From 0e123aca0fbb68e6c5a2fef2b9f25cdf11e2ccf6 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Sun, 9 Aug 2026 09:57:52 +0000 Subject: [PATCH 1/3] =?UTF-8?q?=F0=9F=94=92=20=EB=B3=B4=EC=95=88=20?= =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=ED=94=BD=EC=8A=A4:=20=5Fdownload?= =?UTF-8?q?=5Ftrusted=5Fuv=5Farchive=EC=9D=98=20SSRF=20=EB=B0=A9=EC=A7=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- scripts/ci/materialize_base_python_requirements.py | 12 ++++++++++-- tests/test_uv_redirect_boundary.py | 4 +++- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/scripts/ci/materialize_base_python_requirements.py b/scripts/ci/materialize_base_python_requirements.py index 98cdad459..8a2be31b3 100755 --- a/scripts/ci/materialize_base_python_requirements.py +++ b/scripts/ci/materialize_base_python_requirements.py @@ -19,6 +19,8 @@ import sys import tarfile import tempfile +import urllib.error +import urllib.error import urllib.parse import urllib.request from typing import Any @@ -65,8 +67,14 @@ def redirect_request( new_url: str, ) -> None: """Fail closed for all redirect status codes and target locations.""" - del request, response, code, message, headers, new_url - raise RuntimeError("trusted uv archive redirects are forbidden") + del message, new_url + raise urllib.error.HTTPError( + request.full_url, # type: ignore + code, + "trusted uv archive redirects are forbidden", + headers, + response, + ) @functools.cache diff --git a/tests/test_uv_redirect_boundary.py b/tests/test_uv_redirect_boundary.py index fd98592e8..7d384c1ff 100644 --- a/tests/test_uv_redirect_boundary.py +++ b/tests/test_uv_redirect_boundary.py @@ -2,6 +2,8 @@ from __future__ import annotations +import urllib.error +import urllib.error import urllib.request from collections.abc import Iterator @@ -23,7 +25,7 @@ def test_trusted_uv_redirect_handler_rejects_before_following() -> None: handler = materializer._RejectTrustedUvRedirects() original = urllib.request.Request(materializer.TRUSTED_UV_ARCHIVE_URL) - with pytest.raises(RuntimeError, match="redirects are forbidden"): + with pytest.raises(urllib.error.HTTPError, match="trusted uv archive redirects are forbidden"): handler.redirect_request( original, None, From bcc09a9832fbeb2042616a2c3e9f69edb68ce0c4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 9 Aug 2026 19:07:39 +0900 Subject: [PATCH 2/3] fix: remove duplicate urllib error import --- scripts/ci/materialize_base_python_requirements.py | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/ci/materialize_base_python_requirements.py b/scripts/ci/materialize_base_python_requirements.py index 8a2be31b3..45d70ec0b 100755 --- a/scripts/ci/materialize_base_python_requirements.py +++ b/scripts/ci/materialize_base_python_requirements.py @@ -20,7 +20,6 @@ import tarfile import tempfile import urllib.error -import urllib.error import urllib.parse import urllib.request from typing import Any From 66d91c691f442191a240b3f317ea7635347b1406 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 9 Aug 2026 19:07:55 +0900 Subject: [PATCH 3/3] test: remove duplicate urllib error import --- tests/test_uv_redirect_boundary.py | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/test_uv_redirect_boundary.py b/tests/test_uv_redirect_boundary.py index 7d384c1ff..be36f0bc7 100644 --- a/tests/test_uv_redirect_boundary.py +++ b/tests/test_uv_redirect_boundary.py @@ -2,7 +2,6 @@ from __future__ import annotations -import urllib.error import urllib.error import urllib.request from collections.abc import Iterator