46 lines
1.6 KiB
Python
46 lines
1.6 KiB
Python
import unittest
|
|
|
|
from redflare.core.surface_graph import AttackSurfaceGraph
|
|
|
|
|
|
class SurfaceGraphTests(unittest.TestCase):
|
|
def test_merges_sources_methods_and_query_parameters(self):
|
|
graph = AttackSurfaceGraph()
|
|
graph.add_endpoint(
|
|
"https://example.test",
|
|
"https://example.test/api/users?id=7",
|
|
method="GET",
|
|
source="html-link",
|
|
)
|
|
graph.add_endpoint(
|
|
"https://example.test",
|
|
"https://example.test/api/users?id=9",
|
|
method="POST",
|
|
source="openapi",
|
|
parameters=[{"name": "name", "location": "body", "required": True, "data_type": "string"}],
|
|
)
|
|
snapshot = graph.snapshot()
|
|
endpoints = snapshot["targets"]["https://example.test"]["endpoints"]
|
|
self.assertEqual(len(endpoints), 1)
|
|
self.assertEqual(endpoints[0]["methods"], ["GET", "POST"])
|
|
self.assertEqual({item["name"] for item in endpoints[0]["parameters"]}, {"id", "name"})
|
|
self.assertEqual(
|
|
graph.request_urls("https://example.test"),
|
|
["https://example.test/api/users?id=7"],
|
|
)
|
|
|
|
def test_redacts_sensitive_query_values_in_snapshot(self):
|
|
graph = AttackSurfaceGraph()
|
|
graph.add_endpoint(
|
|
"https://example.test",
|
|
"https://example.test/callback?id=7&access_token=super-secret",
|
|
source="browser-traffic",
|
|
)
|
|
serialized = str(graph.snapshot())
|
|
self.assertNotIn("super-secret", serialized)
|
|
self.assertIn("access_token=%3Credacted%3E", serialized)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|