Spaces:

Ma-Ri-Ba-Ku
/

Picarones

Running

App Files Files Community

Claude commited on about 1 month ago

Commit

bb446fd

unverified ·

1 Parent(s): 560f151

test(rename): dé-sprintage tests/security (9 fichiers, git mv)

Browse files

Files changed (11) hide show

docs/explanation/architecture.md +10 -10
docs/migration/option_b_test_inventory.md +1 -1
tests/security/{test_sprint_a14_s20_corpus_service.py → test_corpus_service.py} +0 -0
tests/security/{test_s1_csrf_required.py → test_csrf_required.py} +0 -0
tests/security/{test_sprint_a14_s1_path_validation.py → test_path_validation.py} +0 -0
tests/security/{test_s8_security_helpers.py → test_security_helpers.py} +0 -0
tests/security/{test_s1_ssrf_attack.py → test_ssrf_attack.py} +0 -0
tests/security/{test_sprint_a14_s19_workspace_manager.py → test_workspace_manager.py} +0 -0
tests/security/{test_s1_xss_in_reports.py → test_xss_in_reports.py} +0 -0
tests/security/{test_s1_xxe_attack.py → test_xxe_attack.py} +0 -0
tests/security/{test_s1_zip_slip_attack.py → test_zip_slip_attack.py} +0 -0

docs/explanation/architecture.md CHANGED Viewed

@@ -72,7 +72,7 @@ normalisé.  Dépend du domain ; aucune logique d'évaluation.
 Le parser XML interne (`_xml_utils.safe_parse_xml`) délègue à
 `defusedxml` avec `forbid_dtd=True`, bloquant XXE, Billion Laughs
 et déclarations `<!DOCTYPE>`.  Les défenses sont verrouillées par
-`tests/security/test_s1_xxe_attack.py` (Sprint S1.4).
 ### `picarones/evaluation/` — moteurs d'évaluation
@@ -130,7 +130,7 @@ produit un artefact texte que `evaluation/` consommera).
 **Anti-SSRF** : `corpus/_http.py:validate_http_url` refuse
 loopback, lien-local, RFC 1918, métadonnées cloud (AWS
 `169.254.169.254`, GCP `metadata.google.internal`).  Verrouillé par
-`tests/security/test_s1_ssrf_attack.py` (Sprint S1.6).
 ### `picarones/app/` — services applicatifs
@@ -153,7 +153,7 @@ Orchestration entre adapters et evaluation.
 **Anti ZIP slip** : `corpus_service._extract_safely` rejette les
 chemins absolus, `..`, octets nuls, symlinks ZIP entries
 (mode UNIX 0xA000), avec garde-fou final `target.resolve().relative_to(extract_dir)`.
-Verrouillé par `tests/security/test_s1_zip_slip_attack.py`.
 ### `picarones/reports/` — rendu déterministe
@@ -176,7 +176,7 @@ citer.
 helper `_safe_json_for_script_tag` qui encode `<>&` en
 `<>&` pour le JSON injecté dans
 `<script type="application/json">`.  Verrouillé par
-`tests/security/test_s1_xss_in_reports.py` (Sprint S1.1).
 ### `picarones/interfaces/` — points d'entrée user-facing
@@ -187,7 +187,7 @@ helper `_safe_json_for_script_tag` qui encode `<>&` en
 **Anti-CSRF** : middleware `csrf_middleware` actif si
 `PICARONES_CSRF_REQUIRED=1`.  Pattern double-submit cookie + HMAC
-signature.  Verrouillé par `tests/security/test_s1_csrf_required.py`.
 ## Principes architecturaux
@@ -229,11 +229,11 @@ de code humaine raterait :
 Sprint S1 a ajouté 63 tests d'attaque qui verrouillent les
 défenses revendiquées :
-- `tests/security/test_s1_xss_in_reports.py` (5) — autoescape Jinja2 + escape JSON.
-- `tests/security/test_s1_xxe_attack.py` (9) — XXE / Billion Laughs / DTD.
-- `tests/security/test_s1_zip_slip_attack.py` (9) — ZIP slip + symlinks.
-- `tests/security/test_s1_ssrf_attack.py` (26) — loopback, RFC 1918, métadonnées cloud.
-- `tests/security/test_s1_csrf_required.py` (14) — double-submit + HMAC.
 ### Reproductibilité bit-for-bit

 Le parser XML interne (`_xml_utils.safe_parse_xml`) délègue à
 `defusedxml` avec `forbid_dtd=True`, bloquant XXE, Billion Laughs
 et déclarations `<!DOCTYPE>`.  Les défenses sont verrouillées par
+`tests/security/test_xxe_attack.py` (Sprint S1.4).
 ### `picarones/evaluation/` — moteurs d'évaluation
 **Anti-SSRF** : `corpus/_http.py:validate_http_url` refuse
 loopback, lien-local, RFC 1918, métadonnées cloud (AWS
 `169.254.169.254`, GCP `metadata.google.internal`).  Verrouillé par
+`tests/security/test_ssrf_attack.py` (Sprint S1.6).
 ### `picarones/app/` — services applicatifs
 **Anti ZIP slip** : `corpus_service._extract_safely` rejette les
 chemins absolus, `..`, octets nuls, symlinks ZIP entries
 (mode UNIX 0xA000), avec garde-fou final `target.resolve().relative_to(extract_dir)`.
+Verrouillé par `tests/security/test_zip_slip_attack.py`.
 ### `picarones/reports/` — rendu déterministe
 helper `_safe_json_for_script_tag` qui encode `<>&` en
 `<>&` pour le JSON injecté dans
 `<script type="application/json">`.  Verrouillé par
+`tests/security/test_xss_in_reports.py` (Sprint S1.1).
 ### `picarones/interfaces/` — points d'entrée user-facing
 **Anti-CSRF** : middleware `csrf_middleware` actif si
 `PICARONES_CSRF_REQUIRED=1`.  Pattern double-submit cookie + HMAC
+signature.  Verrouillé par `tests/security/test_csrf_required.py`.
 ## Principes architecturaux
 Sprint S1 a ajouté 63 tests d'attaque qui verrouillent les
 défenses revendiquées :
+- `tests/security/test_xss_in_reports.py` (5) — autoescape Jinja2 + escape JSON.
+- `tests/security/test_xxe_attack.py` (9) — XXE / Billion Laughs / DTD.
+- `tests/security/test_zip_slip_attack.py` (9) — ZIP slip + symlinks.
+- `tests/security/test_ssrf_attack.py` (26) — loopback, RFC 1918, métadonnées cloud.
+- `tests/security/test_csrf_required.py` (14) — double-submit + HMAC.
 ### Reproductibilité bit-for-bit

docs/migration/option_b_test_inventory.md CHANGED Viewed

@@ -60,7 +60,7 @@ fait dans une fixture partagée.
 | B11 | `tests/integration/test_importer_fallback_wiring.py` | Fallback importer. Test d'intégration. |
 | B12 | `tests/integration/test_s5_disk_full_simulation.py` | Disque plein. |
 | B13 | `tests/security/test_phase1_post_rewrite_wiring.py` | Sécurité post-rewrite. |
-| B14 | `tests/security/test_s1_xss_in_reports.py` | XSS dans rapports. |
 | B15 | `tests/test_minimal_install.py` | Installation minimale (smoke test). |
 | B16 | `tests/web/test_ux_save_compare.py` | UX save/compare web. |

 | B11 | `tests/integration/test_importer_fallback_wiring.py` | Fallback importer. Test d'intégration. |
 | B12 | `tests/integration/test_s5_disk_full_simulation.py` | Disque plein. |
 | B13 | `tests/security/test_phase1_post_rewrite_wiring.py` | Sécurité post-rewrite. |
+| B14 | `tests/security/test_xss_in_reports.py` | XSS dans rapports. |
 | B15 | `tests/test_minimal_install.py` | Installation minimale (smoke test). |
 | B16 | `tests/web/test_ux_save_compare.py` | UX save/compare web. |

tests/security/{test_sprint_a14_s20_corpus_service.py → test_corpus_service.py} RENAMED Viewed

File without changes

tests/security/{test_s1_csrf_required.py → test_csrf_required.py} RENAMED Viewed

File without changes

tests/security/{test_sprint_a14_s1_path_validation.py → test_path_validation.py} RENAMED Viewed

File without changes

tests/security/{test_s8_security_helpers.py → test_security_helpers.py} RENAMED Viewed

File without changes

tests/security/{test_s1_ssrf_attack.py → test_ssrf_attack.py} RENAMED Viewed

File without changes

tests/security/{test_sprint_a14_s19_workspace_manager.py → test_workspace_manager.py} RENAMED Viewed

File without changes

tests/security/{test_s1_xss_in_reports.py → test_xss_in_reports.py} RENAMED Viewed

File without changes

tests/security/{test_s1_xxe_attack.py → test_xxe_attack.py} RENAMED Viewed

File without changes

tests/security/{test_s1_zip_slip_attack.py → test_zip_slip_attack.py} RENAMED Viewed

File without changes