From aed1171af4e4fa716381b8d31774525a773a16ef Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 25 Sep 2026 16:44:51 +0200 Subject: [PATCH] test: avoid public IP addresses in HTML fetch tests --- tests/test_html_to_markdown.py | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/tests/test_html_to_markdown.py b/tests/test_html_to_markdown.py index e9747746..7482d5a9 100644 --- a/tests/test_html_to_markdown.py +++ b/tests/test_html_to_markdown.py @@ -8,6 +8,7 @@ class TestHtmlToMarkdownUrlSafety(unittest.TestCase): + # 192.0.2.0/24 is reserved for documentation and examples (TEST-NET-1). def test_blocks_ipv4_mapped_ipv6_literals_for_blocked_ipv4_ranges(self): blocked_urls = ( @@ -22,16 +23,16 @@ def test_blocks_ipv4_mapped_ipv6_literals_for_blocked_ipv4_ranges(self): with self.subTest(url=url): self.assertFalse(is_safe_url(url)) - def test_allows_public_ipv4_mapped_ipv6_literal(self): - self.assertTrue(is_safe_url("http://[::ffff:93.184.216.34]/")) + def test_allows_unblocked_ipv4_mapped_ipv6_literal(self): + self.assertTrue(is_safe_url("http://[::ffff:192.0.2.1]/")) - def test_allows_public_ipv4_literal(self): - self.assertTrue(is_safe_url("http://93.184.216.34/")) + def test_allows_unblocked_ipv4_literal(self): + self.assertTrue(is_safe_url("http://192.0.2.1/")) - def test_allows_hostnames_resolving_to_public_ipv4_addresses(self): + def test_allows_hostnames_resolving_to_unblocked_ipv4_addresses(self): with patch( "misp_modules.modules.expansion.html_to_markdown.socket.getaddrinfo", - return_value=[(None, None, None, None, ("93.184.216.34", 0))], + return_value=[(None, None, None, None, ("192.0.2.1", 0))], ): self.assertTrue(is_safe_url("http://example.test/")) @@ -63,10 +64,10 @@ def test_blocks_redirect_to_loopback(self, session_factory): session.get.return_value = response with self.assertRaisesRegex(ValueError, "Blocked redirect URL"): - fetchHTML("http://93.184.216.34/") + fetchHTML("http://192.0.2.1/") session.get.assert_called_once_with( - "http://93.184.216.34/", timeout=10, allow_redirects=False + "http://192.0.2.1/", timeout=10, allow_redirects=False ) response.close.assert_called_once_with() @@ -75,20 +76,20 @@ def test_reuses_session_when_following_safe_redirect(self, session_factory): session = session_factory.return_value.__enter__.return_value redirect_response = Mock( is_redirect=True, - headers={"location": "http://93.184.216.35/destination"}, + headers={"location": "http://192.0.2.2/destination"}, ) final_response = Mock(is_redirect=False, text="redirected content") session.get.side_effect = [redirect_response, final_response] - self.assertEqual(fetchHTML("http://93.184.216.34/"), "redirected content") + self.assertEqual(fetchHTML("http://192.0.2.1/"), "redirected content") session_factory.assert_called_once_with() self.assertEqual( session.get.call_args_list, [ - call("http://93.184.216.34/", timeout=10, allow_redirects=False), + call("http://192.0.2.1/", timeout=10, allow_redirects=False), call( - "http://93.184.216.35/destination", + "http://192.0.2.2/destination", timeout=10, allow_redirects=False, ),