Files
WeKnora/internal/handler/tenant_parser_ssrf_test.go
T
wizardchen 7099a7e181 fix(security): redact IM list credentials and harden MinerU SSRF
Stop returning bot credentials from Viewer-accessible IM channel list
endpoints and validate self-hosted MinerU URLs at config save and fetch time.
2026-07-02 17:58:20 +08:00

26 lines
731 B
Go

package handler
import (
"testing"
"github.com/Tencent/WeKnora/internal/types"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestValidateParserEngineOutboundURLs_RejectsPrivateMinerUEndpoint(t *testing.T) {
err := validateParserEngineOutboundURLs(&types.ParserEngineConfig{
MinerUEndpoint: "http://127.0.0.1:8080",
})
require.Error(t, err)
assert.Contains(t, err.Error(), "mineru_endpoint")
}
func TestValidateParserEngineOutboundURLs_RejectsPrivateVLMServerURL(t *testing.T) {
err := validateParserEngineOutboundURLs(&types.ParserEngineConfig{
MinerUVLMServerURL: "http://169.254.169.254",
})
require.Error(t, err)
assert.Contains(t, err.Error(), "mineru_vlm_server_url")
}