mirror of
https://github.com/browser-use/browser-use
synced 2026-05-13 17:56:35 +02:00
22 lines
1.0 KiB
Python
22 lines
1.0 KiB
Python
from browser_use.browser.context import BrowserContext, BrowserContextConfig
|
|
|
|
|
|
class TestUrlAllowlistSecurity:
|
|
"""Tests for URL allowlist security bypass prevention."""
|
|
|
|
def test_authentication_bypass_prevention(self):
|
|
"""Test that the URL allowlist cannot be bypassed using authentication credentials."""
|
|
# Create a context config with a sample allowed domain
|
|
config = BrowserContextConfig(allowed_domains=['example.com'])
|
|
context = BrowserContext(browser=None, config=config)
|
|
|
|
# Security vulnerability test cases
|
|
# These should all be detected as malicious despite containing "example.com"
|
|
assert context._is_url_allowed('https://example.com:password@malicious.com') is False
|
|
assert context._is_url_allowed('https://example.com@malicious.com') is False
|
|
assert context._is_url_allowed('https://example.com%20@malicious.com') is False
|
|
assert context._is_url_allowed('https://example.com%3A@malicious.com') is False
|
|
|
|
# Make sure legitimate auth credentials still work
|
|
assert context._is_url_allowed('https://user:password@example.com') is True
|