You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have a concern that the DNS rebinding test may be ambiguous in asserting the correct response.
In the rebinding test it appears that the code sets check = 1 in the initial success .then on line 76, and in the .catch if the status code is a 400 on line 80.
@craig-davis, I agree; it's ambiguous and need to figure out a better approach to handle it.
The rebind.it URL being used for the test resolves to a public IP first and subsequently resolves to an internal IP (127.0.0.1) - If response from the public server is received, it'll pass and fail otherwise. So, the test was added to ensure it's safe from DSN rebinding.
What about using sinon to spy on the checkIp() function?
The function would have to get relocated so it could be accessed. Having a spy on it or a stub in place would allow the tests to make assertions about the IP it was called with and how many times it's been called.
I have a concern that the DNS rebinding test may be ambiguous in asserting the correct response.
In the rebinding test it appears that the code sets
check = 1
in the initial success.then
on line 76, and in the.catch
if the status code is a400
on line 80.ssrf-req-filter/test/index.js
Lines 73 to 88 in 170b64d
The test then asserts that
check
has a value of1
. This seems to say that the test will pass with either a 200 or a 400 response from the server.Is this the correct interpretation of this test?
The text was updated successfully, but these errors were encountered: