schemathesis 3.38.10__tar.gz → 3.39.1__tar.gz

{schemathesis-3.38.10 → schemathesis-3.39.1}/.pre-commit-config.yaml

@@ -38,12 +38,12 @@ repos:
         additional_dependencies: [types-click, types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.2
+    rev: v0.8.3
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.2
+    rev: v0.8.3
     hooks:
       - id: ruff
 

{schemathesis-3.38.10 → schemathesis-3.39.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: schemathesis
-Version: 3.38.10
+Version: 3.39.1
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://schemathesis.readthedocs.io/en/stable/changelog.html
@@ -9,7 +9,8 @@ Project-URL: Funding, https://github.com/sponsors/Stranger6667
 Project-URL: Source Code, https://github.com/schemathesis/schemathesis
 Author-email: Dmitry Dygalo <dmitry@dygalo.dev>
 Maintainer-email: Dmitry Dygalo <dmitry@dygalo.dev>
-License: MIT
+License-Expression: MIT
+License-File: LICENSE
 Keywords: graphql,hypothesis,openapi,pytest,testing
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console

{schemathesis-3.38.10 → schemathesis-3.39.1}/docs/changelog.rst

@@ -1,8 +1,35 @@
 Changelog
 =========
 
-:version:`Unreleased <v3.38.10...HEAD>` - TBD
----------------------------------------------
+:version:`Unreleased <v3.39.1...HEAD>` - TBD
+--------------------------------------------
+
+.. _v3.39.1:
+
+:version:`3.39.1 <v3.39.0...v3.39.1>` - 2024-12-17
+--------------------------------------------------
+
+**Fixed**
+
+- False positive in the ``ensure_resource_availability`` check.
+- XML serialization no longer produces duplicate attributes.
+
+.. _v3.39.0:
+
+:version:`3.39.0 <v3.38.10...v3.39.0>` - 2024-12-16
+---------------------------------------------------
+
+**Added**
+
+- ``--experimental-no-failfast`` CLI option to make Schemathesis continue testing an API operation after a failure is found.
+
+**Fixed**
+
+- Avoid writing unbounded prefixes in XML serialization.
+
+**Changed**
+
+- Escape XML entities instead of rejecting invalid ones.
 
 .. _v3.38.10:
 

{schemathesis-3.38.10 → schemathesis-3.39.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "3.38.10"
+version = "3.39.1"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-3.38.10 → schemathesis-3.39.1}/src/schemathesis/_xml.py

@@ -2,9 +2,10 @@
 
 from __future__ import annotations
 
+import re
 from io import StringIO
 from typing import Any, Dict, List, Union
-from xml.etree import ElementTree
+from unicodedata import normalize
 
 from .exceptions import UnboundPrefixError
 from .internal.copy import fast_deepcopy
@@ -32,24 +33,9 @@ def _to_xml(value: Any, raw_schema: dict[str, Any] | None, resolved_schema: dict
     namespace_stack: list[str] = []
     _write_xml(buffer, value, tag, resolved_schema, namespace_stack)
     data = buffer.getvalue()
-    if not is_valid_xml(data):
-        from hypothesis import reject
-
-        reject()
     return {"data": data.encode("utf8")}
 
 
-_from_string = ElementTree.fromstring
-
-
-def is_valid_xml(data: str) -> bool:
-    try:
-        _from_string(f"<root xmlns:smp='{NAMESPACE_URL}'>{data}</root>")
-        return True
-    except ElementTree.ParseError:
-        return False
-
-
 def _get_xml_tag(raw_schema: dict[str, Any] | None, resolved_schema: dict[str, Any] | None) -> str:
     # On the top level we need to detect the proper XML tag, in other cases it is known from object properties
     if (resolved_schema or {}).get("xml", {}).get("name"):
@@ -98,12 +84,15 @@ def _write_object(
 ) -> None:
     options = (schema or {}).get("xml", {})
     push_namespace_if_any(stack, options)
+    tag = _sanitize_xml_name(tag)
     if "prefix" in options:
         tag = f"{options['prefix']}:{tag}"
     buffer.write(f"<{tag}")
     if "namespace" in options:
         _write_namespace(buffer, options)
-    attributes = []
+
+    attribute_namespaces = {}
+    attributes = {}
     children_buffer = StringIO()
     properties = (schema or {}).get("properties", {})
     for child_name, value in obj.items():
@@ -111,18 +100,35 @@ def _write_object(
         child_options = property_schema.get("xml", {})
         push_namespace_if_any(stack, child_options)
         child_tag = child_options.get("name", child_name)
+
+        if child_options.get("attribute", False):
+            if child_options.get("prefix") and child_options.get("namespace"):
+                _validate_prefix(child_options, stack)
+                prefix = child_options["prefix"]
+                attr_name = f"{prefix}:{_sanitize_xml_name(child_tag)}"
+                # Store namespace declaration
+                attribute_namespaces[prefix] = child_options["namespace"]
+            else:
+                attr_name = _sanitize_xml_name(child_tag)
+
+            if attr_name not in attributes:  # Only keep first occurrence
+                attributes[attr_name] = f'{attr_name}="{_escape_xml(value)}"'
+            continue
+
+        child_tag = _sanitize_xml_name(child_tag)
         if child_options.get("prefix"):
             _validate_prefix(child_options, stack)
             prefix = child_options["prefix"]
             child_tag = f"{prefix}:{child_tag}"
-        if child_options.get("attribute", False):
-            attributes.append(f'{child_tag}="{value}"')
-            continue
         _write_xml(children_buffer, value, child_tag, property_schema, stack)
         pop_namespace_if_any(stack, child_options)
 
+    # Write namespace declarations for attributes
+    for prefix, namespace in attribute_namespaces.items():
+        buffer.write(f' xmlns:{prefix}="{namespace}"')
+
     if attributes:
-        buffer.write(f" {' '.join(attributes)}")
+        buffer.write(f" {' '.join(attributes.values())}")
     buffer.write(">")
     buffer.write(children_buffer.getvalue())
     buffer.write(f"</{tag}>")
@@ -169,7 +175,7 @@ def _write_primitive(
     buffer.write(f"<{tag}")
     if "namespace" in xml_options:
         _write_namespace(buffer, xml_options)
-    buffer.write(f">{obj}</{tag}>")
+    buffer.write(f">{_escape_xml(obj)}</{tag}>")
 
 
 def _write_namespace(buffer: StringIO, options: dict[str, Any]) -> None:
@@ -182,3 +188,48 @@ def _write_namespace(buffer: StringIO, options: dict[str, Any]) -> None:
 def _get_tag_name_from_reference(reference: str) -> str:
     """Extract object name from a reference."""
     return reference.rsplit("/", maxsplit=1)[1]
+
+
+def _escape_xml(value: JSON) -> str:
+    """Escape special characters in XML content."""
+    if isinstance(value, (int, float, bool)):
+        return str(value)
+    if value is None:
+        return ""
+
+    # Filter out invalid XML characters
+    cleaned = "".join(
+        char
+        for char in str(value)
+        if (
+            char in "\t\n\r"
+            or 0x20 <= ord(char) <= 0xD7FF
+            or 0xE000 <= ord(char) <= 0xFFFD
+            or 0x10000 <= ord(char) <= 0x10FFFF
+        )
+    )
+
+    replacements = {
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&apos;",
+    }
+    return "".join(replacements.get(c, c) for c in cleaned)
+
+
+def _sanitize_xml_name(name: str) -> str:
+    """Sanitize a string to be a valid XML element name."""
+    if not name:
+        return "element"
+
+    name = normalize("NFKC", str(name))
+
+    name = name.replace(":", "_")
+    sanitized = re.sub(r"[^a-zA-Z0-9_\-.]", "_", name)
+
+    if not sanitized[0].isalpha() and sanitized[0] != "_":
+        sanitized = "x_" + sanitized
+
+    return sanitized

{schemathesis-3.38.10 → schemathesis-3.39.1}/src/schemathesis/cli/__init__.py

@@ -323,6 +323,15 @@ REPORT_TO_SERVICE = ReportToService()
     multiple=True,
     metavar="",
 )
+@grouped_option(
+    "--experimental-no-failfast",
+    "no_failfast",
+    help="Continue testing an API operation after a failure is found",
+    is_flag=True,
+    default=False,
+    metavar="",
+    envvar="SCHEMATHESIS_EXPERIMENTAL_NO_FAILFAST",
+)
 @grouped_option(
     "--experimental-missing-required-header-allowed-statuses",
     "missing_required_header_allowed_statuses",
@@ -864,6 +873,7 @@ def run(
     set_cookie: dict[str, str],
     set_path: dict[str, str],
     experiments: list,
+    no_failfast: bool,
     missing_required_header_allowed_statuses: list[str],
     positive_data_acceptance_allowed_statuses: list[str],
     negative_data_rejection_allowed_statuses: list[str],
@@ -1232,6 +1242,7 @@ def run(
         request_timeout=request_timeout,
         seed=hypothesis_seed,
         exit_first=exit_first,
+        no_failfast=no_failfast,
         max_failures=max_failures,
         unique_data=contrib_unique_data,
         dry_run=dry_run,
@@ -1358,6 +1369,7 @@ def into_event_stream(
     output_config: OutputConfig,
     seed: int | None,
     exit_first: bool,
+    no_failfast: bool,
     max_failures: int | None,
     rate_limit: str | None,
     unique_data: bool,
@@ -1402,6 +1414,7 @@ def into_event_stream(
             request_cert=request_cert,
             seed=seed,
             exit_first=exit_first,
+            no_failfast=no_failfast,
             max_failures=max_failures,
             started_at=started_at,
             unique_data=unique_data,

{schemathesis-3.38.10 → schemathesis-3.39.1}/src/schemathesis/runner/__init__.py

@@ -346,6 +346,7 @@ def from_schema(
     request_cert: RequestCert | None = None,
     seed: int | None = None,
     exit_first: bool = False,
+    no_failfast: bool = False,
     max_failures: int | None = None,
     started_at: str | None = None,
     unique_data: bool = False,
@@ -406,6 +407,7 @@ def from_schema(
                 workers_num=workers_num,
                 request_config=request_config,
                 exit_first=exit_first,
+                no_failfast=no_failfast,
                 max_failures=max_failures,
                 started_at=started_at,
                 unique_data=unique_data,
@@ -433,6 +435,7 @@ def from_schema(
                 headers=headers,
                 seed=seed,
                 exit_first=exit_first,
+                no_failfast=no_failfast,
                 max_failures=max_failures,
                 started_at=started_at,
                 unique_data=unique_data,
@@ -460,6 +463,7 @@ def from_schema(
             seed=seed,
             workers_num=workers_num,
             exit_first=exit_first,
+            no_failfast=no_failfast,
             max_failures=max_failures,
             started_at=started_at,
             unique_data=unique_data,
@@ -488,6 +492,7 @@ def from_schema(
             seed=seed,
             request_config=request_config,
             exit_first=exit_first,
+            no_failfast=no_failfast,
             max_failures=max_failures,
             started_at=started_at,
             unique_data=unique_data,
@@ -515,6 +520,7 @@ def from_schema(
             headers=headers,
             seed=seed,
             exit_first=exit_first,
+            no_failfast=no_failfast,
             max_failures=max_failures,
             started_at=started_at,
             unique_data=unique_data,
@@ -541,6 +547,7 @@ def from_schema(
         headers=headers,
         seed=seed,
         exit_first=exit_first,
+        no_failfast=no_failfast,
         max_failures=max_failures,
         started_at=started_at,
         unique_data=unique_data,

{schemathesis-3.38.10 → schemathesis-3.39.1}/src/schemathesis/runner/impl/context.py

@@ -28,8 +28,19 @@ class RunnerContext:
     outcome_cache: dict[int, BaseException | None]
     checks_config: CheckConfig
     override: CaseOverride | None
-
-    __slots__ = ("data", "auth", "seed", "stop_event", "unique_data", "outcome_cache", "checks_config", "override")
+    no_failfast: bool
+
+    __slots__ = (
+        "data",
+        "auth",
+        "seed",
+        "stop_event",
+        "unique_data",
+        "outcome_cache",
+        "checks_config",
+        "override",
+        "no_failfast",
+    )
 
     def __init__(
         self,
@@ -40,6 +51,7 @@ class RunnerContext:
         unique_data: bool,
         checks_config: CheckConfig,
         override: CaseOverride | None,
+        no_failfast: bool,
     ) -> None:
         self.data = TestResultSet(seed=seed)
         self.auth = auth
@@ -49,6 +61,7 @@ class RunnerContext:
         self.unique_data = unique_data
         self.checks_config = checks_config
         self.override = override
+        self.no_failfast = no_failfast
 
     def _repr_pretty_(self, *args: Any, **kwargs: Any) -> None: ...
 

{schemathesis-3.38.10 → schemathesis-3.39.1}/src/schemathesis/runner/impl/core.py

@@ -111,6 +111,7 @@ class BaseRunner:
     store_interactions: bool = False
     seed: int | None = None
     exit_first: bool = False
+    no_failfast: bool = False
     max_failures: int | None = None
     started_at: str = field(default_factory=current_datetime)
     unique_data: bool = False
@@ -139,6 +140,7 @@ class BaseRunner:
             unique_data=self.unique_data,
             checks_config=self.checks_config,
             override=self.override,
+            no_failfast=self.no_failfast,
         )
         start_time = time.monotonic()
         initialized = None
@@ -672,6 +674,8 @@ def run_test(
             )
         else:
             result.add_error(error)
+    if status == Status.success and ctx.no_failfast and any(check.value == Status.failure for check in result.checks):
+        status = Status.failure
     if has_unsatisfied_example_mark(test):
         status = Status.error
         result.add_error(
@@ -811,6 +815,7 @@ def run_checks(
     response: GenericResponse,
     elapsed_time: float,
     max_response_time: int | None = None,
+    no_failfast: bool,
 ) -> None:
     errors = []
 
@@ -852,7 +857,7 @@ def run_checks(
         else:
             result.add_success("max_response_time", case, response, elapsed_time)
 
-    if errors:
+    if errors and not no_failfast:
         raise get_grouped_exception(case.operation.verbose_name, *errors)(causes=tuple(errors))
 
 
@@ -1042,6 +1047,7 @@ def _network_test(
             response=response,
             elapsed_time=context.response_time * 1000,
             max_response_time=max_response_time,
+            no_failfast=ctx.no_failfast,
         )
     except CheckFailed:
         status = Status.failure
@@ -1140,6 +1146,7 @@ def _wsgi_test(
             response=response,
             elapsed_time=context.response_time * 1000,
             max_response_time=max_response_time,
+            no_failfast=ctx.no_failfast,
         )
     except CheckFailed:
         status = Status.failure
@@ -1226,6 +1233,7 @@ def _asgi_test(
             response=response,
             elapsed_time=context.response_time * 1000,
             max_response_time=max_response_time,
+            no_failfast=ctx.no_failfast,
         )
     except CheckFailed:
         status = Status.failure

{schemathesis-3.38.10 → schemathesis-3.39.1}/src/schemathesis/specs/openapi/checks.py

@@ -366,6 +366,10 @@ def ensure_resource_availability(ctx: CheckContext, response: GenericResponse, o
         and original.source.case.operation.method.upper() == "POST"
         and 200 <= original.source.response.status_code < 400
         and original.source.overrides_all_parameters
+        and _is_prefix_operation(
+            ResourcePath(original.source.case.path, original.source.case.path_parameters or {}),
+            ResourcePath(original.path, original.path_parameters or {}),
+        )
     ):
         created_with = original.source.case.operation.verbose_name
         not_available_with = original.operation.verbose_name

{schemathesis-3.38.10 → schemathesis-3.39.1}/test/cli/__snapshots__/test_commands/test_run_output[args24].raw

@@ -24,6 +24,8 @@ Experimental options:
                                             schema-analysis, stateful-test-
                                             runner, stateful-only, coverage-
                                             phase, positive_data_acceptance]
+  --experimental-no-failfast                Continue testing an API operation
+                                            after a failure is found
   --experimental-missing-required-header-allowed-statuses 
                                             Comma-separated list of status codes
                                             expected for test cases with a

{schemathesis-3.38.10 → schemathesis-3.39.1}/test/cli/test_commands.py

@@ -313,6 +313,7 @@ def test_from_schema_arguments(cli, mocker, swagger_20, args, expected):
         "seed": None,
         "unique_data": False,
         "max_response_time": None,
+        "no_failfast": False,
         "generation_config": GenerationConfig(),
         "probe_config": ProbeConfig(auth_type="basic", headers={}, request=RequestConfig(timeout=10000)),
         "service_client": None,
@@ -693,6 +694,13 @@ def test_multiple_failures_single_check(cli, schema_url, snapshot_cli):
     assert cli.run(schema_url, "--hypothesis-seed=1", "--hypothesis-derandomize") == snapshot_cli
 
 
+@pytest.mark.operations("multiple_failures")
+@pytest.mark.openapi_version("3.0")
+def test_no_failfast(cli, schema_url):
+    result = cli.run(schema_url, "--experimental-no-failfast")
+    assert "/ 100 passed" in result.stdout
+
+
 @pytest.mark.operations("multiple_failures")
 @pytest.mark.snapshot(replace_statistic=True)
 def test_multiple_failures_different_check(cli, schema_url, snapshot_cli):

{schemathesis-3.38.10 → schemathesis-3.39.1}/test/cli/test_crashes.py

@@ -87,6 +87,7 @@ def csv_strategy(enum, exclude=()):
             "max-response-time": st.integers(min_value=1),
             "validate-schema": st.booleans(),
             "generation-with-security-parameters": st.booleans(),
+            "experimental-no-failfast": st.booleans(),
             "hypothesis-database": st.text(),
             "hypothesis-deadline": st.integers(min_value=1, max_value=300000) | st.none(),
             "hypothesis-max-examples": st.integers(min_value=1),

{schemathesis-3.38.10 → schemathesis-3.39.1}/test/runner/test_checks.py

@@ -614,6 +614,7 @@ def test_deduplication(ctx, response_factory):
             result=result,
             response=response,
             elapsed_time=0,
+            no_failfast=False,
         )
     # Then the resulting output should be deduplicated
     assert len(deduplicate_failures(failures)) == 1

{schemathesis-3.38.10 → schemathesis-3.39.1}/test/specs/openapi/stateful/conftest.py

@@ -265,10 +265,15 @@ def app_factory(ctx):
             return jsonify({"message": "User deleted successfully"}), 204
         return jsonify({"error": "User not found"}), 404
 
+    deleted_orders = set()
+
     @app.route("/orders/<order_id>", methods=["DELETE"])
     def delete_order(order_id):
         if config.slowdown:
             time.sleep(config.slowdown)
+        if order_id in deleted_orders:
+            return jsonify({"error": "Order not found"}), 404
+        deleted_orders.add(order_id)
         return jsonify({"message": "Nothing happened"}), 200
 
     @app.before_request

{schemathesis-3.38.10 → schemathesis-3.39.1}/test/test_serialization.py

@@ -293,7 +293,7 @@ def test_get_matching_serializers(media_type, expected):
         ),
         (
             "/prefixed-attribute",
-            b'<PrefixedAttribute smp:id="42"></PrefixedAttribute>',
+            b'<PrefixedAttribute xmlns:smp="http://example.com/schema" smp:id="42"></PrefixedAttribute>',
         ),
         (
             "/namespaced-object",
@@ -484,3 +484,41 @@ def test_xml_with_binary(ctx):
         assert case.as_transport_kwargs()["data"] == ""
 
     test()
+
+
+def test_duplicate_xml_attributes(ctx):
+    schema = ctx.openapi.build_schema(
+        {
+            "/test": {
+                "post": {
+                    "requestBody": {
+                        "content": {
+                            "application/xml": {
+                                "schema": {
+                                    "type": "object",
+                                    "properties": {
+                                        "prop1": {
+                                            "type": "integer",
+                                            "xml": {"namespace": "foo", "name": "attr", "attribute": True},
+                                        },
+                                        "prop2": {
+                                            "type": "integer",
+                                            "xml": {"namespace": "foo", "name": "attr", "attribute": True},
+                                        },
+                                    },
+                                }
+                            }
+                        },
+                        "required": True,
+                    },
+                    "responses": {"200": {"description": "OK"}},
+                }
+            }
+        }
+    )
+
+    schema = schemathesis.from_dict(schema)
+    case = schema["/test"]["POST"].make_case(body={"prop1": 1, "prop2": 2})
+
+    serialized_data = case.as_transport_kwargs()["data"].decode("utf8")
+    ElementTree.fromstring(serialized_data)