This commit is contained in:
Andrew Pimenov 2026-09-04 10:11:38 +03:00 • committed by GitHub
commit 85f7ca563d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 12 additions and 0 deletions

View file

@ -124,6 +124,9 @@ async def tier_ookla(
iface_name: str | None = None, iface_name: str | None = None,
ipv4: str | None = None, ipv4: str | None = None,
) -> SpeedResult: ) -> SpeedResult:
if server and server.startswith("-"):
raise ValueError("Invalid server argument: cannot start with '-'")
args = [binary, "--format=json", "--accept-license", "--accept-gdpr"] args = [binary, "--format=json", "--accept-license", "--accept-gdpr"]
args += ookla_interface_args(iface_name, ipv4) args += ookla_interface_args(iface_name, ipv4)
if server: if server:

View file

@ -287,6 +287,15 @@ async def test_tier_ookla_success_parses_json():
assert result.idle_rtt_ms == 15.5 assert result.idle_rtt_ms == 15.5
async def test_tier_ookla_server_argument_injection():
with pytest.raises(
ValueError, match="Invalid server argument: cannot start with '-'"
):
await tier_ookla("speedtest", "--hacked", 10.0)
async def test_tier_ookla_server_args(): async def test_tier_ookla_server_args():
mock_proc = AsyncMock() mock_proc = AsyncMock()
mock_payload = {} mock_payload = {}