From 6c9591df4d4bf548475842d54252af38d318e3de Mon Sep 17 00:00:00 2001 From: Xuanyi Lyu Date: Tue, 25 Nov 2025 21:51:22 -0500 Subject: [PATCH 1/4] Part 3: Test Coverage Depth for Input Validator Module --- src/security/input_validator.py | 8 ++ tests/test_input_validator_depth.py | 193 ++++++++++++++++++++++++++++ 2 files changed, 201 insertions(+) create mode 100644 tests/test_input_validator_depth.py diff --git a/src/security/input_validator.py b/src/security/input_validator.py index 8ebad5b..aef0c8c 100644 --- a/src/security/input_validator.py +++ b/src/security/input_validator.py @@ -201,6 +201,10 @@ def sanitize_sql_input(text): Sanitize input to prevent SQL injection. Note: This is a backup. Always use parameterized queries as primary defense. + Edge Case Note: This function performs a single-pass replacement. + Constructed inputs like 'xpxp__' will result in 'xp_' after sanitization. + See tests/test_input_validator_depth.py::test_sanitize_sql_input_recursive_bypass + Args: text: Raw text input @@ -318,6 +322,10 @@ def sanitize_filename(filename): """ Sanitize filename to prevent directory traversal and other attacks. + Edge Case Note: This function does not filter Windows reserved filenames (CON, PRN, etc.). + It relies on the OS to handle or reject them, or they are considered valid in this context. + See tests/test_input_validator_depth.py::test_sanitize_filename_reserved_windows_names + Args: filename: Original filename diff --git a/tests/test_input_validator_depth.py b/tests/test_input_validator_depth.py new file mode 100644 index 0000000..10cbc0c --- /dev/null +++ b/tests/test_input_validator_depth.py @@ -0,0 +1,193 @@ +""" +Part 3: Test Coverage Depth for Input Validator Module +This module contains unit tests targeting edge cases, failure modes, and security bypass attempts +for src/security/input_validator.py. +""" + +import pytest +from marshmallow import ValidationError +from unittest.mock import MagicMock +import os + +from src.security.input_validator import ( + sanitize_text, + sanitize_filename, + sanitize_sql_input, + is_suspicious_content, + validate_file_upload, + LoginSchema, + RegistrationSchema, + PredictionSchema, + BatchPredictionSchema +) + +class TestInputValidatorDepth: + + # --- Sanitize Text Edge Cases --- + + def test_sanitize_text_recursive_html(self): + """ + Edge Case: Recursive HTML tags. + Some sanitizers might strip tags, allowing nested tags to become valid. + sanitize_text uses html.escape, so it should safely escape everything without recursive issues. + Input: ipt> + Expected: <scr<script>ipt> + """ + text = "ipt>" + sanitized = sanitize_text(text) + assert sanitized == "<scr<script>ipt>" + assert "