diff options
| author | Danilo M. <danix@danix.xyz> | 2026-09-08 15:19:14 +0200 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-09-08 15:19:14 +0200 |
| commit | e1b3204c2af639e2a5ccf01d76f3dd280304702e (patch) | |
| tree | fbcbb61ab07f4f43fcd7c6da4f5e0fb8b178ca8f /tests/test_parse.py | |
| parent | d5dbf6328b9f38fe938d79e11769337b390ab9ba (diff) | |
| download | abusectl-e1b3204c2af639e2a5ccf01d76f3dd280304702e.tar.gz abusectl-e1b3204c2af639e2a5ccf01d76f3dd280304702e.zip | |
test: wire leaky.eml into the anti-leak suite (red, defect 2)
test_no_ioc_holds_a_recipient_address grepped for the literal
"example.org", and every existing fixture hides the recipient address
as base64, so URL redaction could be disabled entirely and both this
test and test_cli's counterpart stayed green.
leaky.eml carries you@example.org in five URL shapes plus a From
display-name trap. Adding it to the fixture list, plus a new test
asserting on the raw address and its percent-encoded form, turns the
suite red: the valueless-query-parameter defect (redact.py) currently
lets ?victim@example.org through as a kept parameter NAME. Left
failing on purpose; the next commit fixes redact.py and turns it
green.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KphFXTc2QajxXsHWyvGJ4R
Diffstat (limited to 'tests/test_parse.py')
| -rw-r--r-- | tests/test_parse.py | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/tests/test_parse.py b/tests/test_parse.py index 28c8609..a29b7a1 100644 --- a/tests/test_parse.py +++ b/tests/test_parse.py @@ -213,12 +213,20 @@ class TestIocAssembly(unittest.TestCase): def test_no_ioc_holds_a_recipient_address(self): # The safety property, asserted over the whole output. for name in ("simple.eml", "forged-chain.eml", "with-attachment.eml", - "redirector.eml"): + "redirector.eml", "leaky.eml"): iocs = parse.iocs(load(name), trusted=["192.0.2.0/24"]) blob = repr(iocs) self.assertNotIn("you@example.org", blob) self.assertNotIn("example.org", blob) + def test_the_address_does_not_survive_any_url_shape(self): + # leaky.eml carries you@example.org in five placements. Each one has + # been a real leak in this codebase or is one shape away from it. + iocs = parse.iocs(load("leaky.eml"), trusted=["192.0.2.0/24"]) + blob = repr(iocs) + self.assertNotIn("you@example.org", blob) + self.assertNotIn("you%40example.org", blob) + if __name__ == "__main__": unittest.main() |