schemathesis 3.25.5__py3-none-any.whl → 4.0.0a1__py3-none-any.whl

schemathesis/transport/requests.py

@@ -0,0 +1,221 @@
+from __future__ import annotations
+
+import binascii
+import inspect
+import os
+from io import BytesIO
+from typing import TYPE_CHECKING, Any
+from urllib.parse import urlparse
+
+from schemathesis.core import NotSet
+from schemathesis.core.rate_limit import ratelimit
+from schemathesis.core.transforms import deepclone, merge_at
+from schemathesis.core.transport import DEFAULT_RESPONSE_TIMEOUT, Response
+from schemathesis.transport import BaseTransport, SerializationContext
+from schemathesis.transport.prepare import prepare_body, prepare_headers, prepare_url
+from schemathesis.transport.serialization import Binary, serialize_binary, serialize_json, serialize_xml, serialize_yaml
+
+if TYPE_CHECKING:
+    import requests
+
+    from schemathesis.generation.case import Case
+
+
+class RequestsTransport(BaseTransport["Case", Response, "requests.Session"]):
+    def serialize_case(self, case: Case, **kwargs: Any) -> dict[str, Any]:
+        base_url = kwargs.get("base_url")
+        headers = kwargs.get("headers")
+        params = kwargs.get("params")
+        cookies = kwargs.get("cookies")
+
+        final_headers = prepare_headers(case, headers)
+
+        media_type = case.media_type
+
+        # Set content type header if needed
+        if media_type and media_type != "multipart/form-data" and not isinstance(case.body, NotSet):
+            if "content-type" not in final_headers:
+                final_headers["Content-Type"] = media_type
+
+        url = prepare_url(case, base_url)
+
+        # Handle serialization
+        if not isinstance(case.body, NotSet) and media_type is not None:
+            serializer = self._get_serializer(media_type)
+            context = SerializationContext(case=case)
+            extra = serializer(context, prepare_body(case))
+        else:
+            extra = {}
+
+        if case._auth is not None:
+            extra["auth"] = case._auth
+
+        # Additional headers from serializer
+        additional_headers = extra.pop("headers", None)
+        if additional_headers:
+            for key, value in additional_headers.items():
+                final_headers.setdefault(key, value)
+
+        data = {
+            "method": case.method,
+            "url": url,
+            "cookies": case.cookies,
+            "headers": final_headers,
+            "params": case.query,
+            **extra,
+        }
+
+        if params is not None:
+            merge_at(data, "params", params)
+        if cookies is not None:
+            merge_at(data, "cookies", cookies)
+
+        return data
+
+    def send(self, case: Case, *, session: requests.Session | None = None, **kwargs: Any) -> Response:
+        import requests
+
+        data = self.serialize_case(case, **kwargs)
+        kwargs.pop("base_url", None)
+        data.update({key: value for key, value in kwargs.items() if key not in data})
+        data.setdefault("timeout", DEFAULT_RESPONSE_TIMEOUT)
+
+        if session is None:
+            validate_vanilla_requests_kwargs(data)
+            session = requests.Session()
+            close_session = True
+        else:
+            close_session = False
+
+        verify = data.get("verify", True)
+
+        try:
+            with ratelimit(case.operation.schema.rate_limiter, case.operation.schema.base_url):
+                response = session.request(**data)  # type: ignore
+            return Response.from_requests(response, verify=verify)
+        finally:
+            if close_session:
+                session.close()
+
+
+def validate_vanilla_requests_kwargs(data: dict[str, Any]) -> None:
+    """Check arguments for `requests.Session.request`.
+
+    Some arguments can be valid for cases like ASGI integration, but at the same time they won't work for the regular
+    `requests` calls. In such cases we need to avoid an obscure error message, that comes from `requests`.
+    """
+    url = data["url"]
+    if not urlparse(url).netloc:
+        stack = inspect.stack()
+        method_name = "call"
+        for frame in stack[1:]:
+            if frame.function == "call_and_validate":
+                method_name = "call_and_validate"
+                break
+        raise RuntimeError(
+            "The `base_url` argument is required when specifying a schema via a file, so Schemathesis knows where to send the data. \n"
+            f"Pass `base_url` either to the `schemathesis.openapi.from_*` loader or to the `Case.{method_name}`.\n"
+            f"If you use the ASGI integration, please supply your test client "
+            f"as the `session` argument to `call`.\nURL: {url}"
+        )
+
+
+REQUESTS_TRANSPORT = RequestsTransport()
+
+
+@REQUESTS_TRANSPORT.serializer("application/json", "text/json")
+def json_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    return serialize_json(value)
+
+
+@REQUESTS_TRANSPORT.serializer(
+    "text/yaml", "text/x-yaml", "text/vnd.yaml", "text/yml", "application/yaml", "application/x-yaml"
+)
+def yaml_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    return serialize_yaml(value)
+
+
+def _should_coerce_to_bytes(item: Any) -> bool:
+    """Whether the item should be converted to bytes."""
+    # These types are OK in forms, others should be coerced to bytes
+    return isinstance(item, Binary) or not isinstance(item, (bytes, str, int))
+
+
+def _prepare_form_data(data: dict[str, Any]) -> dict[str, Any]:
+    """Make the generated data suitable for sending as multipart.
+
+    If the schema is loose, Schemathesis can generate data that can't be sent as multipart. In these cases,
+    we convert it to bytes and send it as-is, ignoring any conversion errors.
+
+    NOTE. This behavior might change in the future.
+    """
+    for name, value in data.items():
+        if isinstance(value, list):
+            data[name] = [serialize_binary(item) if _should_coerce_to_bytes(item) else item for item in value]
+        elif _should_coerce_to_bytes(value):
+            data[name] = serialize_binary(value)
+    return data
+
+
+def choose_boundary() -> str:
+    """Random boundary name."""
+    return binascii.hexlify(os.urandom(16)).decode("ascii")
+
+
+def _encode_multipart(value: Any, boundary: str) -> bytes:
+    """Encode any value as multipart.
+
+    NOTE. It doesn't aim to be 100% correct multipart payload, but rather a way to send data which is not intended to
+    be used as multipart, in cases when the API schema dictates so.
+    """
+    # For such cases we stringify the value and wrap it to a randomly-generated boundary
+    body = BytesIO()
+    body.write(f"--{boundary}\r\n".encode())
+    body.write(str(value).encode())
+    body.write(f"--{boundary}--\r\n".encode("latin-1"))
+    return body.getvalue()
+
+
+@REQUESTS_TRANSPORT.serializer("multipart/form-data", "multipart/mixed")
+def multipart_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    if isinstance(value, bytes):
+        return {"data": value}
+    if isinstance(value, dict):
+        value = deepclone(value)
+        multipart = _prepare_form_data(value)
+        files, data = ctx.case.operation.prepare_multipart(multipart)
+        return {"files": files, "data": data}
+    # Uncommon schema. For example - `{"type": "string"}`
+    boundary = choose_boundary()
+    raw_data = _encode_multipart(value, boundary)
+    content_type = f"multipart/form-data; boundary={boundary}"
+    return {"data": raw_data, "headers": {"Content-Type": content_type}}
+
+
+@REQUESTS_TRANSPORT.serializer("application/xml", "text/xml")
+def xml_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    media_type = ctx.case.media_type
+
+    assert media_type is not None
+
+    raw_schema = ctx.case.operation.get_raw_payload_schema(media_type)
+    resolved_schema = ctx.case.operation.get_resolved_payload_schema(media_type)
+
+    return serialize_xml(value, raw_schema, resolved_schema)
+
+
+@REQUESTS_TRANSPORT.serializer("application/x-www-form-urlencoded")
+def urlencoded_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    return {"data": value}
+
+
+@REQUESTS_TRANSPORT.serializer("text/plain")
+def text_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    if isinstance(value, bytes):
+        return {"data": value}
+    return {"data": str(value).encode("utf8")}
+
+
+@REQUESTS_TRANSPORT.serializer("application/octet-stream")
+def binary_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    return {"data": serialize_binary(value)}

schemathesis/{_xml.py → transport/serialization.py}

@@ -1,11 +1,74 @@
-"""XML serialization."""
 from __future__ import annotations
+
+import re
+from dataclasses import dataclass
 from io import StringIO
 from typing import Any, Dict, List, Union
-from xml.etree import ElementTree
+from unicodedata import normalize
+
+from schemathesis.core.errors import UnboundPrefix
+from schemathesis.core.transforms import deepclone, transform
+
+
+@dataclass
+class Binary(str):
+    """A wrapper around `bytes` to resolve OpenAPI and JSON Schema `format` discrepancies.
+
+    Treat `bytes` as a valid type, allowing generation of bytes for OpenAPI `format` values like `binary` or `file`
+    that JSON Schema expects to be strings.
+    """
+
+    data: bytes
+
+    __slots__ = ("data",)
+
+    def __hash__(self) -> int:
+        return hash(self.data)
+
+
+def serialize_json(value: Any) -> dict[str, Any]:
+    if isinstance(value, bytes):
+        # Possible to get via explicit examples, e.g. `externalValue`
+        return {"data": value}
+    if isinstance(value, Binary):
+        return {"data": value.data}
+    if value is None:
+        # If the body is `None`, then the app expects `null`, but `None` is also the default value for the `json`
+        # argument in `requests.request` and `werkzeug.Client.open` which makes these cases indistinguishable.
+        # Therefore we explicitly create such payload
+        return {"data": b"null"}
+    return {"json": value}
+
+
+def _replace_binary(value: dict) -> dict:
+    return {key: value.data if isinstance(value, Binary) else value for key, value in value.items()}
+
+
+def serialize_binary(value: Any) -> bytes:
+    """Convert the input value to bytes and ignore any conversion errors."""
+    if isinstance(value, bytes):
+        return value
+    if isinstance(value, Binary):
+        return value.data
+    return str(value).encode(errors="ignore")
+
+
+def serialize_yaml(value: Any) -> dict[str, Any]:
+    import yaml
+
+    try:
+        from yaml import CSafeDumper as SafeDumper
+    except ImportError:
+        from yaml import SafeDumper  # type: ignore
+
+    if isinstance(value, bytes):
+        return {"data": value}
+    if isinstance(value, Binary):
+        return {"data": value.data}
+    if isinstance(value, (list, dict)):
+        value = transform(value, _replace_binary)
+    return {"data": yaml.dump(value, Dumper=SafeDumper)}
 
-from .exceptions import UnboundPrefixError
-from .internal.copy import fast_deepcopy
 
 Primitive = Union[str, int, float, bool, None]
 JSON = Union[Primitive, List, Dict[str, Any]]
@@ -13,7 +76,9 @@ DEFAULT_TAG_NAME = "data"
 NAMESPACE_URL = "http://example.com/schema"
 
 
-def _to_xml(value: Any, raw_schema: dict[str, Any] | None, resolved_schema: dict[str, Any] | None) -> dict[str, Any]:
+def serialize_xml(
+    value: Any, raw_schema: dict[str, Any] | None, resolved_schema: dict[str, Any] | None
+) -> dict[str, Any]:
     """Serialize a generated Python object as an XML string.
 
     Schemas may contain additional information for fine-tuned XML serialization.
@@ -30,24 +95,9 @@ def _to_xml(value: Any, raw_schema: dict[str, Any] | None, resolved_schema: dict
     namespace_stack: list[str] = []
     _write_xml(buffer, value, tag, resolved_schema, namespace_stack)
     data = buffer.getvalue()
-    if not is_valid_xml(data):
-        from hypothesis import reject
-
-        reject()
     return {"data": data.encode("utf8")}
 
 
-_from_string = ElementTree.fromstring
-
-
-def is_valid_xml(data: str) -> bool:
-    try:
-        _from_string(f"<root xmlns:smp='{NAMESPACE_URL}'>{data}</root>")
-        return True
-    except ElementTree.ParseError:
-        return False
-
-
 def _get_xml_tag(raw_schema: dict[str, Any] | None, resolved_schema: dict[str, Any] | None) -> str:
     # On the top level we need to detect the proper XML tag, in other cases it is known from object properties
     if (resolved_schema or {}).get("xml", {}).get("name"):
@@ -76,7 +126,7 @@ def _validate_prefix(options: dict[str, Any], namespace_stack: list[str]) -> Non
     try:
         prefix = options["prefix"]
         if prefix not in namespace_stack:
-            raise UnboundPrefixError(prefix)
+            raise UnboundPrefix(prefix)
     except KeyError:
         pass
 
@@ -96,12 +146,15 @@ def _write_object(
 ) -> None:
     options = (schema or {}).get("xml", {})
     push_namespace_if_any(stack, options)
+    tag = _sanitize_xml_name(tag)
     if "prefix" in options:
         tag = f"{options['prefix']}:{tag}"
     buffer.write(f"<{tag}")
     if "namespace" in options:
         _write_namespace(buffer, options)
-    attributes = []
+
+    attribute_namespaces = {}
+    attributes = {}
     children_buffer = StringIO()
     properties = (schema or {}).get("properties", {})
     for child_name, value in obj.items():
@@ -109,18 +162,35 @@ def _write_object(
         child_options = property_schema.get("xml", {})
         push_namespace_if_any(stack, child_options)
         child_tag = child_options.get("name", child_name)
+
+        if child_options.get("attribute", False):
+            if child_options.get("prefix") and child_options.get("namespace"):
+                _validate_prefix(child_options, stack)
+                prefix = child_options["prefix"]
+                attr_name = f"{prefix}:{_sanitize_xml_name(child_tag)}"
+                # Store namespace declaration
+                attribute_namespaces[prefix] = child_options["namespace"]
+            else:
+                attr_name = _sanitize_xml_name(child_tag)
+
+            if attr_name not in attributes:  # Only keep first occurrence
+                attributes[attr_name] = f'{attr_name}="{_escape_xml(value)}"'
+            continue
+
+        child_tag = _sanitize_xml_name(child_tag)
         if child_options.get("prefix"):
             _validate_prefix(child_options, stack)
             prefix = child_options["prefix"]
             child_tag = f"{prefix}:{child_tag}"
-        if child_options.get("attribute", False):
-            attributes.append(f'{child_tag}="{value}"')
-            continue
         _write_xml(children_buffer, value, child_tag, property_schema, stack)
         pop_namespace_if_any(stack, child_options)
 
+    # Write namespace declarations for attributes
+    for prefix, namespace in attribute_namespaces.items():
+        buffer.write(f' xmlns:{prefix}="{namespace}"')
+
     if attributes:
-        buffer.write(f" {' '.join(attributes)}")
+        buffer.write(f" {' '.join(attributes.values())}")
     buffer.write(">")
     buffer.write(children_buffer.getvalue())
     buffer.write(f"</{tag}>")
@@ -141,7 +211,7 @@ def _write_array(buffer: StringIO, obj: list[JSON], tag: str, schema: dict[str,
             _write_namespace(buffer, options)
         buffer.write(">")
     # In Open API `items` value should be an object and not an array
-    items = fast_deepcopy((schema or {}).get("items", {}))
+    items = deepclone((schema or {}).get("items", {}))
     child_options = items.get("xml", {})
     child_tag = child_options.get("name", tag)
     if not is_namespace_specified and "namespace" in options:
@@ -167,7 +237,7 @@ def _write_primitive(
     buffer.write(f"<{tag}")
     if "namespace" in xml_options:
         _write_namespace(buffer, xml_options)
-    buffer.write(f">{obj}</{tag}>")
+    buffer.write(f">{_escape_xml(obj)}</{tag}>")
 
 
 def _write_namespace(buffer: StringIO, options: dict[str, Any]) -> None:
@@ -180,3 +250,48 @@ def _write_namespace(buffer: StringIO, options: dict[str, Any]) -> None:
 def _get_tag_name_from_reference(reference: str) -> str:
     """Extract object name from a reference."""
     return reference.rsplit("/", maxsplit=1)[1]
+
+
+def _escape_xml(value: JSON) -> str:
+    """Escape special characters in XML content."""
+    if isinstance(value, (int, float, bool)):
+        return str(value)
+    if value is None:
+        return ""
+
+    # Filter out invalid XML characters
+    cleaned = "".join(
+        char
+        for char in str(value)
+        if (
+            char in "\t\n\r"
+            or 0x20 <= ord(char) <= 0xD7FF
+            or 0xE000 <= ord(char) <= 0xFFFD
+            or 0x10000 <= ord(char) <= 0x10FFFF
+        )
+    )
+
+    replacements = {
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&apos;",
+    }
+    return "".join(replacements.get(c, c) for c in cleaned)
+
+
+def _sanitize_xml_name(name: str) -> str:
+    """Sanitize a string to be a valid XML element name."""
+    if not name:
+        return "element"
+
+    name = normalize("NFKC", str(name))
+
+    name = name.replace(":", "_")
+    sanitized = re.sub(r"[^a-zA-Z0-9_\-.]", "_", name)
+
+    if not sanitized[0].isalpha() and sanitized[0] != "_":
+        sanitized = "x_" + sanitized
+
+    return sanitized

schemathesis/transport/wsgi.py

@@ -0,0 +1,165 @@
+from __future__ import annotations
+
+import time
+from contextlib import contextmanager
+from typing import TYPE_CHECKING, Any, Generator
+
+from schemathesis.core import NotSet
+from schemathesis.core.rate_limit import ratelimit
+from schemathesis.core.transforms import merge_at
+from schemathesis.core.transport import Response
+from schemathesis.generation.case import Case
+from schemathesis.python import wsgi
+from schemathesis.transport import BaseTransport, SerializationContext
+from schemathesis.transport.prepare import normalize_base_url, prepare_body, prepare_headers, prepare_path
+from schemathesis.transport.requests import REQUESTS_TRANSPORT
+from schemathesis.transport.serialization import serialize_binary, serialize_json, serialize_xml, serialize_yaml
+
+if TYPE_CHECKING:
+    import werkzeug
+
+
+class WSGITransport(BaseTransport["Case", Response, "werkzeug.Client"]):
+    def serialize_case(self, case: Case, **kwargs: Any) -> dict[str, Any]:
+        headers = kwargs.get("headers")
+        params = kwargs.get("params")
+
+        final_headers = prepare_headers(case, headers)
+
+        media_type = case.media_type
+
+        # Set content type for payload
+        if media_type and not isinstance(case.body, NotSet):
+            final_headers["Content-Type"] = media_type
+
+        extra: dict[str, Any]
+        # Handle serialization
+        if not isinstance(case.body, NotSet) and media_type is not None:
+            serializer = self._get_serializer(media_type)
+            context = SerializationContext(case=case)
+            extra = serializer(context, prepare_body(case))
+        else:
+            extra = {}
+
+        data = {
+            "method": case.method,
+            "path": case.operation.schema.get_full_path(prepare_path(case.path, case.path_parameters)),
+            # Convert to regular dict for Werkzeug compatibility
+            "headers": dict(final_headers),
+            "query_string": case.query,
+            **extra,
+        }
+
+        if params is not None:
+            merge_at(data, "query_string", params)
+
+        return data
+
+    def send(
+        self,
+        case: Case,
+        *,
+        session: werkzeug.Client | None = None,
+        **kwargs: Any,
+    ) -> Response:
+        import requests
+
+        headers = kwargs.pop("headers", None)
+        params = kwargs.pop("params", None)
+        cookies = kwargs.pop("cookies", None)
+        application = kwargs.pop("app")
+
+        data = self.serialize_case(case, headers=headers, params=params)
+        data.update({key: value for key, value in kwargs.items() if key not in data})
+
+        client = session or wsgi.get_client(application)
+        cookies = {**(case.cookies or {}), **(cookies or {})}
+
+        with (
+            cookie_handler(client, cookies),
+            ratelimit(case.operation.schema.rate_limiter, case.operation.schema.base_url),
+        ):
+            start = time.monotonic()
+            response = client.open(**data)
+            elapsed = time.monotonic() - start
+
+        requests_kwargs = REQUESTS_TRANSPORT.serialize_case(
+            case,
+            base_url=normalize_base_url(case.operation.base_url),
+            headers=headers,
+            params=params,
+            cookies=cookies,
+        )
+
+        headers = {key: response.headers.getlist(key) for key in response.headers.keys()}
+
+        return Response(
+            status_code=response.status_code,
+            headers=headers,
+            content=response.get_data(),
+            request=requests.Request(**requests_kwargs).prepare(),
+            elapsed=elapsed,
+            verify=False,
+        )
+
+
+@contextmanager
+def cookie_handler(client: werkzeug.Client, cookies: dict[str, Any] | None) -> Generator[None, None, None]:
+    """Set cookies required for a call."""
+    if not cookies:
+        yield
+    else:
+        for key, value in cookies.items():
+            client.set_cookie(key=key, value=value, domain="localhost")
+        yield
+        for key in cookies:
+            client.delete_cookie(key=key, domain="localhost")
+
+
+WSGI_TRANSPORT = WSGITransport()
+
+
+@WSGI_TRANSPORT.serializer("application/json", "text/json")
+def json_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    return serialize_json(value)
+
+
+@WSGI_TRANSPORT.serializer(
+    "text/yaml", "text/x-yaml", "text/vnd.yaml", "text/yml", "application/yaml", "application/x-yaml"
+)
+def yaml_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    return serialize_yaml(value)
+
+
+@WSGI_TRANSPORT.serializer("multipart/form-data", "multipart/mixed")
+def multipart_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    return {"data": value}
+
+
+@WSGI_TRANSPORT.serializer("application/xml", "text/xml")
+def xml_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    media_type = ctx.case.media_type
+
+    assert media_type is not None
+
+    raw_schema = ctx.case.operation.get_raw_payload_schema(media_type)
+    resolved_schema = ctx.case.operation.get_resolved_payload_schema(media_type)
+
+    return serialize_xml(value, raw_schema, resolved_schema)
+
+
+@WSGI_TRANSPORT.serializer("application/x-www-form-urlencoded")
+def urlencoded_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    return {"data": value}
+
+
+@WSGI_TRANSPORT.serializer("text/plain")
+def text_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    if isinstance(value, bytes):
+        return {"data": value}
+    return {"data": str(value)}
+
+
+@WSGI_TRANSPORT.serializer("application/octet-stream")
+def binary_serializer(ctx: SerializationContext[Case], value: Any) -> dict[str, Any]:
+    return {"data": serialize_binary(value)}