Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A plugin to use with Pytest to disable or restrict socket
calls during
tests to ensure network calls are prevented.
socket
interface.You can install pytest-socket
via pip
from PyPI:
pip install pytest-socket
or add to your pyproject.toml
for poetry:
[tool.poetry.dev-dependencies]
pytest-socket = "*"
Run pytest --disable-socket
, tests should fail on any access to socket
or
libraries using socket with a SocketBlockedError
.
To add this flag as the default behavior, add this section to your
pytest.ini
:
[pytest]
addopts = --disable-socket
or add this to your setup.cfg
:
[tool:pytest]
addopts = --disable-socket
or update your conftest.py
to include:
from pytest_socket import disable_socket
def pytest_runtest_setup():
disable_socket()
If you exceptionally want to enable socket for one particular execution
pass --force-enable-socket
. It takes precedence over --disable-socket
.
To enable Unix sockets during the test run (e.g. for async), add this option:
[pytest]
addopts = --disable-socket --allow-unix-socket
To enable specific tests use of socket
, pass in the fixture to the test or
use a marker:
def test_explicitly_enable_socket(socket_enabled):
assert socket.socket(socket.AF_INET, socket.SOCK_STREAM)
@pytest.mark.enable_socket
def test_explicitly_enable_socket_with_mark():
assert socket.socket(socket.AF_INET, socket.SOCK_STREAM)
To allow only specific hosts per-test:
@pytest.mark.allow_hosts(['127.0.0.1'])
def test_explicitly_enable_socket_with_mark():
assert socket.socket.connect(('127.0.0.1', 80))
or for whole test run
[pytest]
addopts = --allow-hosts=127.0.0.1,127.0.1.1
Q: Why is network access disabled in some of my tests but not others?
A: pytest's default fixture scope is "function", which socket_enabled
uses.
If you create another fixture that creates a socket usage that has a "higher"
instantiation order, such as at the module/class/session, then the higher order
fixture will be resolved first, and won't be disabled during the tests.
Read more in this excellent example
and more about pytest fixture order here.
This behavior may change in the future, as we learn more about pytest fixture order, and what users expect to happen.
Contributions are very welcome. Tests can be run with pytest, please ensure the coverage at least stays the same before you submit a pull request.
Distributed under the terms of the MIT license, "pytest-socket" is free and open source software
If you encounter any problems, please file an issue along with a detailed description.
This Pytest plugin was generated with Cookiecutter along with @hackebrot's Cookiecutter-pytest-plugin template.
This plugin came about due to the efforts by @hangtwenty solving a StackOverflow question, then converted into a pytest plugin by @miketheman.
FAQs
Pytest Plugin to disable socket calls during tests
We found that pytest-socket demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.