fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -9,6 +9,38 @@ namespace JobTrackerApi.Tests;

 public sealed class JobImportServiceTests
 {
+    [Theory]
+    [InlineData("http://10.1.2.3/")]
+    [InlineData("http://[::ffff:10.1.2.3]/")]
+    [InlineData("http://169.254.169.254/")]
+    [InlineData("http://[::ffff:169.254.169.254]/")]
+    [InlineData("http://192.168.1.1/")]
+    [InlineData("http://[::ffff:192.168.1.1]/")]
+    [InlineData("http://[::ffff:a01:203]/")]
+    [InlineData("http://[::ffff:127.0.0.1]/")]
+    [InlineData("http://2130706433/")]
+    [InlineData("http://0x7f000001/")]
+    [InlineData("http://0177.0.0.1/")]
+    [InlineData("http://127.1/")]
+    public async Task Preview_rejects_equivalent_private_literals_before_http_send(string url)
+    {
+        var resolver = new Mock<IHostAddressResolver>(MockBehavior.Strict);
+        var sends = 0;
+        var handler = new StubHttpMessageHandler(_ =>
+        {
+            sends++;
+            return new HttpResponseMessage(HttpStatusCode.OK) { Content = new StringContent("<html></html>") };
+        });
+
+        var result = await CreateService(resolver.Object, handler).PreviewAsync(url, CancellationToken.None);
+
+        Assert.Equal(0, sends);
+        Assert.False(result.Success);
+        Assert.Equal("none", result.Parser);
+        Assert.Equal("Local or private network URLs are not allowed.", result.Error);
+        resolver.VerifyNoOtherCalls();
+    }
+
    [Fact]
    public async Task Preview_rejects_hostname_that_resolves_to_loopback()
    {