ipmg 3.1.1__tar.gz → 3.1.2__tar.gz

{ipmg-3.1.1/src/ipmg.egg-info → ipmg-3.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ipmg
-Version: 3.1.1
+Version: 3.1.2
 Summary: IP Management & Ping Monitoring CLI Tool
 Author: Sameer Alam
 Maintainer-email: Sameer Alam <sameeralam3127@gmail.com>

{ipmg-3.1.1 → ipmg-3.1.2}/pyproject.toml

@@ -13,7 +13,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ipmg"
-version = "3.1.1"  # Managed automatically by semantic-release
+version = "3.1.2"  # Managed automatically by semantic-release
 description = "IP Management & Ping Monitoring CLI Tool"
 readme = "README.md"
 requires-python = ">=3.9"

{ipmg-3.1.1 → ipmg-3.1.2}/src/ipmg/__init__.py

@@ -2,4 +2,4 @@
 ipmg - IP Management & Ping Monitoring Tool
 """
 
-__version__ = "3.1.1"
+__version__ = "3.1.2"

{ipmg-3.1.1 → ipmg-3.1.2}/src/ipmg/infrastructure/notify.py

@@ -8,6 +8,7 @@ never fails the scan or costs it its reports.
 
 from __future__ import annotations
 
+import ipaddress
 import json
 import logging
 import os
@@ -92,6 +93,16 @@ def _flag_or_env(value: Optional[str], environ: Mapping[str, str], name: str) ->
     return environ.get(name, "").strip()
 
 
+def _is_loopback(host: str) -> bool:
+    candidate = host.strip().strip("[]")
+    if candidate.lower() == "localhost":
+        return True
+    try:
+        return ipaddress.ip_address(candidate).is_loopback
+    except ValueError:
+        return False
+
+
 def _url(value: Optional[str], environ: Mapping[str, str], flag: str, env: str) -> str:
     """The URL for a ``--notify-*`` flag. None means the flag was not given."""
     if value is None:
@@ -140,6 +151,11 @@ def _smtp_settings(args, environ: Mapping[str, str]) -> Optional[SmtpSettings]:
         raise NotifyError(f"SMTP port out of range (1-65535): {port}")
 
     username = _flag_or_env(getattr(args, "smtp_user", None), environ, ENV_SMTP_USER)
+    if username and security == "none" and not _is_loopback(host):
+        raise NotifyError(
+            "--smtp-user cannot be used with --smtp-security none unless the SMTP host is "
+            "loopback; use starttls or ssl instead."
+        )
     sender = _flag_or_env(getattr(args, "smtp_from", None), environ, ENV_SMTP_FROM)
     return SmtpSettings(
         host=host,
@@ -316,6 +332,11 @@ def post_json(url: str, payload: Mapping[str, Any]) -> None:
 
 
 def send_email(settings: SmtpSettings, message: EmailMessage) -> None:
+    if settings.username and settings.security == "none" and not _is_loopback(settings.host):
+        raise NotifyError(
+            "--smtp-user cannot be used with --smtp-security none unless the SMTP host is "
+            "loopback; use starttls or ssl instead."
+        )
     context = ssl.create_default_context()
     if settings.security == "ssl":
         client = smtplib.SMTP_SSL(

{ipmg-3.1.1 → ipmg-3.1.2/src/ipmg.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ipmg
-Version: 3.1.1
+Version: 3.1.2
 Summary: IP Management & Ping Monitoring CLI Tool
 Author: Sameer Alam
 Maintainer-email: Sameer Alam <sameeralam3127@gmail.com>

{ipmg-3.1.1 → ipmg-3.1.2}/tests/test_notify.py

@@ -223,6 +223,38 @@ def test_incomplete_email_settings_are_errors(overrides, environ, message):
         notify_options(notify_args(**overrides), environ=environ)
 
 
+def test_smtp_user_with_security_none_is_refused_for_non_loopback_hosts():
+    with pytest.raises(NotifyError, match=r"starttls.*ssl"):
+        notify_options(
+            notify_args(
+                notify_email=["ops@example.test"],
+                smtp_host="mail.example.test",
+                smtp_security="none",
+                smtp_user="ipmg@example.test",
+            ),
+            environ={},
+        )
+
+
+@pytest.mark.parametrize("loopback_host", ["localhost", "127.0.0.1", "::1"])
+def test_smtp_user_with_security_none_is_allowed_for_loopback_hosts(loopback_host):
+    settings = notify_options(
+        notify_args(
+            notify_email=["ops@example.test"],
+            smtp_host=loopback_host,
+            smtp_security="none",
+            smtp_user="relay-user",
+        ),
+        environ={"IPMG_SMTP_PASSWORD": "relay-password"},  # pragma: allowlist secret
+    ).email
+
+    assert settings.host == loopback_host
+    assert settings.security == "none"
+    assert settings.username == "relay-user"
+    assert settings.port == 25
+
+
+
 # ---------------------------------------------------------------- messages
 
 
@@ -518,3 +550,21 @@ def test_send_email_follows_the_security_setting(diff, fake_smtp, security, user
 
     assert fake_smtp[0].calls == expected
     assert (fake_smtp[0].context is not None) is (security == "ssl")
+
+
+def test_send_email_refuses_cleartext_auth_on_remote_host(diff, fake_smtp):
+    settings = SmtpSettings("mail.example.test", 25, "none", "ipmg@x.test", ("ops@x.test",), "u", "pw")
+
+    with pytest.raises(NotifyError, match=r"starttls.*ssl"):
+        send_email(settings, email_message(diff, settings))
+
+    assert fake_smtp == []
+
+
+def test_send_email_allows_cleartext_auth_on_loopback_host(diff, fake_smtp):
+    settings = SmtpSettings("127.0.0.1", 25, "none", "ipmg@x.test", ("ops@x.test",), "u", "pw")
+
+    send_email(settings, email_message(diff, settings))
+
+    assert fake_smtp[0].calls == [("login", "u", "pw"), ("send", "ops@x.test"), "quit"]
+