starred/shelfmark
1
0
Fork 0
mirror of https://github.com/calibrain/shelfmark.git synced 2026-10-05 22:05:50 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

Restrict SABnzbd NZB prefetch origins (#967)

Browse Source
This commit is contained in:
Alex
2026-05-09 13:44:47 +01:00
committed by GitHub
parent eee8ba0e83
commit 81b448bc9f
2 changed files with 75 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/prowlarr/test_sabnzbd_client.py
+34
View File
@@ -476,6 +476,7 @@ class TestSABnzbdClientAddDownload:
"SABNZBD_URL": "http://localhost:8080",
"SABNZBD_API_KEY": "abc123",
"SABNZBD_CATEGORY": "books",
"PROWLARR_URL": "https://example.com",
}
monkeypatch.setattr(
"shelfmark.download.clients.sabnzbd.config.get",
@@ -512,6 +513,7 @@ class TestSABnzbdClientAddDownload:
"SABNZBD_URL": "http://localhost:8080",
"SABNZBD_API_KEY": "abc123",
"SABNZBD_CATEGORY": "books",
"PROWLARR_URL": "https://example.com",
}
monkeypatch.setattr(
"shelfmark.download.clients.sabnzbd.config.get",
@@ -551,6 +553,7 @@ class TestSABnzbdClientAddDownload:
"SABNZBD_URL": "http://localhost:8080",
"SABNZBD_API_KEY": "abc123",
"SABNZBD_CATEGORY": "books",
"PROWLARR_URL": "https://example.com",
}
monkeypatch.setattr(
"shelfmark.download.clients.sabnzbd.config.get",
@@ -592,6 +595,7 @@ class TestSABnzbdClientAddDownload:
"SABNZBD_URL": "http://localhost:8080",
"SABNZBD_API_KEY": "abc123",
"SABNZBD_CATEGORY": "books",
"PROWLARR_URL": "https://example.com",
}
monkeypatch.setattr(
"shelfmark.download.clients.sabnzbd.config.get",
@@ -620,6 +624,36 @@ class TestSABnzbdClientAddDownload:
assert result == "SABnzbd_nzo_fallback"
assert mock_api_call.call_args[0][0] == "addurl"
def test_add_download_does_not_prefetch_untrusted_nzb_url(self, monkeypatch):
"""Untrusted NZB URLs should be handed to SABnzbd without backend prefetch."""
config_values = {
"SABNZBD_URL": "http://localhost:8080",
"SABNZBD_API_KEY": "abc123",
"SABNZBD_CATEGORY": "books",
"PROWLARR_URL": "https://prowlarr.example",
}
monkeypatch.setattr(
"shelfmark.download.clients.sabnzbd.config.get",
lambda key, default="": config_values.get(key, default),
)
mock_response = MagicMock()
mock_response.json.return_value = {"status": True, "nzo_ids": ["SABnzbd_nzo_addurl"]}
with patch(
"shelfmark.download.clients.sabnzbd.requests.get",
return_value=mock_response,
) as mock_get:
from shelfmark.download.clients.sabnzbd import SABnzbdClient
client = SABnzbdClient()
result = client.add_download("https://attacker.example/download.nzb", "Test Book")
assert result == "SABnzbd_nzo_addurl"
called_urls = [call.args[0] for call in mock_get.call_args_list]
assert "https://attacker.example/download.nzb" not in called_urls
assert called_urls == ["http://localhost:8080/api"]
class TestSABnzbdClientRemove:
"""Tests for SABnzbdClient.remove()."""