From 725c3ec4bc4283f73fce3e881e8187f4e30fb4e4 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Thu, 1 Oct 2026 21:51:09 +0530 Subject: [PATCH] test(auth): fold backslash-userinfo redirect case into the boundary table The standalone parser-differential test duplicated the authorize-rejection assertions of test_native_redirect_uri_boundary_matches_browser_authority; moving its URI into the rejected tuple keeps the coverage (400, no cookie) with one test instead of two. --- .../test_dashboard_auth_native_flow.py | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) diff --git a/tests/hermes_cli/test_dashboard_auth_native_flow.py b/tests/hermes_cli/test_dashboard_auth_native_flow.py index 4bf0ab4002..b6c4257282 100644 --- a/tests/hermes_cli/test_dashboard_auth_native_flow.py +++ b/tests/hermes_cli/test_dashboard_auth_native_flow.py @@ -452,27 +452,11 @@ def _start_native_password_login(client, *, challenge, state="desk-state"): return r.cookies -def test_native_password_login_rejects_browser_parser_differential(pw_gated_client): - """A redirect accepted as loopback must not resolve to a remote browser authority.""" - _verifier, challenge = _make_pkce() - r = pw_gated_client.get( - "/auth/native/authorize", - params={ - "provider": "testpw", - "code_challenge": challenge, - "code_challenge_method": "S256", - "redirect_uri": "http://attacker.example\\@127.0.0.1/callback", - "state": "desk-state", - }, - ) - assert r.status_code == 400, r.text - assert "set-cookie" not in r.headers - - def test_native_redirect_uri_boundary_matches_browser_authority(gated_client): """Only canonical loopback authorities survive the upstream OAuth callback.""" verifier, challenge = _make_pkce() rejected = ( + "http://attacker.example\\@127.0.0.1/callback", # browser authority = attacker host "http://user@127.0.0.1/callback", "http://@127.0.0.1/callback", "http://%31%32%37%2e%30%2e%30%2e%31/callback",