rene
1ff66a7083
PYDANTIC max_length (38 Routen, ~400 Field-Constraints): Schützt vor DoS durch Riesen-Payloads (10MB Thread-Titel etc.). Pragmatische Limits: - Titel/Name: 200 · Beschreibung/Body: 10000 · Notiz: 5000 - Email: 254 (RFC 5321) · URL: 500 · Slug/Kategorie: 100 - Hund-Name/Rasse: 80 · Hund-Bio: 2000 Top-betroffen: forum.py, diary.py, health.py, dogs.py, expenses.py, notes.py, auth.py, profile.py. Manuelle len()-Checks in profile, chat, ki entfernt (jetzt durch Field abgedeckt). PYTEST COVERAGE (+19 Tests, 37 grün + 1 xfail): - test_security.py: require_owner (Places GET/PATCH/DELETE mit Fremduser → 403), JWT-Blacklist (Logout invalidiert Token), Login-Lockout (5 Fehlversuche → 429 + Retry-After Header) - test_race.py: Invoice-Counter (20 parallele Threads, alle unique), Founder-Number (atomare Vergabe, voll bei 100) - test_validation.py: Forum-Titel 30k Zeichen → 422, Diary-Text 50k → 422 (verifiziert Pydantic max_length-Sweep) A11Y (Tap-Targets ≥44×44 + Dark-Mode-Kontrast): - #header-user-btn 36→44px, .header-back 40→44, .header-menu-btn 40→44 - dog-profile Wrapped-Slider Prev/Next 40→44 - forum-Lightbox Close 40→44 - --c-text-muted Light: #B0A090 (2.37:1 FAIL) → #7F6B58 (4.74:1 PASS) - --c-text-muted Dark: #806A58 (3.58:1 FAIL) → #A08878 (5.46:1 PASS) - Branding-Farben unangetastet
104 lines
3.6 KiB
Python
104 lines
3.6 KiB
Python
"""Pydantic-Validation-Tests: max_length verhindert massive Payloads.
|
|
|
|
Sprint60 hat in forum.py und diary.py max_length-Felder eingefuehrt
|
|
(titel<=200, text<=10000). Wir testen, dass ueberlange Eingaben
|
|
SOFORT mit 422 abgelehnt werden — bevor sie in die DB gelangen.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
|
|
# ==================================================================
|
|
# Forum — ThreadCreate
|
|
# ==================================================================
|
|
class TestForumValidation:
|
|
def test_forum_thread_with_overlong_title_is_422(self, client, user):
|
|
"""30000-Zeichen-Titel -> 422 (max_length=200)."""
|
|
r = client.post(
|
|
"/api/forum/threads",
|
|
headers=user["headers"],
|
|
json={
|
|
"kategorie": "allgemein",
|
|
"titel": "T" * 30_000,
|
|
"text": "Inhalt",
|
|
},
|
|
)
|
|
assert r.status_code == 422, (
|
|
f"Erwartete 422 (max_length), bekam {r.status_code}: {r.text[:200]}"
|
|
)
|
|
|
|
def test_forum_thread_with_overlong_text_is_422(self, client, user):
|
|
"""50000-Zeichen-Text -> 422 (max_length=10000)."""
|
|
r = client.post(
|
|
"/api/forum/threads",
|
|
headers=user["headers"],
|
|
json={
|
|
"kategorie": "allgemein",
|
|
"titel": "Ok-Titel",
|
|
"text": "X" * 50_000,
|
|
},
|
|
)
|
|
assert r.status_code == 422, (
|
|
f"Erwartete 422, bekam {r.status_code}: {r.text[:200]}"
|
|
)
|
|
|
|
def test_forum_thread_at_max_length_passes_validation(self, client, user):
|
|
"""200-Zeichen-Titel + 10000-Zeichen-Text muss durchgehen."""
|
|
r = client.post(
|
|
"/api/forum/threads",
|
|
headers=user["headers"],
|
|
json={
|
|
"kategorie": "allgemein",
|
|
"titel": "T" * 200,
|
|
"text": "X" * 10_000,
|
|
},
|
|
)
|
|
# Darf nicht 422 sein — moegliche Codes 200/201/400 sind ok
|
|
assert r.status_code != 422, (
|
|
f"Grenzwerte sollten validieren, bekam 422: {r.text[:200]}"
|
|
)
|
|
|
|
|
|
# ==================================================================
|
|
# Diary — DiaryCreate
|
|
# ==================================================================
|
|
class TestDiaryValidation:
|
|
def test_diary_with_overlong_text_is_422(self, client, user, dog):
|
|
"""50000-Zeichen-Text -> 422 (max_length=10000)."""
|
|
r = client.post(
|
|
f"/api/dogs/{dog['id']}/diary",
|
|
headers=user["headers"],
|
|
json={
|
|
"titel": "Mein Eintrag",
|
|
"text": "X" * 50_000,
|
|
},
|
|
)
|
|
assert r.status_code == 422, (
|
|
f"Erwartete 422, bekam {r.status_code}: {r.text[:200]}"
|
|
)
|
|
|
|
def test_diary_with_overlong_title_is_422(self, client, user, dog):
|
|
"""5000-Zeichen-Titel -> 422 (max_length=200)."""
|
|
r = client.post(
|
|
f"/api/dogs/{dog['id']}/diary",
|
|
headers=user["headers"],
|
|
json={
|
|
"titel": "T" * 5_000,
|
|
"text": "kurzer Text",
|
|
},
|
|
)
|
|
assert r.status_code == 422, (
|
|
f"Erwartete 422, bekam {r.status_code}: {r.text[:200]}"
|
|
)
|
|
|
|
def test_diary_with_normal_payload_succeeds(self, client, user, dog):
|
|
"""Sanity-Check: normaler Eintrag geht durch."""
|
|
r = client.post(
|
|
f"/api/dogs/{dog['id']}/diary",
|
|
headers=user["headers"],
|
|
json={
|
|
"titel": "Normal",
|
|
"text": "Normaler Text-Inhalt.",
|
|
},
|
|
)
|
|
assert r.status_code in (200, 201), r.text
|