[repo-assist] test: add unit tests for SchemaReader.validateContentType - #491
Merged
sergey-tihon merged 1 commit intoSep 9, 2026
Conversation
Adds direct unit test coverage for validateContentType, the SSRF Content-Type allow-list check used when reading remote schemas. Previously this security-relevant function had no dedicated tests. Covers: allowed schema media types (json/yaml variants, text/plain, octet-stream), charset-parameter stripping, case-insensitive comparison, null Content-Type handling, rejection of non-schema types (text/html, image/png), and full bypass when SSRF protection is disabled. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The PR is purely additive test coverage with no production code changes and low risk to the codebase.
Pull request overview
Adds direct unit-test coverage for SwaggerProvider.Internal.SchemaReader.validateContentType, the SSRF-related Content-Type allow-list guard used when fetching remote schemas.
Changes:
- Added a new
ContentTypeValidationTestsmodule with 14 unit tests covering allowed/disallowed media types, case-insensitive matching, charset presence, null Content-Type handling, and theSsrfProtection=falsebypass path.
File summaries
| File | Description |
|---|---|
| tests/SwaggerProvider.Tests/SsrfSecurityTests.fs | Adds unit tests targeting validateContentType to strengthen SSRF defense-in-depth coverage. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+379
to
+383
| let ``Allow Content-Type with charset parameter``() = | ||
| // e.g. "application/json; charset=utf-8" — parameters must be stripped before comparison | ||
| let contentType = MediaTypeHeaderValue("application/json") | ||
| contentType.CharSet <- "utf-8" | ||
| validateContentType false contentType |
sergey-tihon
deleted the
repo-assist/test-validateContentType-coverage-cea7c0dce32ce8d4
branch
September 9, 2026 16:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 This PR was created by Repo Assist, an automated AI assistant.
What
Adds direct unit test coverage for
SchemaReader.validateContentTypeinUtils.fs— the SSRF Content-Type allow-list check invoked after fetching a remote schema over HTTP(S). This function had zero direct unit tests despite being a security-relevant guard (it prevents processing of non-schema responses such as HTML, images, or binaries that a compromised/malicious endpoint could return during an SSRF attempt).New tests (14)
application/json,application/yaml,application/x-yaml,text/yaml,text/x-yaml,text/plain,application/octet-streamapplication/json; charset=utf-8)text/html,image/png) withInvalid Content-TypemessageSsrfProtection=false(development mode), for both a disallowed type and nullWhy
Existing
SsrfSecurityTests.fsthoroughly covers URL-scheme and IP-range SSRF protections but had no tests for the Content-Type layer of the same defense-in-depth mechanism. This closes that gap with minimal, self-contained tests that exercise the pure function directly (no network calls).Trade-offs
None — purely additive test coverage; no production code changed.
Test Status
dotnet build SwaggerProvider.sln -c Releasesucceeded (0 errors).dotnet fantomas --checkon the modified file passes.Add this agentic workflow to your repo
To install this agentic workflow, run