"""支持 allow_direct_ip 参数."""
|
||
assert is_url_basic_safe("https://8.8.8.8/") is False
|
||
assert is_url_basic_safe("https://8.8.8.8/", allow_direct_ip=True) is True
|
||
|
||
def test_no_exceptions_raised(self):
|
||
"""不抛出异常，只返回 bool."""
|
||
# 各种边界情况都不抛异常
|
||
try:
|
||
is_url_basic_safe("")
|
||
is_url_basic_safe("not a url")
|
||
is_url_basic_safe("http://" + "a" * 3000)
|
||
except UrlSecurityError:
|
||
pytest.fail("is_url_basic_safe should not raise UrlSecurityError")
|
||
|
||
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
# validate_magic_number
|
||
# ═══════════════════════════════════════════════════════════════════════════════
|
||
|
||
|
||
class TestValidateMagicNumber:
|
||
"""魔数校验测试."""
|
||
|
||
def test_jpeg_valid(self):
|
||
"""JPEG 文件通过."""
|
||
# JPEG 文件头: FF D8 FF
|
||
jpeg_header = b"\xff\xd8\xff\xe0\x00\x10JFIF\x00"
|
||
validate_magic_number(jpeg_header, {"image/jpeg"})
|
||
|
||
def test_png_valid(self):
|
||
"""PNG 文件通过."""
|
||
png_header = b"\x89PNG\r\n\x1a\n\x00\x00\x00"
|
||
validate_magic_number(png_header, {"image/png"})
|
||
|
||
def test_gif_valid(self):
|
||
"""GIF 文件通过（GIF89a 和 GIF87a）."""
|
||
validate_magic_number(b"GIF89a...", {"image/gif"})
|
||
validate_magic_number(b"GIF87a...", {"image/gif"})
|
||
|
||
def test_wav_valid(self):
|
||
"""WAV 文件通过（RIFF + WAVE）."""
|
||
wav_header = b"RIFF\x00\x00\x00\x00WAVEfmt "
|
||
validate_magic_number(wav_header, {"audio/wav"})
|
||
|
||
def test_mp3_id3_valid(self):
|
||
"""带 ID3 标签的 MP3 通过."""
|
||
mp3_header = b"ID3\x03\x00\x00\x00\x00\x0f\x76"
|
||
validate_magic_number(mp3_header, {"audio/mpeg"})
|
||
|
||
def test_mp3_sync_valid(self):
|
||
"""不带 ID3 的 MP3（帧同步字）通过."""
|
||
mp3_header = b"\xff\xfb\x90\x00" + b"\x00" * 32
|
||
validate_magic_number(mp3_header, {"audio/mpeg"})
|
||
|
||
def test_ogg_valid(self):
|
||
"""OGG 文件通过."""
|
||
validate_magic_number(b"OggS\x00\x00...", {"audio/ogg"})
|
||
|
||
def test_flac_valid(self):
|
||
"""FLAC 文件通过."""
|
||
validate_magic_number(b"fLaC\x00\x00...", {"audio/flac"})
|
||
|
||
def test_webp_valid(self):
|
||
"""WebP 文件通过（RIFF + WEBP）."""
|
||
webp_header = b"RIFF\x00\x00\x00\x00WEBPVP8 "
|
||
validate_magic_number(webp_header, {"image/webp"})
|
||
|
||
def test_bmp_valid(self):
|
||
"""BMP 文件通过."""
|
||
validate_magic_number(b"BM\x00\x00\x00\x00...", {"image/bmp"})
|
||
|
||
def test_mp4_valid(self):
|
||
"""MP4 文件通过（ftyp 在偏移 4）."""
|
||
mp4_header = b"\x00\x00\x00\x20ftypisom\x00\x00\x02\x00"
|
||
validate_magic_number(mp4_header, {"video/mp4"})
|
||
|
||
def test_invalid_format_rejected(self):
|
||
"""不匹配的格式被拒."""
|
||
with pytest.raises(UrlSecurityError, match="魔数"):
|
||
validate_magic_number(b"hello world", {"image/jpeg"})
|
||
|
||
def test_empty_bytes_rejected(self):
|
||
"""空字节被拒."""
|
||
with pytest.raises(UrlSecurityError, match="为空"):
|
||
validate_magic_number(b"", {"image/jpeg"})
|
||
|
||
def test_too_short_bytes_rejected(self):
|
||
"""字节太短不匹配魔数时被拒."""
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_magic_number(b"\xff\xd8", {"image/jpeg"}) # 只2字节，不够JPEG魔数
|
||
|
||
def test_multiple_allowed_types(self):
|
||
"""允许多种格式时任一匹配即通过."""
|
||
jpeg_header = b"\xff\xd8\xff\xe0\x00\x10JFIF\x00"
|
||
validate_magic_number(jpeg_header, {"image/jpeg", "image/png", "image/gif"})
|
||
|
||
def test_wrong_type_rejected(self):
|
||
"""用 PNG 魔数校验 JPEG 类型失败."""
|
||
jpeg_header = b"\xff\xd8\xff\xe0\x00\x10JFIF\x00"
|
||
with pytest.raises(UrlSecurityError):
|
||
validate_magic_number(jpeg_header, {"image/png"})
|
||
|
||
def test_unknown_mime_skipped(self):
|
||
"""未知 MIME 类型（无对应魔数）不阻断."""
|
||
# application/octet-stream 没有魔数定义，直接通过
|
||
validate_magic_number(b"random bytes here", {"application/octet-stream"})
|
||
|
||
def test_allowed_image_mime_types_has_common(self):
|
||
"""图片 MIME 白名单包含常见类型."""
|
||
assert "image/jpeg" in ALLOWED_IMAGE_MIME_TYPES
|
||
assert "image/png" in ALLOWED_IMAGE_MIME_TYPES
|
||
|
||
def test_allowed_video_mime_types_has_common(self):
|
||
"""视频 MIME 白名单包含常见类型."""
|
||
assert "video/mp4" in ALLOWED_VIDEO_MIME_TYPES
|