From 4964660e50bc034b6997d176be6df4bbf973ee6f Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Tue, 20 May 2025 23:38:25 +0200
Subject: [PATCH] Move test for local files to invalid urls

Only https and http schemes are allowed so any other scheme will be considered invalid.
---
 lib/galaxy_test/api/test_proxy.py | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/lib/galaxy_test/api/test_proxy.py b/lib/galaxy_test/api/test_proxy.py
index cd6a54ba7ae..9fee1690818 100644
--- a/lib/galaxy_test/api/test_proxy.py
+++ b/lib/galaxy_test/api/test_proxy.py
@@ -52,12 +52,6 @@ class TestProxyApi(ApiTestCase):
         self._assert_status_code_is(response, 403)
         assert response.json()["err_msg"] == "Anonymous users are not allowed to access this endpoint"
 
-    def test_user_cannot_access_local_file(self):
-        local_file_url = "file://etc/passwd"
-        response = self._get(f"proxy?url={local_file_url}")
-        self._assert_status_code_is(response, 403)
-        assert response.json()["err_msg"] == "Action requires admin account."
-
     @pytest.mark.parametrize(
         "invalid_url",
         [
@@ -65,10 +59,12 @@ class TestProxyApi(ApiTestCase):
             "http:/missing-slash.com",
             "//missing-scheme.com",
             "invalid-url",
-            "ftp://not-allowed.com",
             "https://first.url\nhttps://second.url",
             "https://first.url https://second.url",
             "https://first.urlhttps://second.url",
+            # Schemes other than http and https are not allowed
+            "ftp://not-allowed.com",
+            "file://etc/passwd",
         ],
     )
     def test_invalid_url_format(self, invalid_url: str):