Skip to content

test: assert exact hosts instead of URL substrings - #801

Merged
tobixen merged 4 commits into
masterfrom
test-url-asserts
Oct 19, 2026
Merged

tobixen merged 4 commits into
masterfrom
test-url-asserts

Conversation

@tobixen

@tobixen tobixen commented Oct 19, 2026

Copy link
Copy Markdown
Member

Commit message:

test: assert exact hosts instead of URL substrings

CodeQL flags `"host" in url` as incomplete URL sanitization.  It is
a false positive in test code, but dismissed alerts come back once
the lines move.  Exact comparisons are stricter tests anyway.

Prompt: The github security qa suggests this: [replace `assert
"caldav.example.com" in str(client.url)` with a urlparse().hostname
comparison] I'm not sure I agree with the exact proposal, and it's a
nit given that it's test code, but can we do something with it so we
won't see this again?

Assisted-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>

🤖 Generated with Claude Code

RadicaleServer passed no server section to Radicale, so it always
listened on 5232.  stop() left the server end of the socketpair open,
and XandikosServer.stop() never closed its event loop; both raised
warnings under -W error.

Fixes #797

Prompt: ... start looking into github issues, prioritize issues that are tagged in my calendar, issues recently posted by third parties, but most importantly: issues relevant for [the calendaring library, https://github.com/pycalendar/calendaring]

Assisted-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
aio.get_calendars() was a drifted copy of the sync one and resolved a
single section only.  Client resolution is now one shared helper, run
in a thread from async code, as aio.get_davclient() now is too, so the
config file and RFC 6764 discovery no longer block the event loop.
_auto_url moved to base_client, so an httpx-only install can create a
client.  Like the sync one, aio.get_calendars() no longer probes with
OPTIONS, and a failed principal lookup obeys raise_errors.

Fixes #793
Fixes #794

Prompt: Let's bundle small things in a PR, #797, #794, #793 are all small things I think?  If you agree, go for it, create a PR with those, and we'll take #598 and #786 in the next session

Assisted-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
#800

Three small fixes found while building calendaring: caldav.testing
servers listen on their configured port and stop() leaks nothing;
aio.get_calendars() shares the sync config-section resolution; and the
async factories build their clients in a worker thread, so config
reading and RFC 6764 discovery no longer block the event loop.

Commits:
- 3c70237 fix: caldav.testing server port and stop() leaks
- 6cfc275 fix: async factories: config sections, discovery

Fixes #793
Fixes #794
Fixes #797

Assisted-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
CodeQL flags `"host" in url` as incomplete URL sanitization.  It is
a false positive in test code, but dismissed alerts come back once
the lines move.  Exact comparisons are stricter tests anyway.

Prompt: The github security qa suggests this: [replace `assert
"caldav.example.com" in str(client.url)` with a urlparse().hostname
comparison] I'm not sure I agree with the exact proposal, and it's a
nit given that it's test code, but can we do something with it so we
won't see this again?

Assisted-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Reviewed-by: Tobias Brox <tobias@redpill-linpro.com>
@tobixen
tobixen merged commit 45b8921 into master Oct 19, 2026
16 checks passed
@tobixen
tobixen deleted the test-url-asserts branch October 19, 2026 23:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant