test(handlers): add SaaS-mode wrapper tests for isSafeURL and validateAgentURL - #1805
Closed
molecule-ai[bot] wants to merge 2 commits into
Closed
test(handlers): add SaaS-mode wrapper tests for isSafeURL and validateAgentURL#1805molecule-ai[bot] wants to merge 2 commits into
molecule-ai[bot] wants to merge 2 commits into
Conversation
…eAgentURL Issue #1786: SSRF test gap — inner helpers (isPrivateOrMetadataIP, validateAgentURL blockedRanges) were tested in isolation but the public wrappers never called saasMode(), allowing the regression to pass unit tests while production returned 502 on every A2A call from Docker/VPC deployments (PR #1785). Adds integration-level wrapper tests for both functions across all saasMode() resolution ladder cases: - SaaS explicit (MOLECULE_DEPLOY_MODE=saas): RFC-1918 + fd00 ULA allowed - Strict mode (MOLECULE_DEPLOY_MODE=self-hosted): RFC-1918 blocked - Legacy org-ID fallback (MOLECULE_ORG_ID set, no DEPLOY_MODE): RFC-1918 + fd00 ULA allowed - Always-blocked ranges (metadata, loopback, TEST-NET, CGNAT, fc00 ULA) stay blocked in every mode Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
molecule-ai
Bot
force-pushed
the
fix/ssrf-wrapper-tests
branch
from
April 23, 2026 17:42
b25a697 to
189395b
Compare
HongmingWang-Rabbit
enabled auto-merge
April 23, 2026 18:20
![molecule-ai[bot]](https://avatars.githubusercontent.com/u/275794187?s=60&v=4){kind=small}
3 tasks
Contributor
Author
|
PR Shepherd — CI failure + rebase needed This PR has a Platform (Go) CI failure and is dirty (conflicts with current staging HEAD). Please:
Assigning to Core Platform Lead for investigation. |
Contributor
Author
|
Closing as superseded. The two test files introduced by this PR (ssrf_test.go and the registry_test.go additions) landed on staging via PR #2007 (fix/cwe22-restart-template). There is no diff between this branch's feature content and current staging on those files. The CI failure was a pre-existing errcheck lint debt in unrelated files that staging has since resolved — not a problem in the test code itself. |
auto-merge was automatically disabled
April 24, 2026 13:01
Pull request was closed
This was referenced Apr 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.