a1d-mcp-server / test_no_key.py
yuxh1996's picture
Fix MCP API key bypass vulnerability
37495c1
#!/usr/bin/env python3
"""
Test script to verify API key enforcement without environment variables
"""
import os
import sys
# Remove any existing API key environment variable
if 'A1D_API_KEY' in os.environ:
del os.environ['A1D_API_KEY']
# Import after removing environment variable
from app import remove_bg_wrapper
def test_no_api_key():
"""Test that API key is required when not provided"""
try:
result = remove_bg_wrapper("https://example.com/test.jpg")
print(f"❌ FAILED: Function should have failed but returned: {result}")
return False
except Exception as e:
print(f"βœ… SUCCESS: Function correctly failed with error: {str(e)}")
return True
if __name__ == "__main__":
print("πŸ§ͺ Testing API key enforcement...")
print("=" * 50)
# Check environment
print(f"A1D_API_KEY in environment: {'A1D_API_KEY' in os.environ}")
print(f"SPACE_ID in environment: {'SPACE_ID' in os.environ}")
# Run test
success = test_no_api_key()
print("=" * 50)
if success:
print("βœ… Test PASSED: API key enforcement is working")
sys.exit(0)
else:
print("❌ Test FAILED: API key enforcement is NOT working")
sys.exit(1)