1 files changed, 40 insertions, 0 deletions
diff --git a/packages/meshbay-node/tests/test_linkpreview.py b/packages/meshbay-node/tests/test_linkpreview.py
index 0dd951a..a14b173 100644
--- a/packages/meshbay-node/tests/test_linkpreview.py
+++ b/packages/meshbay-node/tests/test_linkpreview.py
@@ -48,6 +48,30 @@ def test_safe_url_refuses(url):
         safe_url(url)
 
 
+@pytest.mark.parametrize("url", [
+    "http://example.com:22/x",       # SSH
+    "http://example.com:3306/x",     # MySQL
+    "http://example.com:6379/x",     # Redis
+    "http://example.com:9200/x",     # Elasticsearch
+    "http://example.com:5000/x",     # a common internal admin port
+])
+def test_safe_url_refuses_non_web_ports(url, resolves_public):
+    with pytest.raises(UnsafeURL):
+        safe_url(url)
+
+
+@pytest.mark.parametrize("url", [
+    "http://example.com/x",          # implicit 80
+    "https://example.com/x",         # implicit 443
+    "http://example.com:80/x",
+    "https://example.com:443/x",
+    "http://example.com:8080/x",
+    "https://example.com:8443/x",
+])
+def test_safe_url_allows_the_web_ports(url, resolves_public):
+    assert safe_url(url) == url
+
+
 def test_safe_url_accepts_a_public_host(resolves_public):
     assert safe_url("https://example.com/some/page") == "https://example.com/some/page"
 
@@ -153,3 +177,19 @@ async def test_fetch_image_downscales(resolves_public):
     assert jpeg and jpeg[:2] == b"\xff\xd8"        # JPEG SOI
     with Image.open(BytesIO(jpeg)) as im:
         assert max(im.size) <= linkpreview._IMAGE_MAX_DIM
+
+
+async def test_fetch_image_refuses_a_decompression_bomb(resolves_public, monkeypatch):
+    from io import BytesIO
+
+    from PIL import Image
+    # A tiny file that reports enormous dimensions from its header alone.
+    monkeypatch.setattr(linkpreview, "_MAX_IMAGE_PIXELS", 1_000_000)
+    buf = BytesIO()
+    Image.new("RGB", (2000, 2000), (0, 0, 0)).save(buf, format="PNG")  # 4 MP > cap
+    bomb = buf.getvalue()
+
+    def handler(request):
+        return httpx.Response(200, headers={"content-type": "image/png"}, content=bomb)
+    async with _client(handler) as c:
+        assert await linkpreview.fetch_image("https://example.com/x.png", client=c) is None