From ba4c0dc9f6374653566fd6fa8db401c94cb3c062 Mon Sep 17 00:00:00 2001 From: pedrooot Date: Wed, 7 Oct 2026 17:44:26 +0200 Subject: [PATCH] test(network): assert the CLI opt-out by behaviour --- tests/lib/network/ssrf_test.py | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/tests/lib/network/ssrf_test.py b/tests/lib/network/ssrf_test.py index 1c8fd8a119..0ca672fd95 100644 --- a/tests/lib/network/ssrf_test.py +++ b/tests/lib/network/ssrf_test.py @@ -1,5 +1,5 @@ import ipaddress -import pathlib +import os import socket from unittest import mock @@ -11,6 +11,7 @@ from prowler.lib.network.ssrf import ( OutboundURLNotAllowedError, allowed_private_networks, extract_host, + outbound_check_skipped, validate_outbound_host, validate_outbound_url, ) @@ -108,9 +109,29 @@ class TestOutboundCheckOptOut: with pytest.raises(OutboundURLNotAllowedError): validate_outbound_host("169.254.169.254") - def test_the_cli_entrypoint_opts_out(self): - source = pathlib.Path("prowler/__main__.py").read_text() - assert "os.environ.setdefault(SKIP_OUTBOUND_CHECK_ENV" in source + def test_the_cli_entrypoint_opts_out(self, monkeypatch): + """prowler() must set the opt-out before it does anything else.""" + # a throwaway mapping, so the variable prowler() sets cannot leak into + # the tests that assert the check is enforced + monkeypatch.setattr(os, "environ", dict(os.environ)) + os.environ.pop(SKIP_OUTBOUND_CHECK_ENV, None) + + import prowler.__main__ as prowler_main + + class _Stop(Exception): + pass + + def _parser_that_stops(): + # raised from the first statement after the opt-out, so reaching here + # proves the variable was already set + raise _Stop + + monkeypatch.setattr(prowler_main, "ProwlerArgumentParser", _parser_that_stops) + + with pytest.raises(_Stop): + prowler_main.prowler() + + assert outbound_check_skipped() class TestAllowedPrivateNetworks: