0.4.0

[orenlab]

No description provided.

In general, the way to fix this kind of problem is to avoid making security or correctness assertions about URLs using raw string substring/startswith/endswith checks. Instead, parse the URL using a standard library (urllib.parse.urlparse in Python) and assert on its structured components (scheme, hostname, port, path), or compare full canonical URLs when appropriate.

For this specific test, the safest and most precise fix that preserves existing functionality is to assert that the validated URL exactly matches the original URL string, rather than just checking that it starts with "https://example.com". The test currently wants to verify that when DNS resolution indicates a public IP address, Validators.validate_url returns a URL that begins with the expected host. If the validator is meant to return the input unchanged in this case (which is consistent with the other tests that do strict equality checks), then changing the assertion to assert url == "https://example.com" both avoids the problematic prefix check and tightens the test. This change is local to tests/test_common_types.py, around line 148, and requires no new imports or helpers.

In general, to avoid incomplete URL substring sanitization, you should parse the URL and inspect its structured components (like hostname and scheme) rather than relying on substring or naive prefix checks. For domains, ensure that you either match exactly or correctly handle subdomains (for example, require hostname == "example.com" or hostname.endswith(".example.com") depending on the policy).

For this specific test, instead of asserting that the sanitized URL “starts with” the string "https://example.com", we should parse the returned url and assert on its structural parts: the scheme must be https and the hostname must be example.com. This keeps the test’s underlying intent (“the validated URL is an https URL to example.com”) while avoiding substring logic. Since this is a test file and we should not assume anything about other modules, we’ll add a local import of urllib.parse.urlparse in this file (or reuse it if already imported elsewhere in the snippet) and modify only the assertion at line 199.

Concretely:

• In tests/test_common_types.py, around lines 194–199, replace assert url.startswith("https://example.com") with code that:
  • imports urlparse from urllib.parse at the top of the file if not already present.
  • parses url with urlparse(url).
  • asserts parsed.scheme == "https" and parsed.hostname == "example.com".
    This change keeps the semantics of the test while aligning with the recommendation to work with parsed URLs, and it does not alter the external behavior of Validators.validate_url.

In general, the fix is to avoid using substring or prefix/suffix checks on the raw URL string to validate what host it points to. Instead, parse the URL and assert on structured components such as the scheme and hostname. In this test, we should not assert that the URL merely “starts with” "https://example.com"; we should instead ensure that config.api_url is exactly the expected URL string, or else inspect its parsed components.

The most direct, non‑behavior‑changing fix here is:

• Keep _write_env and the value it writes (https://example.com/secret) unchanged.
• In test_from_env_and_sanitized, replace assert config.api_url.startswith("https://example.com") with a stronger assertion like assert config.api_url == "https://example.com/secret". This exactly matches what _write_env set, removes substring logic, and retains the intended semantics (the configuration should reflect the environment variable).
• Similarly, in test_from_env_str_path, replace assert config.api_url.startswith("https://example.com") with assert config.api_url == "https://example.com/secret".

No new methods or classes are needed. We don’t need to import any URL parsing libraries because we can use equality against the known constant string written in the env file. All required edits are confined to tests/test_config.py around lines 34–35 and 45–46.

General approach: Instead of checking whether the URL string starts with "https://example.com", parse the URL and assert on its components (e.g., scheme and hostname). This aligns with the recommendation to parse URLs before checking host values and avoids any substring-based assumptions.

Best specific fix here: In tests/test_config.py, update the assertions on config.api_url that use .startswith("https://example.com") to instead:

1. Parse config.api_url with urllib.parse.urlparse.
2. Assert that parsed.scheme == "https" and parsed.hostname == "example.com".

Because the tests are the only code we’re allowed to change and they already import only standard libraries plus project modules, we can safely add an import of urlparse from urllib.parse at the top of this test module.

Concretely:

• Add from urllib.parse import urlparse near the other imports at the top of tests/test_config.py.
• In test_from_env_and_sanitized, replace assert config.api_url.startswith("https://example.com") with a urlparse call and assertions on scheme and hostname.
• In test_from_env_str_path, similarly replace the .startswith assertion with the parsed-url assertions.

This preserves the intent of the tests (ensuring the configuration URL targets https://example.com) while removing substring-based URL checks.

---

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.1% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 97.83359% with 69 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pyoutlineapi/audit.py	92.88%	8 Missing and 11 partials ⚠️
pyoutlineapi/client.py	95.63%	0 Missing and 12 partials ⚠️
pyoutlineapi/metrics_collector.py	97.06%	0 Missing and 10 partials ⚠️
pyoutlineapi/circuit_breaker.py	95.31%	0 Missing and 9 partials ⚠️
pyoutlineapi/base_client.py	98.19%	1 Missing and 6 partials ⚠️
pyoutlineapi/common_types.py	98.78%	0 Missing and 4 partials ⚠️
pyoutlineapi/health_monitoring.py	98.81%	0 Missing and 3 partials ⚠️
pyoutlineapi/response_parser.py	96.80%	0 Missing and 3 partials ⚠️
pyoutlineapi/exceptions.py	99.50%	0 Missing and 1 partial ⚠️
pyoutlineapi/models.py	99.55%	0 Missing and 1 partial ⚠️

Files with missing lines	Coverage Δ
pyoutlineapi/__init__.py	100.00% <100.00%> (+14.28%)	⬆️
pyoutlineapi/api_mixins.py	100.00% <100.00%> (ø)
pyoutlineapi/batch_operations.py	100.00% <100.00%> (ø)
pyoutlineapi/config.py	100.00% <100.00%> (ø)
pyoutlineapi/exceptions.py	99.50% <99.50%> (-0.50%)	⬇️
pyoutlineapi/models.py	99.56% <99.55%> (+8.47%)	⬆️
pyoutlineapi/health_monitoring.py	98.81% <98.81%> (ø)
pyoutlineapi/response_parser.py	96.80% <96.80%> (ø)
pyoutlineapi/common_types.py	98.78% <98.78%> (ø)
pyoutlineapi/base_client.py	98.19% <98.19%> (ø)
... and 4 more

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.