Upload files to "tests"

2026-06-21 17:44:33 +00:00
parent 418f5baf36
commit a51dd25ac4
4 changed files with 175 additions and 0 deletions
@@ -0,0 +1,45 @@
+import unittest
+
+from redflare.core.surface_graph import AttackSurfaceGraph
+
+
+class SurfaceGraphTests(unittest.TestCase):
+    def test_merges_sources_methods_and_query_parameters(self):
+        graph = AttackSurfaceGraph()
+        graph.add_endpoint(
+            "https://example.test",
+            "https://example.test/api/users?id=7",
+            method="GET",
+            source="html-link",
+        )
+        graph.add_endpoint(
+            "https://example.test",
+            "https://example.test/api/users?id=9",
+            method="POST",
+            source="openapi",
+            parameters=[{"name": "name", "location": "body", "required": True, "data_type": "string"}],
+        )
+        snapshot = graph.snapshot()
+        endpoints = snapshot["targets"]["https://example.test"]["endpoints"]
+        self.assertEqual(len(endpoints), 1)
+        self.assertEqual(endpoints[0]["methods"], ["GET", "POST"])
+        self.assertEqual({item["name"] for item in endpoints[0]["parameters"]}, {"id", "name"})
+        self.assertEqual(
+            graph.request_urls("https://example.test"),
+            ["https://example.test/api/users?id=7"],
+        )
+
+    def test_redacts_sensitive_query_values_in_snapshot(self):
+        graph = AttackSurfaceGraph()
+        graph.add_endpoint(
+            "https://example.test",
+            "https://example.test/callback?id=7&access_token=super-secret",
+            source="browser-traffic",
+        )
+        serialized = str(graph.snapshot())
+        self.assertNotIn("super-secret", serialized)
+        self.assertIn("access_token=%3Credacted%3E", serialized)
+
+
+if __name__ == "__main__":
+    unittest.main()