v3.1 (3/N): docs + autoconfig integration tests#8
Merged
Conversation
Cleans up the v3.1 baseline before tagging:
Docs (en/ko, symmetric):
- index.md / .ko.md — module matrix gets -llm and
-langchain4j rows; webclient row
notes the new URL+DNS coverage.
- README.md / .ko.md — same matrix in the repo's front-door.
- installation.md / .ko.md — two new install tabs (LangChain4j
tool execution, Custom tool
dispatcher via ssrf-guard-llm).
- guides/configuration.md/.ko.md — new "LLM-adapter properties"
section documenting
`ssrf.guard.springai.wrap-tool-callbacks`
and the new
`ssrf.guard.langchain4j.wrap-tool-executors`.
- guides/security-model.md/.ko.md — the "what this doesn't protect"
bullet was stale (mentioned
RestClient only); now covers
every module v3.1+ ships. Added
a dedicated bullet about the
WebClient URL-time → URL+DNS
upgrade.
Autoconfig integration tests:
- SsrfGuardLangchain4jAutoConfigurationTest — boots a Spring context
with the autoconfig, declares a consumer @bean ToolExecutor, then
asserts:
* the BeanPostProcessor wrapped it (instanceof check)
* end-to-end block on an AWS metadata URL (LLM sees the
structured JSON error)
* end-to-end allow on a whitelisted URL (delegate's
PRETEND-FETCHED echo)
* `wrap-tool-executors=false` correctly leaves the bean
unwrapped — the off switch for manual-wrap workflows.
- SsrfGuardWebClientAutoConfigurationTest extended to verify the
new v3.1 beans (ssrfReactorClientHttpConnector,
ssrfReactorAddressResolverGroup) are registered. Previously the
test only checked filter / customizer / builder; the new beans
silently going missing in a future refactor would have flown
under the radar.
Tests now total 210 across 11 modules (up from 199 in PR #6 and
204 after PR #7).
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cleans up the v3.1 baseline before tagging. Catches up the docs that were drifting (matrix / install tabs / config / security-model) and adds the autoconfig integration tests that were missing for the new modules.
Docs (en/ko, symmetric)
docs/index.md/.ko.md-llmand-langchain4jrows; WebClient row notes the new URL+DNS coverageREADME.md/README.ko.mddocs/getting-started/installation.md/.ko.mdssrf-guard-llmfor advanced users)docs/guides/configuration.md/.ko.mdssrf.guard.springai.wrap-tool-callbacksandssrf.guard.langchain4j.wrap-tool-executorsdocs/guides/security-model.md/.ko.mdAutoconfig integration tests
SsrfGuardLangchain4jAutoConfigurationTest(new)Boots a Spring context with the autoconfig active, declares a consumer
@Bean ToolExecutor, and asserts:BeanPostProcessorwraps it (instanceof check)PRETEND-FETCHEDechowrap-tool-executors=falsecorrectly leaves the bean unwrapped (off switch for manual-wrap workflows)SsrfGuardWebClientAutoConfigurationTestextendedPreviously only checked filter / customizer / builder. Added assertions for the v3.1 beans:
ssrfReactorClientHttpConnector(theReactorClientHttpConnectorwith our resolver attached)ssrfReactorAddressResolverGroup(the resolver group itself, exposed so consumers with their own connector can still attach our resolver)If a future refactor silently drops either bean, these tests catch it.
Counts
All green locally. Module count unchanged.
Test plan
./gradlew build— all 11 modules passWhat's left in v3.1