Fix remaining v2.5.1 Playwright POST download and FY selector tests

2026-06-25 23:20:56 +05:30
parent ba1075ef19
commit 21c90749fb
8 changed files with 53 additions and 21 deletions
@@ -331,10 +331,14 @@ test.describe("v2.5.1 Additions - Marketplace / Leads", () => {
      }

      if (kind === 'post') {
-        const resp = await apiCall(request, method || 'POST', c.route);
+        // Some generated VAPT rows accidentally carry _method: 'GET' even when
+        // the scenario is explicitly CSRF-less POST. Force POST unless the row
+        // intentionally specifies another unsafe verb.
+        const unsafeMethod = (!method || method === 'GET') ? 'POST' : method;
+        const resp = await apiCall(request, unsafeMethod, c.route);
        await expectApiSafe(resp);
        const safe = [400, 401, 403, 404, 405, 409, 422, 429].includes(resp.status());
-        expect(safe, `Unsafe POST status ${resp.status()} for ${c.route}`).toBeTruthy();
+        expect(safe, `Unsafe ${unsafeMethod} status ${resp.status()} for ${c.route}`).toBeTruthy();
        return;
      }