schemathesis 3.25.5__py3-none-any.whl → 3.39.7__py3-none-any.whl

schemathesis/_xml.py

@@ -1,8 +1,11 @@
 """XML serialization."""
+
 from __future__ import annotations
+
+import re
 from io import StringIO
 from typing import Any, Dict, List, Union
-from xml.etree import ElementTree
+from unicodedata import normalize
 
 from .exceptions import UnboundPrefixError
 from .internal.copy import fast_deepcopy
@@ -30,24 +33,9 @@ def _to_xml(value: Any, raw_schema: dict[str, Any] | None, resolved_schema: dict
     namespace_stack: list[str] = []
     _write_xml(buffer, value, tag, resolved_schema, namespace_stack)
     data = buffer.getvalue()
-    if not is_valid_xml(data):
-        from hypothesis import reject
-
-        reject()
     return {"data": data.encode("utf8")}
 
 
-_from_string = ElementTree.fromstring
-
-
-def is_valid_xml(data: str) -> bool:
-    try:
-        _from_string(f"<root xmlns:smp='{NAMESPACE_URL}'>{data}</root>")
-        return True
-    except ElementTree.ParseError:
-        return False
-
-
 def _get_xml_tag(raw_schema: dict[str, Any] | None, resolved_schema: dict[str, Any] | None) -> str:
     # On the top level we need to detect the proper XML tag, in other cases it is known from object properties
     if (resolved_schema or {}).get("xml", {}).get("name"):
@@ -96,12 +84,15 @@ def _write_object(
 ) -> None:
     options = (schema or {}).get("xml", {})
     push_namespace_if_any(stack, options)
+    tag = _sanitize_xml_name(tag)
     if "prefix" in options:
         tag = f"{options['prefix']}:{tag}"
     buffer.write(f"<{tag}")
     if "namespace" in options:
         _write_namespace(buffer, options)
-    attributes = []
+
+    attribute_namespaces = {}
+    attributes = {}
     children_buffer = StringIO()
     properties = (schema or {}).get("properties", {})
     for child_name, value in obj.items():
@@ -109,18 +100,35 @@ def _write_object(
         child_options = property_schema.get("xml", {})
         push_namespace_if_any(stack, child_options)
         child_tag = child_options.get("name", child_name)
+
+        if child_options.get("attribute", False):
+            if child_options.get("prefix") and child_options.get("namespace"):
+                _validate_prefix(child_options, stack)
+                prefix = child_options["prefix"]
+                attr_name = f"{prefix}:{_sanitize_xml_name(child_tag)}"
+                # Store namespace declaration
+                attribute_namespaces[prefix] = child_options["namespace"]
+            else:
+                attr_name = _sanitize_xml_name(child_tag)
+
+            if attr_name not in attributes:  # Only keep first occurrence
+                attributes[attr_name] = f'{attr_name}="{_escape_xml(value)}"'
+            continue
+
+        child_tag = _sanitize_xml_name(child_tag)
         if child_options.get("prefix"):
             _validate_prefix(child_options, stack)
             prefix = child_options["prefix"]
             child_tag = f"{prefix}:{child_tag}"
-        if child_options.get("attribute", False):
-            attributes.append(f'{child_tag}="{value}"')
-            continue
         _write_xml(children_buffer, value, child_tag, property_schema, stack)
         pop_namespace_if_any(stack, child_options)
 
+    # Write namespace declarations for attributes
+    for prefix, namespace in attribute_namespaces.items():
+        buffer.write(f' xmlns:{prefix}="{namespace}"')
+
     if attributes:
-        buffer.write(f" {' '.join(attributes)}")
+        buffer.write(f" {' '.join(attributes.values())}")
     buffer.write(">")
     buffer.write(children_buffer.getvalue())
     buffer.write(f"</{tag}>")
@@ -167,7 +175,7 @@ def _write_primitive(
     buffer.write(f"<{tag}")
     if "namespace" in xml_options:
         _write_namespace(buffer, xml_options)
-    buffer.write(f">{obj}</{tag}>")
+    buffer.write(f">{_escape_xml(obj)}</{tag}>")
 
 
 def _write_namespace(buffer: StringIO, options: dict[str, Any]) -> None:
@@ -180,3 +188,48 @@ def _write_namespace(buffer: StringIO, options: dict[str, Any]) -> None:
 def _get_tag_name_from_reference(reference: str) -> str:
     """Extract object name from a reference."""
     return reference.rsplit("/", maxsplit=1)[1]
+
+
+def _escape_xml(value: JSON) -> str:
+    """Escape special characters in XML content."""
+    if isinstance(value, (int, float, bool)):
+        return str(value)
+    if value is None:
+        return ""
+
+    # Filter out invalid XML characters
+    cleaned = "".join(
+        char
+        for char in str(value)
+        if (
+            char in "\t\n\r"
+            or 0x20 <= ord(char) <= 0xD7FF
+            or 0xE000 <= ord(char) <= 0xFFFD
+            or 0x10000 <= ord(char) <= 0x10FFFF
+        )
+    )
+
+    replacements = {
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&apos;",
+    }
+    return "".join(replacements.get(c, c) for c in cleaned)
+
+
+def _sanitize_xml_name(name: str) -> str:
+    """Sanitize a string to be a valid XML element name."""
+    if not name:
+        return "element"
+
+    name = normalize("NFKC", str(name))
+
+    name = name.replace(":", "_")
+    sanitized = re.sub(r"[^a-zA-Z0-9_\-.]", "_", name)
+
+    if not sanitized[0].isalpha() and sanitized[0] != "_":
+        sanitized = "x_" + sanitized
+
+    return sanitized

schemathesis/auths.py

@@ -1,5 +1,7 @@
 """Support for custom API authentication mechanisms."""
+
 from __future__ import annotations
+
 import inspect
 import threading
 import time
@@ -10,20 +12,22 @@ from typing import (
     Any,
     Callable,
     Generic,
+    Protocol,
     TypeVar,
+    Union,
     overload,
     runtime_checkable,
-    Protocol,
 )
 
 from .exceptions import UsageError
 from .filters import FilterSet, FilterValue, MatcherFunc, attach_filter_chain
-from .types import GenericTest
 
 if TYPE_CHECKING:
-    from .models import APIOperation, Case
     import requests.auth
 
+    from .models import APIOperation, Case
+    from .types import GenericTest
+
 DEFAULT_REFRESH_INTERVAL = 300
 AUTH_STORAGE_ATTRIBUTE_NAME = "_schemathesis_auth"
 Auth = TypeVar("Auth")
@@ -41,6 +45,9 @@ class AuthContext:
     app: Any | None
 
 
+CacheKeyFunction = Callable[["Case", "AuthContext"], Union[str, int]]
+
+
 @runtime_checkable
 class AuthProvider(Generic[Auth], Protocol):
     """Get authentication data for an API and set it on the generated test cases."""
@@ -96,16 +103,24 @@ class CachingAuthProvider(Generic[Auth]):
 
     def get(self, case: Case, context: AuthContext) -> Auth | None:
         """Get cached auth value."""
-        if self.cache_entry is None or self.timer() >= self.cache_entry.expires:
+        cache_entry = self._get_cache_entry(case, context)
+        if cache_entry is None or self.timer() >= cache_entry.expires:
             with self._refresh_lock:
-                if not (self.cache_entry is None or self.timer() >= self.cache_entry.expires):
+                cache_entry = self._get_cache_entry(case, context)
+                if not (cache_entry is None or self.timer() >= cache_entry.expires):
                     # Another thread updated the cache
-                    return self.cache_entry.data
+                    return cache_entry.data
                 # We know that optional auth is possible only inside a higher-level wrapper
                 data: Auth = _provider_get(self.provider, case, context)  # type: ignore[assignment]
-                self.cache_entry = CacheEntry(data=data, expires=self.timer() + self.refresh_interval)
+                self._set_cache_entry(data, case, context)
                 return data
-        return self.cache_entry.data
+        return cache_entry.data
+
+    def _get_cache_entry(self, case: Case, context: AuthContext) -> CacheEntry[Auth] | None:
+        return self.cache_entry
+
+    def _set_cache_entry(self, data: Auth, case: Case, context: AuthContext) -> None:
+        self.cache_entry = CacheEntry(data=data, expires=self.timer() + self.refresh_interval)
 
     def set(self, case: Case, data: Auth, context: AuthContext) -> None:
         """Set auth data on the `Case` instance.
@@ -115,6 +130,25 @@ class CachingAuthProvider(Generic[Auth]):
         self.provider.set(case, data, context)
 
 
+def _noop_key_function(case: Case, context: AuthContext) -> str:
+    # Never used
+    raise NotImplementedError
+
+
+@dataclass
+class KeyedCachingAuthProvider(CachingAuthProvider[Auth]):
+    cache_by_key: CacheKeyFunction = _noop_key_function
+    cache_entries: dict[str | int, CacheEntry[Auth] | None] = field(default_factory=dict)
+
+    def _get_cache_entry(self, case: Case, context: AuthContext) -> CacheEntry[Auth] | None:
+        key = self.cache_by_key(case, context)
+        return self.cache_entries.get(key)
+
+    def _set_cache_entry(self, data: Auth, case: Case, context: AuthContext) -> None:
+        key = self.cache_by_key(case, context)
+        self.cache_entries[key] = CacheEntry(data=data, expires=self.timer() + self.refresh_interval)
+
+
 class FilterableRegisterAuth(Protocol):
     """Protocol that adds filters to the return value of `register`."""
 
@@ -243,6 +277,7 @@ class AuthStorage(Generic[Auth]):
         self,
         *,
         refresh_interval: int | None = DEFAULT_REFRESH_INTERVAL,
+        cache_by_key: CacheKeyFunction | None = None,
     ) -> FilterableRegisterAuth:
         pass
 
@@ -252,6 +287,7 @@ class AuthStorage(Generic[Auth]):
         provider_class: type[AuthProvider],
         *,
         refresh_interval: int | None = DEFAULT_REFRESH_INTERVAL,
+        cache_by_key: CacheKeyFunction | None = None,
     ) -> FilterableApplyAuth:
         pass
 
@@ -260,10 +296,11 @@ class AuthStorage(Generic[Auth]):
         provider_class: type[AuthProvider] | None = None,
         *,
         refresh_interval: int | None = DEFAULT_REFRESH_INTERVAL,
+        cache_by_key: CacheKeyFunction | None = None,
     ) -> FilterableRegisterAuth | FilterableApplyAuth:
         if provider_class is not None:
-            return self.apply(provider_class, refresh_interval=refresh_interval)
-        return self.register(refresh_interval=refresh_interval)
+            return self.apply(provider_class, refresh_interval=refresh_interval, cache_by_key=cache_by_key)
+        return self.register(refresh_interval=refresh_interval, cache_by_key=cache_by_key)
 
     def set_from_requests(self, auth: requests.auth.AuthBase) -> FilterableRequestsAuth:
         """Use `requests` auth instance as an auth provider."""
@@ -283,6 +320,7 @@ class AuthStorage(Generic[Auth]):
         *,
         provider_class: type[AuthProvider],
         refresh_interval: int | None = DEFAULT_REFRESH_INTERVAL,
+        cache_by_key: CacheKeyFunction | None = None,
         filter_set: FilterSet,
     ) -> None:
         if not issubclass(provider_class, AuthProvider):
@@ -292,16 +330,27 @@ class AuthStorage(Generic[Auth]):
             )
         provider: AuthProvider
         # Apply caching if desired
+        instance = provider_class()
         if refresh_interval is not None:
-            provider = CachingAuthProvider(provider_class(), refresh_interval=refresh_interval)
+            if cache_by_key is None:
+                provider = CachingAuthProvider(instance, refresh_interval=refresh_interval)
+            else:
+                provider = KeyedCachingAuthProvider(
+                    instance, refresh_interval=refresh_interval, cache_by_key=cache_by_key
+                )
         else:
-            provider = provider_class()
+            provider = instance
         # Store filters if any
         if not filter_set.is_empty():
             provider = SelectiveAuthProvider(provider, filter_set)
         self.providers.append(provider)
 
-    def register(self, *, refresh_interval: int | None = DEFAULT_REFRESH_INTERVAL) -> FilterableRegisterAuth:
+    def register(
+        self,
+        *,
+        refresh_interval: int | None = DEFAULT_REFRESH_INTERVAL,
+        cache_by_key: CacheKeyFunction | None = None,
+    ) -> FilterableRegisterAuth:
         """Register a new auth provider.
 
         .. code-block:: python
@@ -323,7 +372,12 @@ class AuthStorage(Generic[Auth]):
         filter_set = FilterSet()
 
         def wrapper(provider_class: type[AuthProvider]) -> type[AuthProvider]:
-            self._set_provider(provider_class=provider_class, refresh_interval=refresh_interval, filter_set=filter_set)
+            self._set_provider(
+                provider_class=provider_class,
+                refresh_interval=refresh_interval,
+                filter_set=filter_set,
+                cache_by_key=cache_by_key,
+            )
             return provider_class
 
         attach_filter_chain(wrapper, "apply_to", filter_set.include)
@@ -339,7 +393,11 @@ class AuthStorage(Generic[Auth]):
         self.providers = []
 
     def apply(
-        self, provider_class: type[AuthProvider], *, refresh_interval: int | None = DEFAULT_REFRESH_INTERVAL
+        self,
+        provider_class: type[AuthProvider],
+        *,
+        refresh_interval: int | None = DEFAULT_REFRESH_INTERVAL,
+        cache_by_key: CacheKeyFunction | None = None,
     ) -> FilterableApplyAuth:
         """Register auth provider only on one test function.
 
@@ -363,7 +421,10 @@ class AuthStorage(Generic[Auth]):
         def wrapper(test: GenericTest) -> GenericTest:
             auth_storage = self.add_auth_storage(test)
             auth_storage._set_provider(
-                provider_class=provider_class, refresh_interval=refresh_interval, filter_set=filter_set
+                provider_class=provider_class,
+                refresh_interval=refresh_interval,
+                filter_set=filter_set,
+                cache_by_key=cache_by_key,
             )
             return test
 
@@ -389,6 +450,7 @@ class AuthStorage(Generic[Auth]):
             data: Auth | None = _provider_get(provider, case, context)
             if data is not None:
                 provider.set(case, data, context)
+                case._has_explicit_auth = True
                 break
 
 

schemathesis/checks.py

@@ -1,22 +1,26 @@
 from __future__ import annotations
-from typing import TYPE_CHECKING
+
 import json
+from typing import TYPE_CHECKING
 
 from . import failures
-from .exceptions import get_server_error, get_response_parsing_error
+from .exceptions import get_response_parsing_error, get_server_error
 from .specs.openapi.checks import (
     content_type_conformance,
+    ignored_auth,
+    negative_data_rejection,
     response_headers_conformance,
     response_schema_conformance,
     status_code_conformance,
 )
 
 if TYPE_CHECKING:
+    from .internal.checks import CheckContext, CheckFunction
+    from .models import Case
     from .transports.responses import GenericResponse
-    from .models import Case, CheckFunction
 
 
-def not_a_server_error(response: GenericResponse, case: Case) -> bool | None:
+def not_a_server_error(ctx: CheckContext, response: GenericResponse, case: Case) -> bool | None:
     """A check to verify that the response is not a server-side error."""
     from .specs.graphql.schemas import GraphQLCase
     from .specs.graphql.validation import validate_graphql_response
@@ -24,25 +28,31 @@ def not_a_server_error(response: GenericResponse, case: Case) -> bool | None:
 
     status_code = response.status_code
     if status_code >= 500:
-        exc_class = get_server_error(status_code)
+        exc_class = get_server_error(case.operation.verbose_name, status_code)
         raise exc_class(failures.ServerError.title, context=failures.ServerError(status_code=status_code))
     if isinstance(case, GraphQLCase):
         try:
             data = get_json(response)
             validate_graphql_response(data)
         except json.JSONDecodeError as exc:
-            exc_class = get_response_parsing_error(exc)
+            exc_class = get_response_parsing_error(case.operation.verbose_name, exc)
             context = failures.JSONDecodeErrorContext.from_exception(exc)
             raise exc_class(context.title, context=context) from exc
     return None
 
 
+def _make_max_response_time_failure_message(elapsed_time: float, max_response_time: int) -> str:
+    return f"Actual: {elapsed_time:.2f}ms\nLimit: {max_response_time}.00ms"
+
+
 DEFAULT_CHECKS: tuple[CheckFunction, ...] = (not_a_server_error,)
 OPTIONAL_CHECKS = (
     status_code_conformance,
     content_type_conformance,
     response_headers_conformance,
     response_schema_conformance,
+    negative_data_rejection,
+    ignored_auth,
 )
 ALL_CHECKS: tuple[CheckFunction, ...] = DEFAULT_CHECKS + OPTIONAL_CHECKS
 
@@ -55,14 +65,16 @@ def register(check: CheckFunction) -> CheckFunction:
     .. code-block:: python
 
         @schemathesis.check
-        def new_check(response, case):
+        def new_check(ctx, response, case):
             # some awesome assertions!
             ...
     """
     from . import cli
+    from .internal.checks import wrap_check
 
+    _check = wrap_check(check)
     global ALL_CHECKS
 
-    ALL_CHECKS += (check,)
-    cli.CHECKS_TYPE.choices += (check.__name__,)  # type: ignore
+    ALL_CHECKS += (_check,)
+    cli.CHECKS_TYPE.choices += (_check.__name__,)  # type: ignore
     return check