gpt4free

公开

关注 0 Fork 0 Star 1

XFEstudio/gpt4free

Address review: rename _get_safe_types, clarify .py/.env whitelist exclusion tests

Agent-Logs-Url: https://github.com/xtekky/gpt4free/sessions/b7cbc71b-2455-4cd2-be09-f5516e4a08ee Co-authored-by: hlohaus <983577+hlohaus@users.noreply.github.com>

4e55c654

copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

提交于 2026-04-04 19:16

父提交 6ff49cb

代码差异

1 个文件 +22 -17

Modified etc/unittest/mcp.py +22 -17

@@ -709,27 +709,32 @@ class TestWorkspaceFileServing(unittest.TestCase):

709 709 if f.exists():

710 710 f.unlink()

711 711

712 def _get_safe_types(self):

713 """Extract the _WORKSPACE_SAFE_TYPES dict from the route closure."""

712 def _safe_types_defined(self) -> str:

713 """Return the register_routes source for safe-type assertions."""

714 714 import g4f.api as api_mod

715 715 import inspect

716 # Check the dict is defined in register_routes via a simple approach

717 src = inspect.getsource(api_mod.Api.register_routes)

718 return "text/html" in src and "text/css" in src and "application/javascript" in src

716 return inspect.getsource(api_mod.Api.register_routes)

719 717

720 718 def test_allowed_types_present(self):

721 """HTML, CSS, JS must be in the allowed types."""

722 self.assertTrue(self._get_safe_types())

723

724 def test_py_files_not_served(self):

725 """.py files must not be allowed (would leak provider code)."""

726 import g4f.api as api_mod

727 import inspect

728 src = inspect.getsource(api_mod.Api.register_routes)

729 # Ensure .py is not in the whitelist dict

730 self.assertIn("nosniff", src, "Security header X-Content-Type-Options missing")

731 self.assertIn("Content-Security-Policy", src, "CSP header missing")

732 self.assertIn("no-store", src, "Cache-Control: no-store header missing")

719 """HTML, CSS, JS must be in the allowed-types whitelist."""

720 src = self._safe_types_defined()

721 self.assertIn("text/html", src)

722 self.assertIn("text/css", src)

723 self.assertIn("application/javascript", src)

724

725 def test_py_extension_not_in_whitelist(self):

726 """.py must not appear as a whitelisted extension (would leak provider code)."""

727 src = self._safe_types_defined()

728 # The whitelist uses extension keys; 'py' must not be one of them.

729 # We check that "py" does not appear as a key in the _WORKSPACE_SAFE_TYPES dict.

730 self.assertNotIn('"py"', src, ".py extension must not be in the safe-types whitelist")

731 self.assertNotIn("'py'", src, ".py extension must not be in the safe-types whitelist")

732

733 def test_env_extension_not_in_whitelist(self):

734 """.env files must not be serveable."""

735 src = self._safe_types_defined()

736 self.assertNotIn('"env"', src, ".env extension must not be in the safe-types whitelist")

737 self.assertNotIn("'env'", src, ".env extension must not be in the safe-types whitelist")

733 738

734 739 def test_workspace_file_route_defined(self):

735 740 """The /pa/files/{file_path:path} route must be registered."""