schemathesis 3.37.1__tar.gz → 3.38.0__tar.gz

{schemathesis-3.37.1 → schemathesis-3.38.0}/.github/workflows/build.yml

@@ -52,7 +52,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-22.04, windows-2019]
-        python: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        python: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
         # Set the patch version for "python", so GitHub adds these configurations instead of expanding existing ones
         include:
           - os: ubuntu-22.04
@@ -118,3 +118,11 @@ jobs:
           fi
         working-directory: ./test/apps
         shell: bash
+
+  spell-check:
+    name: Spell Check
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: crate-ci/typos@master

{schemathesis-3.37.1 → schemathesis-3.38.0}/.pre-commit-config.yaml

@@ -25,12 +25,12 @@ repos:
       - id: yamllint
 
   - repo: https://github.com/codingjoe/relint
-    rev: 3.2.0
+    rev: 3.3.0
     hooks:
       - id: relint
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.11.2
+    rev: v1.12.0
     hooks:
       - id: mypy
         exclude: ^(docs/|test/|test-corpus/|example/|benches/).*$
@@ -38,12 +38,12 @@ repos:
         additional_dependencies: [types-click, types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.9
+    rev: v0.7.0
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.9
+    rev: v0.7.0
     hooks:
       - id: ruff
 

{schemathesis-3.37.1 → schemathesis-3.38.0}/CODE_OF_CONDUCT.md

@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at dadygalo@gmail.com. All
+reported by contacting the project team at dmitry@dygalo.dev. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.

{schemathesis-3.37.1 → schemathesis-3.38.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: schemathesis
-Version: 3.37.1
+Version: 3.38.0
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://schemathesis.readthedocs.io/en/stable/changelog.html
@@ -25,6 +25,7 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Topic :: Software Development :: Testing
 Requires-Python: >=3.8

schemathesis-3.38.0/SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+Schemathesis provides security updates only for the latest minor version within the 3.x series.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 3.x     | :white_check_mark: |
+| < 3.0   | :x:                |
+
+## Reporting a Vulnerability
+
+To report a security vulnerability in Schemathesis:
+
+1. Email your findings to dmitry@dygalo.dev.
+2. Provide a detailed description of the vulnerability and steps to reproduce it.
+3. If possible, include a suggested fix or mitigation.
+
+You can expect an initial response within a few days of your report.
+
+While Schemathesis is typically installed in test environments, we take all security reports seriously and appreciate your efforts to disclose responsibly.
+
+## Disclosure Policy
+
+There is no formal process for disclosing fixed vulnerabilities. Updates will be released as part of regular patch versions, and significant security fixes will be noted in the release notes.
+
+Thank you for helping keep Schemathesis and its users safe!

{schemathesis-3.37.1 → schemathesis-3.38.0}/benches/coverage_phase.py

@@ -4,7 +4,7 @@ import pytest
 
 from schemathesis.generation.coverage import cover_schema_iter, CoverageContext
 
-CONTEXTS = [CoverageContext.with_positive(), CoverageContext.with_negative()]
+CONTEXTS = [CoverageContext().with_positive(), CoverageContext().with_negative()]
 CONTEXT_NAMES = [",".join([m.value for m in ctx.data_generation_methods]) for ctx in CONTEXTS]
 
 BASIC_TYPES = [

{schemathesis-3.37.1 → schemathesis-3.38.0}/docs/additional-content.rst

@@ -16,6 +16,15 @@ Papers
 
   - **Date**: 24 Nov 2023
 
+Tutorials
+---------
+
+- `Automated REST API fuzzing using Schemathesis <https://killercoda.com/rafdev/scenario/rest-fuzzing-with-schemathesis>`_ by **RafDevX** and **sofiaedv** at **KTH Royal Institute of Technology**
+
+  - **Description**: Hands-on tutorial about fuzzing REST APIs with Schemathesis as taught in **DD2482 Automated Software Testing and DevOps**
+
+  - **Date**: 15 Oct 2024
+
 Articles
 --------
 

{schemathesis-3.37.1 → schemathesis-3.38.0}/docs/changelog.rst

@@ -1,9 +1,36 @@
 Changelog
 =========
 
-:version:`Unreleased <v3.37.1...HEAD>` - TBD
+:version:`Unreleased <v3.38.0...HEAD>` - TBD
 --------------------------------------------
 
+.. _v3.38.0:
+
+:version:`3.38.0 <v3.37.1...v3.38.0>` - 2024-10-21
+--------------------------------------------------
+
+**Added**
+
+- Support negative cases for ``items`` and ``patternProperties`` during the coverage phase.
+- Location information for all negative values generated at the coverage phase.
+- Python 3.13 support.
+
+**Changed**
+
+- Ensure ``minLength`` & ``maxLength`` are taken into account when generating negative cases with ``pattern`` during the coverage phase.
+
+**Fixed**
+
+- Passing ``additional_checks`` & ``excluded_checks`` to ``Case.call_and_validate``.
+- Not generating some negative patterns during the coverage phase.
+- Internal error on unsupported regex in the coverage phase.
+- False positive in ``ignored_auth`` if auth is provided via ``--set-query`` or ``--set-cookie``.
+- ``ignored_auth`` not working under ``pytest``.
+
+**Performance**
+
+- Major speedup for the coverage phase.
+
 .. _v3.37.1:
 
 :version:`3.37.1 <v3.37.0...v3.37.1>` - 2024-10-17

{schemathesis-3.37.1 → schemathesis-3.38.0}/docs/extending.rst

@@ -29,7 +29,7 @@ The function name, such as ``filter_query``, indicates it's a hook to filter que
 .. note::
 
     The second argument could be ``None`` if there are no parameters of such a kind or if it is optional.
-    Keep it in mind when acessing the keys of the dictionary.
+    Keep it in mind when accessing the keys of the dictionary.
 
 When dealing with multiple hooks that serve similar purposes, especially across different schemas within the same file, custom names can be assigned as the first argument in the decorator to avoid conflicts and maintain clarity.
 

{schemathesis-3.37.1 → schemathesis-3.38.0}/docs/python.rst

@@ -580,7 +580,7 @@ Async support
 
 Schemathesis supports asynchronous test functions executed via ``asyncio`` or ``trio``.
 They work the same way as regular async tests and don't require any additional configuration beyond
-installing ``pytest-asyncio`` or ``pytest-trio`` and follwing their usage guidelines.
+installing ``pytest-asyncio`` or ``pytest-trio`` and following their usage guidelines.
 
 .. code:: python
 

{schemathesis-3.37.1 → schemathesis-3.38.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "3.37.1"
+version = "3.38.0"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]
@@ -27,6 +27,7 @@ classifiers = [
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: Implementation :: CPython",
   "Topic :: Software Development :: Testing",
 ]

{schemathesis-3.37.1 → schemathesis-3.38.0}/src/schemathesis/_hypothesis.py

@@ -6,15 +6,16 @@ import asyncio
 import json
 import warnings
 from copy import copy
+from functools import wraps
 from typing import TYPE_CHECKING, Any, Callable, Generator, Mapping
 
 import hypothesis
 from hypothesis import Phase
 from hypothesis.errors import HypothesisWarning, Unsatisfiable
 from hypothesis.internal.entropy import deterministic_PRNG
-from hypothesis.internal.reflection import proxies
 from jsonschema.exceptions import SchemaError
 
+from . import _patches
 from .auths import get_auth_storage_from_test
 from .constants import DEFAULT_DEADLINE, NOT_SET
 from .exceptions import OperationSchemaError, SerializationNotPossible
@@ -29,11 +30,13 @@ from .types import NotSet
 if TYPE_CHECKING:
     from .utils import GivenInput
 
-# Forcefully initializes Hypothesis' global PRNG to avoid races that initilize it
+# Forcefully initializes Hypothesis' global PRNG to avoid races that initialize it
 # if e.g. Schemathesis CLI is used with multiple workers
 with deterministic_PRNG():
     pass
 
+_patches.install()
+
 
 def create_test(
     *,
@@ -72,7 +75,7 @@ def create_test(
     # tests in multiple threads because Hypothesis stores some internal attributes on function objects and re-writing
     # them from different threads may lead to unpredictable side-effects.
 
-    @proxies(test)  # type: ignore
+    @wraps(test)
     def test_function(*args: Any, **kwargs: Any) -> Any:
         __tracebackhide__ = True
         return test(*args, **kwargs)
@@ -220,7 +223,6 @@ def _iter_coverage_cases(
     from .specs.openapi.constants import LOCATION_TO_CONTAINER
     from .specs.openapi.examples import find_in_responses, find_matching_in_responses
 
-    ctx = coverage.CoverageContext(data_generation_methods=data_generation_methods)
     meta = GenerationMetadata(
         query=None,
         path_parameters=None,
@@ -229,15 +231,18 @@ def _iter_coverage_cases(
         body=None,
         phase=TestPhase.COVERAGE,
         description=None,
+        location=None,
     )
     generators: dict[tuple[str, str], Generator[coverage.GeneratedValue, None, None]] = {}
     template: dict[str, Any] = {}
     responses = find_in_responses(operation)
     for parameter in operation.iter_parameters():
-        schema = parameter.as_json_schema(operation)
+        schema = parameter.as_json_schema(operation, update_quantifiers=False)
         for value in find_matching_in_responses(responses, parameter.name):
             schema.setdefault("examples", []).append(value)
-        gen = coverage.cover_schema_iter(ctx, schema)
+        gen = coverage.cover_schema_iter(
+            coverage.CoverageContext(data_generation_methods=data_generation_methods), schema
+        )
         value = next(gen, NOT_SET)
         if isinstance(value, NotSet):
             continue
@@ -251,13 +256,15 @@ def _iter_coverage_cases(
         generators[(location, name)] = gen
     if operation.body:
         for body in operation.body:
-            schema = body.as_json_schema(operation)
+            schema = body.as_json_schema(operation, update_quantifiers=False)
             # Definition could be a list for Open API 2.0
             definition = body.definition if isinstance(body.definition, dict) else {}
             examples = [example["value"] for example in definition.get("examples", {}).values() if "value" in example]
             if examples:
                 schema.setdefault("examples", []).extend(examples)
-            gen = coverage.cover_schema_iter(ctx, schema)
+            gen = coverage.cover_schema_iter(
+                coverage.CoverageContext(data_generation_methods=data_generation_methods), schema
+            )
             value = next(gen, NOT_SET)
             if isinstance(value, NotSet):
                 continue
@@ -268,12 +275,14 @@ def _iter_coverage_cases(
             case.data_generation_method = value.data_generation_method
             case.meta = copy(meta)
             case.meta.description = value.description
+            case.meta.location = value.location
             yield case
             for next_value in gen:
                 case = operation.make_case(**{**template, "body": next_value.value, "media_type": body.media_type})
                 case.data_generation_method = next_value.data_generation_method
                 case.meta = copy(meta)
                 case.meta.description = next_value.description
+                case.meta.location = next_value.location
                 yield case
     elif DataGenerationMethod.positive in data_generation_methods:
         case = operation.make_case(**template)
@@ -292,6 +301,7 @@ def _iter_coverage_cases(
             case.data_generation_method = value.data_generation_method
             case.meta = copy(meta)
             case.meta.description = value.description
+            case.meta.location = value.location
             yield case
 
 

schemathesis-3.38.0/src/schemathesis/_patches.py

@@ -0,0 +1,21 @@
+"""A set of performance-related patches."""
+
+from typing import Any
+
+
+def install() -> None:
+    from hypothesis.internal.reflection import is_first_param_referenced_in_function
+    from hypothesis.strategies._internal import core
+    from hypothesis_jsonschema import _from_schema, _resolve
+
+    from .internal.copy import fast_deepcopy
+
+    # This one is used a lot, and under the hood it re-parses the AST of the same function
+    def _is_first_param_referenced_in_function(f: Any) -> bool:
+        if f.__name__ == "from_object_schema" and f.__module__ == "hypothesis_jsonschema._from_schema":
+            return True
+        return is_first_param_referenced_in_function(f)
+
+    core.is_first_param_referenced_in_function = _is_first_param_referenced_in_function  # type: ignore
+    _resolve.deepcopy = fast_deepcopy  # type: ignore
+    _from_schema.deepcopy = fast_deepcopy  # type: ignore

{schemathesis-3.37.1 → schemathesis-3.38.0}/src/schemathesis/cli/__init__.py

@@ -36,7 +36,7 @@ from ..filters import FilterSet, expression_to_filter_function, is_deprecated
 from ..fixups import ALL_FIXUPS
 from ..generation import DEFAULT_DATA_GENERATION_METHODS, DataGenerationMethod
 from ..hooks import GLOBAL_HOOK_DISPATCHER, HookContext, HookDispatcher, HookScope
-from ..internal.checks import CheckConfig, PositiveDataAcceptanceConfig
+from ..internal.checks import CheckConfig
 from ..internal.datetime import current_datetime
 from ..internal.output import OutputConfig
 from ..internal.validation import file_exists

{schemathesis-3.37.1 → schemathesis-3.38.0}/src/schemathesis/cli/cassettes.py

@@ -244,6 +244,12 @@ http_interactions:"""
                     write_double_quoted(stream, interaction.description)
                 else:
                     stream.write("null")
+                stream.write("\n    location: ")
+
+                if interaction.location is not None:
+                    write_double_quoted(stream, interaction.location)
+                else:
+                    stream.write("null")
                 stream.write(
                     f"""
   phase: {phase}

{schemathesis-3.37.1 → schemathesis-3.38.0}/src/schemathesis/extra/pytest_plugin.py

@@ -200,7 +200,7 @@ class SchemathesisCase(PyCollector):
             kwargs["_ispytest"] = True
         metafunc = Metafunc(definition, fixtureinfo, self.config, **kwargs)
         methods = []
-        if hasattr(module, "pytest_generate_tests"):
+        if module is not None and hasattr(module, "pytest_generate_tests"):
             methods.append(module.pytest_generate_tests)
         if hasattr(cls, "pytest_generate_tests"):
             cls = cast(Type, cls)

{schemathesis-3.37.1 → schemathesis-3.38.0}/src/schemathesis/generation/_hypothesis.py

@@ -43,6 +43,8 @@ def add_single_example(strategy: st.SearchStrategy[T], examples: list[T]) -> Non
     def example_generating_inner_function(ex: T) -> None:
         examples.append(ex)
 
+    example_generating_inner_function._hypothesis_internal_database_key = b""  # type: ignore
+
     if SCHEMATHESIS_BENCHMARK_SEED is not None:
         example_generating_inner_function = seed(SCHEMATHESIS_BENCHMARK_SEED)(example_generating_inner_function)