From 6d8e3cbd7ab6835413903e1682d01fc754d7f222 Mon Sep 17 00:00:00 2001 From: Thom Chiovoloni Date: Mon, 26 Oct 2026 17:01:26 +0000 Subject: [PATCH 1/2] Fix CI, again --- .github/workflows/docker.yml | 2 ++ Dockerfile | 2 +- tests/test_docker_runner.py | 7 +++++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 33784015..bc522b54 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -19,7 +19,9 @@ on: - 'Dockerfile' - 'docker-compose.yml' - 'docker-entrypoint-initdb.d/**' + - 'scripts/pg-common.sh' - 'scripts/test-e2e-docker.sh' + - 'src/ssrf.rs' - 'tests/test_docker_runner.py' - 'Cargo.toml' - 'Cargo.lock' diff --git a/Dockerfile b/Dockerfile index 8c7be40f..f95849cb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -77,7 +77,7 @@ RUN echo "shared_preload_libraries = 'pg_durable'" >> /usr/share/postgresql/post echo "pg_durable.worker_role = 'postgres'" >> /usr/share/postgresql/postgresql.conf.sample && \ echo "pg_durable.enable_superuser_instances = on" >> /usr/share/postgresql/postgresql.conf.sample && \ echo "pg_durable.http_security = 'restricted'" >> /usr/share/postgresql/postgresql.conf.sample && \ - echo "pg_durable.http_allowed_domains = '*.blob.core.windows.net,*.blob.storage.azure.net,*.queue.core.windows.net,*.table.core.windows.net,*.file.core.windows.net,*.azurewebsites.net,*.azure-api.net,*.documents.azure.com,*.servicebus.windows.net,*.openai.azure.com,*.cognitiveservices.azure.com,*.vault.azure.net,*.redis.cache.windows.net,*.database.windows.net,*.kusto.windows.net,*.azurefd.net,*.azureedge.net,*.azure-devices.net,*.trafficmanager.net,*.cloudapp.azure.com,api.github.com,httpbingo.org'" >> /usr/share/postgresql/postgresql.conf.sample && \ + echo "pg_durable.http_allowed_domains = '*.blob.core.windows.net,*.blob.storage.azure.net,*.queue.core.windows.net,*.table.core.windows.net,*.file.core.windows.net,*.azurewebsites.net,*.azurecontainerapps.io,*.azurecontainer.io,*.azure-api.net,*.documents.azure.com,*.servicebus.windows.net,*.openai.azure.com,*.cognitiveservices.azure.com,*.services.ai.azure.com,*.vault.azure.net,*.redis.cache.windows.net,*.database.windows.net,*.kusto.windows.net,*.azurefd.net,*.azureedge.net,*.azure-devices.net,*.trafficmanager.net,*.cloudapp.azure.com,api.github.com,httpbingo.org'" >> /usr/share/postgresql/postgresql.conf.sample && \ echo "logging_collector = on" >> /usr/share/postgresql/postgresql.conf.sample && \ echo "log_directory = 'log'" >> /usr/share/postgresql/postgresql.conf.sample && \ echo "log_filename = 'postgresql.log'" >> /usr/share/postgresql/postgresql.conf.sample && \ diff --git a/tests/test_docker_runner.py b/tests/test_docker_runner.py index 808fe6fc..f3690822 100644 --- a/tests/test_docker_runner.py +++ b/tests/test_docker_runner.py @@ -82,6 +82,13 @@ def run_runner(self, names, **environment): tests = [args[args.index("-f") + 1] for args in calls if args[0] == "exec" and "-f" in args] return result, calls, tests + def test_image_http_allowlist_matches_local_runner(self): + common = (ROOT / "scripts" / "pg-common.sh").read_text() + dockerfile = (ROOT / "Dockerfile").read_text() + local_domains = common.split("PG_DURABLE_TEST_HTTP_DOMAINS='", 1)[1].split("'", 1)[0] + docker_domains = dockerfile.split("pg_durable.http_allowed_domains = '", 1)[1].split("'", 1)[0] + self.assertCountEqual(docker_domains.split(","), local_domains.split(",")) + def test_fixed_image_skips_every_local_special_phase(self): local = (ROOT / "scripts" / "test-e2e-local.sh").read_text() # Read only the phase classifier without running its server-management code. From 99873d4e1bec39052561112e2a5206759dfd1a8f Mon Sep 17 00:00:00 2001 From: Thom Chiovoloni Date: Mon, 26 Oct 2026 18:13:42 +0000 Subject: [PATCH 2/2] Fix review comments --- tests/test_docker_runner.py | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/tests/test_docker_runner.py b/tests/test_docker_runner.py index f3690822..e593504c 100644 --- a/tests/test_docker_runner.py +++ b/tests/test_docker_runner.py @@ -7,6 +7,7 @@ import json import os from pathlib import Path +import re import shutil import subprocess import sys @@ -83,11 +84,20 @@ def run_runner(self, names, **environment): return result, calls, tests def test_image_http_allowlist_matches_local_runner(self): - common = (ROOT / "scripts" / "pg-common.sh").read_text() - dockerfile = (ROOT / "Dockerfile").read_text() - local_domains = common.split("PG_DURABLE_TEST_HTTP_DOMAINS='", 1)[1].split("'", 1)[0] - docker_domains = dockerfile.split("pg_durable.http_allowed_domains = '", 1)[1].split("'", 1)[0] - self.assertCountEqual(docker_domains.split(","), local_domains.split(",")) + common = (ROOT / "scripts" / "pg-common.sh").read_text(encoding="utf-8") + dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8") + local_match = re.search(r"PG_DURABLE_TEST_HTTP_DOMAINS='([^']*)'", common) + docker_match = re.search(r"pg_durable\.http_allowed_domains\s*=\s*'([^']*)'", dockerfile) + self.assertIsNotNone( + local_match, "Missing quoted PG_DURABLE_TEST_HTTP_DOMAINS in scripts/pg-common.sh" + ) + self.assertIsNotNone( + docker_match, "Missing quoted pg_durable.http_allowed_domains in Dockerfile" + ) + self.assertCountEqual( + [domain.strip() for domain in docker_match.group(1).split(",")], + [domain.strip() for domain in local_match.group(1).split(",")], + ) def test_fixed_image_skips_every_local_special_phase(self): local = (ROOT / "scripts" / "test-e2e-local.sh").read_text()