schemathesis 3.38.9__tar.gz → 3.39.0__tar.gz

{schemathesis-3.38.9 → schemathesis-3.39.0}/.pre-commit-config.yaml

@@ -38,12 +38,12 @@ repos:
         additional_dependencies: [types-click, types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.1
+    rev: v0.8.3
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.1
+    rev: v0.8.3
     hooks:
       - id: ruff
 

{schemathesis-3.38.9 → schemathesis-3.39.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: schemathesis
-Version: 3.38.9
+Version: 3.39.0
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://schemathesis.readthedocs.io/en/stable/changelog.html
@@ -9,7 +9,8 @@ Project-URL: Funding, https://github.com/sponsors/Stranger6667
 Project-URL: Source Code, https://github.com/schemathesis/schemathesis
 Author-email: Dmitry Dygalo <dmitry@dygalo.dev>
 Maintainer-email: Dmitry Dygalo <dmitry@dygalo.dev>
-License: MIT
+License-Expression: MIT
+License-File: LICENSE
 Keywords: graphql,hypothesis,openapi,pytest,testing
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console

{schemathesis-3.38.9 → schemathesis-3.39.0}/docs/changelog.rst

@@ -1,9 +1,35 @@
 Changelog
 =========
 
-:version:`Unreleased <v3.38.9...HEAD>` - TBD
+:version:`Unreleased <v3.39.0...HEAD>` - TBD
 --------------------------------------------
 
+.. _v3.39.0:
+
+:version:`3.39.0 <v3.38.10...v3.39.0>` - 2024-12-16
+---------------------------------------------------
+
+**Added**:
+
+- ``--experimental-no-failfast`` CLI option to make Schemathesis continue testing an API operation after a failure is found.
+
+**Fixed**:
+
+- Avoid writing unbounded prefixes in XML serialization.
+
+**Changed**:
+
+- Escape XML entities instead of rejecting invalid ones.
+
+.. _v3.38.10:
+
+:version:`3.38.10 <v3.38.9...v3.38.10>` - 2024-12-11
+----------------------------------------------------
+
+**Fixed**
+
+- Ignored request-related configuration inside the ``ignored_auth`` check. :issue:`2613`
+
 .. _v3.38.9:
 
 :version:`3.38.9 <v3.38.8...v3.38.9>` - 2024-12-02

{schemathesis-3.38.9 → schemathesis-3.39.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "3.38.9"
+version = "3.39.0"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-3.38.9 → schemathesis-3.39.0}/src/schemathesis/_xml.py

@@ -2,9 +2,10 @@
 
 from __future__ import annotations
 
+import re
 from io import StringIO
 from typing import Any, Dict, List, Union
-from xml.etree import ElementTree
+from unicodedata import normalize
 
 from .exceptions import UnboundPrefixError
 from .internal.copy import fast_deepcopy
@@ -32,24 +33,9 @@ def _to_xml(value: Any, raw_schema: dict[str, Any] | None, resolved_schema: dict
     namespace_stack: list[str] = []
     _write_xml(buffer, value, tag, resolved_schema, namespace_stack)
     data = buffer.getvalue()
-    if not is_valid_xml(data):
-        from hypothesis import reject
-
-        reject()
     return {"data": data.encode("utf8")}
 
 
-_from_string = ElementTree.fromstring
-
-
-def is_valid_xml(data: str) -> bool:
-    try:
-        _from_string(f"<root xmlns:smp='{NAMESPACE_URL}'>{data}</root>")
-        return True
-    except ElementTree.ParseError:
-        return False
-
-
 def _get_xml_tag(raw_schema: dict[str, Any] | None, resolved_schema: dict[str, Any] | None) -> str:
     # On the top level we need to detect the proper XML tag, in other cases it is known from object properties
     if (resolved_schema or {}).get("xml", {}).get("name"):
@@ -98,11 +84,14 @@ def _write_object(
 ) -> None:
     options = (schema or {}).get("xml", {})
     push_namespace_if_any(stack, options)
+    tag = _sanitize_xml_name(tag)
     if "prefix" in options:
         tag = f"{options['prefix']}:{tag}"
     buffer.write(f"<{tag}")
     if "namespace" in options:
         _write_namespace(buffer, options)
+
+    attribute_namespaces = {}
     attributes = []
     children_buffer = StringIO()
     properties = (schema or {}).get("properties", {})
@@ -111,16 +100,31 @@ def _write_object(
         child_options = property_schema.get("xml", {})
         push_namespace_if_any(stack, child_options)
         child_tag = child_options.get("name", child_name)
+
+        if child_options.get("attribute", False):
+            if child_options.get("prefix") and child_options.get("namespace"):
+                _validate_prefix(child_options, stack)
+                prefix = child_options["prefix"]
+                attr_name = f"{prefix}:{_sanitize_xml_name(child_tag)}"
+                # Store namespace declaration
+                attribute_namespaces[prefix] = child_options["namespace"]
+            else:
+                attr_name = _sanitize_xml_name(child_tag)
+            attributes.append(f'{attr_name}="{_escape_xml(value)}"')
+            continue
+
+        child_tag = _sanitize_xml_name(child_tag)
         if child_options.get("prefix"):
             _validate_prefix(child_options, stack)
             prefix = child_options["prefix"]
             child_tag = f"{prefix}:{child_tag}"
-        if child_options.get("attribute", False):
-            attributes.append(f'{child_tag}="{value}"')
-            continue
         _write_xml(children_buffer, value, child_tag, property_schema, stack)
         pop_namespace_if_any(stack, child_options)
 
+    # Write namespace declarations for attributes
+    for prefix, namespace in attribute_namespaces.items():
+        buffer.write(f' xmlns:{prefix}="{namespace}"')
+
     if attributes:
         buffer.write(f" {' '.join(attributes)}")
     buffer.write(">")
@@ -169,7 +173,7 @@ def _write_primitive(
     buffer.write(f"<{tag}")
     if "namespace" in xml_options:
         _write_namespace(buffer, xml_options)
-    buffer.write(f">{obj}</{tag}>")
+    buffer.write(f">{_escape_xml(obj)}</{tag}>")
 
 
 def _write_namespace(buffer: StringIO, options: dict[str, Any]) -> None:
@@ -182,3 +186,48 @@ def _write_namespace(buffer: StringIO, options: dict[str, Any]) -> None:
 def _get_tag_name_from_reference(reference: str) -> str:
     """Extract object name from a reference."""
     return reference.rsplit("/", maxsplit=1)[1]
+
+
+def _escape_xml(value: JSON) -> str:
+    """Escape special characters in XML content."""
+    if isinstance(value, (int, float, bool)):
+        return str(value)
+    if value is None:
+        return ""
+
+    # Filter out invalid XML characters
+    cleaned = "".join(
+        char
+        for char in str(value)
+        if (
+            char in "\t\n\r"
+            or 0x20 <= ord(char) <= 0xD7FF
+            or 0xE000 <= ord(char) <= 0xFFFD
+            or 0x10000 <= ord(char) <= 0x10FFFF
+        )
+    )
+
+    replacements = {
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&apos;",
+    }
+    return "".join(replacements.get(c, c) for c in cleaned)
+
+
+def _sanitize_xml_name(name: str) -> str:
+    """Sanitize a string to be a valid XML element name."""
+    if not name:
+        return "element"
+
+    name = normalize("NFKC", str(name))
+
+    name = name.replace(":", "_")
+    sanitized = re.sub(r"[^a-zA-Z0-9_\-.]", "_", name)
+
+    if not sanitized[0].isalpha() and sanitized[0] != "_":
+        sanitized = "x_" + sanitized
+
+    return sanitized

{schemathesis-3.38.9 → schemathesis-3.39.0}/src/schemathesis/cli/__init__.py

@@ -323,6 +323,15 @@ REPORT_TO_SERVICE = ReportToService()
     multiple=True,
     metavar="",
 )
+@grouped_option(
+    "--experimental-no-failfast",
+    "no_failfast",
+    help="Continue testing an API operation after a failure is found",
+    is_flag=True,
+    default=False,
+    metavar="",
+    envvar="SCHEMATHESIS_EXPERIMENTAL_NO_FAILFAST",
+)
 @grouped_option(
     "--experimental-missing-required-header-allowed-statuses",
     "missing_required_header_allowed_statuses",
@@ -864,6 +873,7 @@ def run(
     set_cookie: dict[str, str],
     set_path: dict[str, str],
     experiments: list,
+    no_failfast: bool,
     missing_required_header_allowed_statuses: list[str],
     positive_data_acceptance_allowed_statuses: list[str],
     negative_data_rejection_allowed_statuses: list[str],
@@ -1232,6 +1242,7 @@ def run(
         request_timeout=request_timeout,
         seed=hypothesis_seed,
         exit_first=exit_first,
+        no_failfast=no_failfast,
         max_failures=max_failures,
         unique_data=contrib_unique_data,
         dry_run=dry_run,
@@ -1358,6 +1369,7 @@ def into_event_stream(
     output_config: OutputConfig,
     seed: int | None,
     exit_first: bool,
+    no_failfast: bool,
     max_failures: int | None,
     rate_limit: str | None,
     unique_data: bool,
@@ -1402,6 +1414,7 @@ def into_event_stream(
             request_cert=request_cert,
             seed=seed,
             exit_first=exit_first,
+            no_failfast=no_failfast,
             max_failures=max_failures,
             started_at=started_at,
             unique_data=unique_data,

{schemathesis-3.38.9 → schemathesis-3.39.0}/src/schemathesis/internal/checks.py

@@ -52,6 +52,7 @@ class CheckContext:
     auth: HTTPDigestAuth | RawAuth | None
     headers: CaseInsensitiveDict | None
     config: CheckConfig = field(default_factory=CheckConfig)
+    transport_kwargs: dict | None = None
 
 
 def wrap_check(check: Callable) -> CheckFunction:

{schemathesis-3.38.9 → schemathesis-3.39.0}/src/schemathesis/models.py

@@ -474,6 +474,7 @@ class Case:
         excluded_checks: tuple[CheckFunction, ...] = (),
         code_sample_style: str | None = None,
         headers: dict[str, Any] | None = None,
+        transport_kwargs: dict[str, Any] | None = None,
     ) -> None:
         """Validate application response.
 
@@ -507,7 +508,10 @@ class Case:
         additional_checks = tuple(check for check in _additional_checks if check not in excluded_checks)
         failed_checks = []
         ctx = CheckContext(
-            override=self._override, auth=None, headers=CaseInsensitiveDict(headers) if headers else None
+            override=self._override,
+            auth=None,
+            headers=CaseInsensitiveDict(headers) if headers else None,
+            transport_kwargs=transport_kwargs,
         )
         for check in chain(checks, additional_checks):
             copied_case = self.partial_deepcopy()
@@ -591,6 +595,7 @@ class Case:
             headers=headers,
             additional_checks=additional_checks,
             excluded_checks=excluded_checks,
+            transport_kwargs=kwargs,
         )
         return response
 

{schemathesis-3.38.9 → schemathesis-3.39.0}/src/schemathesis/runner/__init__.py

@@ -346,6 +346,7 @@ def from_schema(
     request_cert: RequestCert | None = None,
     seed: int | None = None,
     exit_first: bool = False,
+    no_failfast: bool = False,
     max_failures: int | None = None,
     started_at: str | None = None,
     unique_data: bool = False,
@@ -406,6 +407,7 @@ def from_schema(
                 workers_num=workers_num,
                 request_config=request_config,
                 exit_first=exit_first,
+                no_failfast=no_failfast,
                 max_failures=max_failures,
                 started_at=started_at,
                 unique_data=unique_data,
@@ -433,6 +435,7 @@ def from_schema(
                 headers=headers,
                 seed=seed,
                 exit_first=exit_first,
+                no_failfast=no_failfast,
                 max_failures=max_failures,
                 started_at=started_at,
                 unique_data=unique_data,
@@ -460,6 +463,7 @@ def from_schema(
             seed=seed,
             workers_num=workers_num,
             exit_first=exit_first,
+            no_failfast=no_failfast,
             max_failures=max_failures,
             started_at=started_at,
             unique_data=unique_data,
@@ -488,6 +492,7 @@ def from_schema(
             seed=seed,
             request_config=request_config,
             exit_first=exit_first,
+            no_failfast=no_failfast,
             max_failures=max_failures,
             started_at=started_at,
             unique_data=unique_data,
@@ -515,6 +520,7 @@ def from_schema(
             headers=headers,
             seed=seed,
             exit_first=exit_first,
+            no_failfast=no_failfast,
             max_failures=max_failures,
             started_at=started_at,
             unique_data=unique_data,
@@ -541,6 +547,7 @@ def from_schema(
         headers=headers,
         seed=seed,
         exit_first=exit_first,
+        no_failfast=no_failfast,
         max_failures=max_failures,
         started_at=started_at,
         unique_data=unique_data,

{schemathesis-3.38.9 → schemathesis-3.39.0}/src/schemathesis/runner/impl/context.py

@@ -28,8 +28,19 @@ class RunnerContext:
     outcome_cache: dict[int, BaseException | None]
     checks_config: CheckConfig
     override: CaseOverride | None
-
-    __slots__ = ("data", "auth", "seed", "stop_event", "unique_data", "outcome_cache", "checks_config", "override")
+    no_failfast: bool
+
+    __slots__ = (
+        "data",
+        "auth",
+        "seed",
+        "stop_event",
+        "unique_data",
+        "outcome_cache",
+        "checks_config",
+        "override",
+        "no_failfast",
+    )
 
     def __init__(
         self,
@@ -40,6 +51,7 @@ class RunnerContext:
         unique_data: bool,
         checks_config: CheckConfig,
         override: CaseOverride | None,
+        no_failfast: bool,
     ) -> None:
         self.data = TestResultSet(seed=seed)
         self.auth = auth
@@ -49,6 +61,7 @@ class RunnerContext:
         self.unique_data = unique_data
         self.checks_config = checks_config
         self.override = override
+        self.no_failfast = no_failfast
 
     def _repr_pretty_(self, *args: Any, **kwargs: Any) -> None: ...
 

{schemathesis-3.38.9 → schemathesis-3.39.0}/src/schemathesis/runner/impl/core.py

@@ -111,6 +111,7 @@ class BaseRunner:
     store_interactions: bool = False
     seed: int | None = None
     exit_first: bool = False
+    no_failfast: bool = False
     max_failures: int | None = None
     started_at: str = field(default_factory=current_datetime)
     unique_data: bool = False
@@ -139,6 +140,7 @@ class BaseRunner:
             unique_data=self.unique_data,
             checks_config=self.checks_config,
             override=self.override,
+            no_failfast=self.no_failfast,
         )
         start_time = time.monotonic()
         initialized = None
@@ -672,6 +674,8 @@ def run_test(
             )
         else:
             result.add_error(error)
+    if status == Status.success and ctx.no_failfast and any(check.value == Status.failure for check in result.checks):
+        status = Status.failure
     if has_unsatisfied_example_mark(test):
         status = Status.error
         result.add_error(
@@ -811,6 +815,7 @@ def run_checks(
     response: GenericResponse,
     elapsed_time: float,
     max_response_time: int | None = None,
+    no_failfast: bool,
 ) -> None:
     errors = []
 
@@ -852,7 +857,7 @@ def run_checks(
         else:
             result.add_success("max_response_time", case, response, elapsed_time)
 
-    if errors:
+    if errors and not no_failfast:
         raise get_grouped_exception(case.operation.verbose_name, *errors)(causes=tuple(errors))
 
 
@@ -994,18 +999,18 @@ def _network_test(
     max_response_time: int | None,
 ) -> requests.Response:
     check_results: list[Check] = []
+    hook_context = HookContext(operation=case.operation)
+    kwargs: dict[str, Any] = {
+        "session": session,
+        "headers": headers,
+        "timeout": request_config.prepared_timeout,
+        "verify": request_config.tls_verify,
+        "cert": request_config.cert,
+    }
+    if request_config.proxy is not None:
+        kwargs["proxies"] = {"all": request_config.proxy}
+    hooks.dispatch("process_call_kwargs", hook_context, case, kwargs)
     try:
-        hook_context = HookContext(operation=case.operation)
-        kwargs: dict[str, Any] = {
-            "session": session,
-            "headers": headers,
-            "timeout": request_config.prepared_timeout,
-            "verify": request_config.tls_verify,
-            "cert": request_config.cert,
-        }
-        if request_config.proxy is not None:
-            kwargs["proxies"] = {"all": request_config.proxy}
-        hooks.dispatch("process_call_kwargs", hook_context, case, kwargs)
         response = case.call(**kwargs)
     except CheckFailed as exc:
         check_name = "request_timeout"
@@ -1030,6 +1035,7 @@ def _network_test(
         auth=ctx.auth,
         headers=CaseInsensitiveDict(headers) if headers else None,
         config=ctx.checks_config,
+        transport_kwargs=kwargs,
     )
     try:
         run_checks(
@@ -1041,6 +1047,7 @@ def _network_test(
             response=response,
             elapsed_time=context.response_time * 1000,
             max_response_time=max_response_time,
+            no_failfast=ctx.no_failfast,
         )
     except CheckFailed:
         status = Status.failure
@@ -1127,6 +1134,7 @@ def _wsgi_test(
         auth=ctx.auth,
         headers=CaseInsensitiveDict(headers) if headers else None,
         config=ctx.checks_config,
+        transport_kwargs=kwargs,
     )
     try:
         run_checks(
@@ -1138,6 +1146,7 @@ def _wsgi_test(
             response=response,
             elapsed_time=context.response_time * 1000,
             max_response_time=max_response_time,
+            no_failfast=ctx.no_failfast,
         )
     except CheckFailed:
         status = Status.failure
@@ -1212,6 +1221,7 @@ def _asgi_test(
         auth=ctx.auth,
         headers=CaseInsensitiveDict(headers) if headers else None,
         config=ctx.checks_config,
+        transport_kwargs=kwargs,
     )
     try:
         run_checks(
@@ -1223,6 +1233,7 @@ def _asgi_test(
             response=response,
             elapsed_time=context.response_time * 1000,
             max_response_time=max_response_time,
+            no_failfast=ctx.no_failfast,
         )
     except CheckFailed:
         status = Status.failure

{schemathesis-3.38.9 → schemathesis-3.39.0}/src/schemathesis/specs/graphql/schemas.py

@@ -83,11 +83,14 @@ class GraphQLCase(Case):
         excluded_checks: tuple[CheckFunction, ...] = (),
         code_sample_style: str | None = None,
         headers: dict[str, Any] | None = None,
+        transport_kwargs: dict[str, Any] | None = None,
     ) -> None:
         checks = checks or (not_a_server_error,)
         checks += additional_checks
         checks = tuple(check for check in checks if check not in excluded_checks)
-        return super().validate_response(response, checks, code_sample_style=code_sample_style, headers=headers)
+        return super().validate_response(
+            response, checks, code_sample_style=code_sample_style, headers=headers, transport_kwargs=transport_kwargs
+        )
 
 
 C = TypeVar("C", bound=Case)

{schemathesis-3.38.9 → schemathesis-3.39.0}/src/schemathesis/specs/openapi/checks.py

@@ -404,14 +404,21 @@ def ignored_auth(ctx: CheckContext, response: GenericResponse, case: Case) -> bo
             # Auth is explicitly set, it is expected to be valid
             # Check if invalid auth will give an error
             _remove_auth_from_case(case, security_parameters)
-            new_response = case.operation.schema.transport.send(case)
+            kwargs = ctx.transport_kwargs or {}
+            kwargs.copy()
+            if "headers" in kwargs:
+                headers = kwargs["headers"].copy()
+                _remove_auth_from_explicit_headers(headers, security_parameters)
+                kwargs["headers"] = headers
+            kwargs.pop("session", None)
+            new_response = case.operation.schema.transport.send(case, **kwargs)
             if new_response.status_code != 401:
                 _update_response(response, new_response)
                 _raise_no_auth_error(new_response, case.operation.verbose_name, "that requires authentication")
             # Try to set invalid auth and check if it succeeds
             for parameter in security_parameters:
                 _set_auth_for_case(case, parameter)
-                new_response = case.operation.schema.transport.send(case)
+                new_response = case.operation.schema.transport.send(case, **kwargs)
                 if new_response.status_code != 401:
                     _update_response(response, new_response)
                     _raise_no_auth_error(new_response, case.operation.verbose_name, "with any auth")
@@ -526,6 +533,13 @@ def _remove_auth_from_case(case: Case, security_parameters: list[SecurityParamet
             case.cookies.pop(name, None)
 
 
+def _remove_auth_from_explicit_headers(headers: dict, security_parameters: list[SecurityParameter]) -> None:
+    for parameter in security_parameters:
+        name = parameter["name"]
+        if parameter["in"] == "header":
+            headers.pop(name, None)
+
+
 def _set_auth_for_case(case: Case, parameter: SecurityParameter) -> None:
     name = parameter["name"]
     for location, attr_name in (

{schemathesis-3.38.9 → schemathesis-3.39.0}/test/cli/__snapshots__/test_commands/test_run_output[args24].raw

@@ -24,6 +24,8 @@ Experimental options:
                                             schema-analysis, stateful-test-
                                             runner, stateful-only, coverage-
                                             phase, positive_data_acceptance]
+  --experimental-no-failfast                Continue testing an API operation
+                                            after a failure is found
   --experimental-missing-required-header-allowed-statuses 
                                             Comma-separated list of status codes
                                             expected for test cases with a

{schemathesis-3.38.9 → schemathesis-3.39.0}/test/cli/test_commands.py

@@ -313,6 +313,7 @@ def test_from_schema_arguments(cli, mocker, swagger_20, args, expected):
         "seed": None,
         "unique_data": False,
         "max_response_time": None,
+        "no_failfast": False,
         "generation_config": GenerationConfig(),
         "probe_config": ProbeConfig(auth_type="basic", headers={}, request=RequestConfig(timeout=10000)),
         "service_client": None,
@@ -693,6 +694,13 @@ def test_multiple_failures_single_check(cli, schema_url, snapshot_cli):
     assert cli.run(schema_url, "--hypothesis-seed=1", "--hypothesis-derandomize") == snapshot_cli
 
 
+@pytest.mark.operations("multiple_failures")
+@pytest.mark.openapi_version("3.0")
+def test_no_failfast(cli, schema_url):
+    result = cli.run(schema_url, "--experimental-no-failfast")
+    assert "/ 100 passed" in result.stdout
+
+
 @pytest.mark.operations("multiple_failures")
 @pytest.mark.snapshot(replace_statistic=True)
 def test_multiple_failures_different_check(cli, schema_url, snapshot_cli):

{schemathesis-3.38.9 → schemathesis-3.39.0}/test/cli/test_crashes.py

@@ -87,6 +87,7 @@ def csv_strategy(enum, exclude=()):
             "max-response-time": st.integers(min_value=1),
             "validate-schema": st.booleans(),
             "generation-with-security-parameters": st.booleans(),
+            "experimental-no-failfast": st.booleans(),
             "hypothesis-database": st.text(),
             "hypothesis-deadline": st.integers(min_value=1, max_value=300000) | st.none(),
             "hypothesis-max-examples": st.integers(min_value=1),

{schemathesis-3.38.9 → schemathesis-3.39.0}/test/runner/test_checks.py

@@ -614,6 +614,7 @@ def test_deduplication(ctx, response_factory):
             result=result,
             response=response,
             elapsed_time=0,
+            no_failfast=False,
         )
     # Then the resulting output should be deduplicated
     assert len(deduplicate_failures(failures)) == 1