Skip to content

Commit 9aff9d5

Browse files
[autofix.ci] apply automated fixes
1 parent 80219c8 commit 9aff9d5

File tree

2 files changed

+22
-5
lines changed

2 files changed

+22
-5
lines changed

api/tests/integration_tests/ssrf_proxy/TEST_CASES_README.md

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,25 +13,29 @@ These tests are located in `api/tests/integration_tests/ssrf_proxy/` because the
1313
### Basic Testing
1414

1515
From the `api/` directory:
16+
1617
```bash
1718
uv run python tests/integration_tests/ssrf_proxy/test_ssrf_proxy.py
1819
```
1920

2021
Or from the repository root:
22+
2123
```bash
2224
cd api && uv run python tests/integration_tests/ssrf_proxy/test_ssrf_proxy.py
2325
```
2426

2527
### List Available Tests
2628

2729
View all test cases without running them:
30+
2831
```bash
2932
uv run python tests/integration_tests/ssrf_proxy/test_ssrf_proxy.py --list-tests
3033
```
3134

3235
### Use Custom Test File
3336

3437
Run tests from a specific YAML file:
38+
3539
```bash
3640
uv run python tests/integration_tests/ssrf_proxy/test_ssrf_proxy.py --test-file test_cases_extended.yaml
3741
```
@@ -41,11 +45,13 @@ uv run python tests/integration_tests/ssrf_proxy/test_ssrf_proxy.py --test-file
4145
**WARNING: Development mode DISABLES all SSRF protections! Only use in development environments!**
4246

4347
Test the development mode configuration (used by docker-compose.middleware.yaml):
48+
4449
```bash
4550
uv run python tests/integration_tests/ssrf_proxy/test_ssrf_proxy.py --dev-mode
4651
```
4752

4853
Development mode:
54+
4955
- Mounts `conf.d.dev/` configuration that allows ALL requests
5056
- Uses `test_cases_dev_mode.yaml` by default (all tests expect ALLOW)
5157
- Verifies that private networks, cloud metadata, and non-standard ports are accessible
@@ -80,8 +86,8 @@ test_categories:
8086
## Available Test Files
8187
8288
1. **test_cases.yaml** - Standard test suite with essential test cases (default)
83-
2. **test_cases_extended.yaml** - Extended test suite with additional edge cases and scenarios
84-
3. **test_cases_dev_mode.yaml** - Development mode test suite (all requests should be allowed)
89+
1. **test_cases_extended.yaml** - Extended test suite with additional edge cases and scenarios
90+
1. **test_cases_dev_mode.yaml** - Development mode test suite (all requests should be allowed)
8591
8692
All files are located in `api/tests/integration_tests/ssrf_proxy/`
8793

@@ -102,10 +108,11 @@ All files are located in `api/tests/integration_tests/ssrf_proxy/`
102108
## Adding New Test Cases
103109

104110
1. Edit the YAML file (or create a new one)
105-
2. Add test cases under appropriate categories
106-
3. Run with `--test-file` option if using a custom file
111+
1. Add test cases under appropriate categories
112+
1. Run with `--test-file` option if using a custom file
107113

108114
Example:
115+
109116
```yaml
110117
test_categories:
111118
custom_tests:
@@ -121,6 +128,7 @@ test_categories:
121128
## What Gets Tested
122129

123130
The tests validate the SSRF proxy configuration files in `docker/ssrf_proxy/`:
131+
124132
- `squid.conf.template` - Squid proxy configuration
125133
- `docker-entrypoint.sh` - Container initialization script
126134
- `conf.d/` - Additional configuration files (if present)
@@ -129,6 +137,7 @@ The tests validate the SSRF proxy configuration files in `docker/ssrf_proxy/`:
129137
## Development Mode Configuration
130138

131139
Development mode provides a zero-configuration environment for local development:
140+
132141
- Mounts `conf.d.dev/` instead of `conf.d/`
133142
- Allows ALL requests including private networks and cloud metadata
134143
- Enables access to any port
@@ -137,12 +146,14 @@ Development mode provides a zero-configuration environment for local development
137146
### Using Development Mode with Docker Compose
138147

139148
From the main Dify repository root:
149+
140150
```bash
141151
# Use the development overlay
142152
docker-compose -f docker-compose.middleware.yaml -f docker/ssrf_proxy/docker-compose.dev.yaml up ssrf_proxy
143153
```
144154

145155
Or manually mount the development configuration:
156+
146157
```bash
147158
docker run -d \
148159
--name ssrf-proxy-dev \
@@ -161,4 +172,4 @@ docker run -d \
161172
- **Clarity**: YAML format is human-readable and self-documenting
162173
- **Flexibility**: Multiple test files for different scenarios
163174
- **Fallback**: Code includes default test cases if YAML loading fails
164-
- **Integration**: Properly integrated with the API project's Python environment
175+
- **Integration**: Properly integrated with the API project's Python environment

docker/ssrf_proxy/README.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ The following networks are blocked by default to prevent SSRF:
9797
⚠️ **WARNING: Development mode DISABLES all SSRF protections! Only use in development environments!**
9898

9999
Development mode provides a zero-configuration environment that:
100+
100101
- Allows access to ALL private networks and localhost
101102
- Allows access to cloud metadata endpoints
102103
- Allows connections to any port
@@ -105,14 +106,18 @@ Development mode provides a zero-configuration environment that:
105106
### Using Development Mode
106107

107108
#### Option 1: Docker Compose Override (Recommended)
109+
108110
From the main Dify repository root:
111+
109112
```bash
110113
# Use the development overlay with your existing docker-compose
111114
docker-compose -f docker-compose.middleware.yaml -f docker/ssrf_proxy/docker-compose.dev.yaml up ssrf_proxy
112115
```
113116

114117
#### Option 2: Manual Configuration
118+
115119
Mount the development configuration manually:
120+
116121
```bash
117122
docker run -d \
118123
--name ssrf-proxy-dev \
@@ -145,6 +150,7 @@ uv run python tests/integration_tests/ssrf_proxy/test_ssrf_proxy.py --dev-mode
145150
```
146151

147152
The test suite validates:
153+
148154
- Blocking of private networks and loopback addresses
149155
- Blocking of cloud metadata endpoints
150156
- Allowing of public internet resources

0 commit comments

Comments
 (0)