schemathesis 4.0.12__tar.gz → 4.0.14__tar.gz

{schemathesis-4.0.12 → schemathesis-4.0.14}/CHANGELOG.md

@@ -1,6 +1,20 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.12...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.14...HEAD) - TBD
+
+## [4.0.14](https://github.com/schemathesis/schemathesis/compare/v4.0.13...v4.0.14) - 2025-07-25
+
+### :bug: Fixed
+
+- Negative test cases with invalid parameters mistakenly becoming positive test cases. [#2900](https://github.com/schemathesis/schemathesis/issues/2900), [#2913](https://github.com/schemathesis/schemathesis/issues/2913)
+- **CLI**: Avoid overriding config options with CLI default values. The CLI options have higher precedence only if explicitly specified.
+- **CLI**: Gracefully handle non-existing config file for the `--config-file` CLI option.
+
+## [4.0.13](https://github.com/schemathesis/schemathesis/compare/v4.0.12...v4.0.13) - 2025-07-24
+
+### :bug: Fixed
+
+- Honor filters defined via a config file in `pytest` integration.
 
 ## [4.0.12](https://github.com/schemathesis/schemathesis/compare/v4.0.11...v4.0.12) - 2025-07-21
 

{schemathesis-4.0.12 → schemathesis-4.0.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.0.12
+Version: 4.0.14
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.0.12 → schemathesis-4.0.14}/benches/coverage_phase.py

@@ -1,12 +1,17 @@
 """Benchmarks for the coverage phase."""
 
 import pytest
+from jsonschema import Draft202012Validator
 
 from schemathesis.generation.coverage import CoverageContext, cover_schema_iter
 
 CONTEXTS = [
-    CoverageContext(location="body", is_required=True, custom_formats={}).with_positive(),
-    CoverageContext(location="body", is_required=True, custom_formats={}).with_negative(),
+    CoverageContext(
+        location="body", is_required=True, custom_formats={}, validator_cls=Draft202012Validator
+    ).with_positive(),
+    CoverageContext(
+        location="body", is_required=True, custom_formats={}, validator_cls=Draft202012Validator
+    ).with_negative(),
 ]
 CONTEXT_NAMES = [",".join([m.value for m in ctx.generation_modes]) for ctx in CONTEXTS]
 

{schemathesis-4.0.12 → schemathesis-4.0.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.0.12"
+version = "4.0.14"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.0.12 → schemathesis-4.0.14}/src/schemathesis/cli/commands/__init__.py

@@ -36,6 +36,15 @@ def schemathesis(ctx: click.Context, config_file: str | None) -> None:
             config = SchemathesisConfig.from_path(config_file)
         else:
             config = SchemathesisConfig.discover()
+    except FileNotFoundError:
+        display_header(SCHEMATHESIS_VERSION)
+        click.secho(
+            f"❌  Failed to load configuration file from {config_file}",
+            fg="red",
+            bold=True,
+        )
+        click.echo("\nThe configuration file does not exist")
+        ctx.exit(1)
     except (TOMLDecodeError, ConfigError) as exc:
         display_header(SCHEMATHESIS_VERSION)
         click.secho(

{schemathesis-4.0.12 → schemathesis-4.0.14}/src/schemathesis/cli/commands/run/__init__.py

@@ -9,7 +9,7 @@ from click.utils import LazyFile
 from schemathesis.checks import CHECKS, load_all_checks
 from schemathesis.cli.commands.run import executor, validation
 from schemathesis.cli.commands.run.filters import with_filters
-from schemathesis.cli.constants import DEFAULT_WORKERS, MAX_WORKERS, MIN_WORKERS
+from schemathesis.cli.constants import MAX_WORKERS, MIN_WORKERS
 from schemathesis.cli.core import ensure_color
 from schemathesis.cli.ext.groups import group, grouped_option
 from schemathesis.cli.ext.options import (
@@ -62,7 +62,7 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
         ["auto", *list(map(str, range(MIN_WORKERS, MAX_WORKERS + 1)))],
         choices_repr=f"[auto, {MIN_WORKERS}-{MAX_WORKERS}]",
     ),
-    default=str(DEFAULT_WORKERS),
+    default=None,
     show_default=True,
     callback=validation.convert_workers,
     metavar="",
@@ -172,7 +172,7 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
     help="Skip deprecated operations",
     is_flag=True,
     is_eager=True,
-    default=False,
+    default=None,
     show_default=True,
 )
 @group("Network requests options")
@@ -206,7 +206,7 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
     "request_tls_verify",
     help="Path to CA bundle for TLS verification, or 'false' to disable",
     type=str,
-    default="true",
+    default=None,
     show_default=True,
     callback=validation.convert_boolean_string,
 )
@@ -280,13 +280,13 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
     help="Retain exact byte sequence of payloads in cassettes, encoded as base64",
     type=bool,
     is_flag=True,
-    default=False,
+    default=None,
     callback=validation.validate_preserve_bytes,
 )
 @grouped_option(
     "--output-sanitize",
     type=str,
-    default="true",
+    default=None,
     show_default=True,
     help="Enable or disable automatic output sanitization to obscure sensitive data",
     metavar="BOOLEAN",
@@ -296,7 +296,7 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
     "--output-truncate",
     help="Truncate schemas and responses in error messages",
     type=str,
-    default="true",
+    default=None,
     show_default=True,
     metavar="BOOLEAN",
     callback=validation.convert_boolean_string,
@@ -331,20 +331,21 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
     "generation_no_shrink",
     help="Disable test case shrinking. Makes test failures harder to debug but improves performance",
     is_flag=True,
+    default=None,
 )
 @grouped_option(
     "--generation-deterministic",
     help="Enables deterministic mode, which eliminates random variation between tests",
     is_flag=True,
     is_eager=True,
-    default=False,
+    default=None,
     show_default=True,
 )
 @grouped_option(
     "--generation-allow-x00",
     help="Whether to allow the generation of 'NULL' bytes within strings",
     type=str,
-    default="true",
+    default=None,
     show_default=True,
     metavar="BOOLEAN",
     callback=validation.convert_boolean_string,
@@ -353,7 +354,7 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
     "--generation-codec",
     help="The codec used for generating strings",
     type=str,
-    default="utf-8",
+    default=None,
     callback=validation.validate_generation_codec,
 )
 @grouped_option(
@@ -371,7 +372,7 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
     "--generation-with-security-parameters",
     help="Whether to generate security parameters",
     type=str,
-    default="true",
+    default=None,
     show_default=True,
     callback=validation.convert_boolean_string,
     metavar="BOOLEAN",
@@ -380,7 +381,7 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
     "--generation-graphql-allow-null",
     help="Whether to use `null` values for optional arguments in GraphQL queries",
     type=str,
-    default="true",
+    default=None,
     show_default=True,
     callback=validation.convert_boolean_string,
     metavar="BOOLEAN",
@@ -398,7 +399,7 @@ DEFAULT_PHASES = ["examples", "coverage", "fuzzing", "stateful"]
     "generation_unique_inputs",
     help="Force the generation of unique test cases",
     is_flag=True,
-    default=False,
+    default=None,
     show_default=True,
     metavar="BOOLEAN",
 )
@@ -440,15 +441,15 @@ def run(
     exclude_operation_id_regex: str | None,
     include_by: Callable | None = None,
     exclude_by: Callable | None = None,
-    exclude_deprecated: bool = False,
-    workers: int = DEFAULT_WORKERS,
+    exclude_deprecated: bool | None = None,
+    workers: int | None = None,
     base_url: str | None,
     wait_for_schema: float | None = None,
     suppress_health_check: list[HealthCheck] | None,
     warnings: bool | list[SchemathesisWarning] | None,
     rate_limit: str | None = None,
     request_timeout: int | None = None,
-    request_tls_verify: bool = True,
+    request_tls_verify: bool | None = None,
     request_cert: str | None = None,
     request_cert_key: str | None = None,
     request_proxy: str | None = None,
@@ -457,21 +458,21 @@ def run(
     report_junit_path: LazyFile | None = None,
     report_vcr_path: LazyFile | None = None,
     report_har_path: LazyFile | None = None,
-    report_preserve_bytes: bool = False,
-    output_sanitize: bool = True,
-    output_truncate: bool = True,
+    report_preserve_bytes: bool | None = None,
+    output_sanitize: bool | None = None,
+    output_truncate: bool | None = None,
     generation_modes: list[GenerationMode],
     generation_seed: int | None = None,
     generation_max_examples: int | None = None,
     generation_maximize: list[MetricFunction] | None,
-    generation_deterministic: bool = False,
+    generation_deterministic: bool | None = None,
     generation_database: str | None = None,
-    generation_unique_inputs: bool = False,
-    generation_allow_x00: bool = True,
-    generation_graphql_allow_null: bool = True,
-    generation_with_security_parameters: bool = True,
-    generation_codec: str = "utf-8",
-    generation_no_shrink: bool = False,
+    generation_unique_inputs: bool | None = None,
+    generation_allow_x00: bool | None = None,
+    generation_graphql_allow_null: bool | None = None,
+    generation_with_security_parameters: bool | None = None,
+    generation_codec: str | None = None,
+    generation_no_shrink: bool | None = None,
     force_color: bool = False,
     no_color: bool = False,
     **__kwargs: Any,

{schemathesis-4.0.12 → schemathesis-4.0.14}/src/schemathesis/cli/commands/run/validation.py

@@ -73,7 +73,11 @@ def validate_base_url(ctx: click.core.Context, param: click.core.Parameter, raw_
     return raw_value
 
 
-def validate_generation_codec(ctx: click.core.Context, param: click.core.Parameter, raw_value: str) -> str:
+def validate_generation_codec(
+    ctx: click.core.Context, param: click.core.Parameter, raw_value: str | None
+) -> str | None:
+    if raw_value is None:
+        return raw_value
     try:
         codecs.getencoder(raw_value)
     except LookupError as exc:
@@ -214,7 +218,11 @@ def convert_generation_mode(ctx: click.core.Context, param: click.core.Parameter
     return [GenerationMode(value)]
 
 
-def convert_boolean_string(ctx: click.core.Context, param: click.core.Parameter, value: str) -> str | bool:
+def convert_boolean_string(
+    ctx: click.core.Context, param: click.core.Parameter, value: str | None
+) -> str | bool | None:
+    if value is None:
+        return value
     return string_to_boolean(value)
 
 
@@ -226,7 +234,9 @@ def reraise_format_error(raw_value: str) -> Generator[None, None, None]:
         raise click.BadParameter(f"Expected KEY:VALUE format, received {raw_value}.") from exc
 
 
-def convert_workers(ctx: click.core.Context, param: click.core.Parameter, value: str) -> int:
+def convert_workers(ctx: click.core.Context, param: click.core.Parameter, value: str | None) -> int | None:
+    if value is None:
+        return value
     if value == "auto":
         return get_workers_count()
     return int(value)

{schemathesis-4.0.12 → schemathesis-4.0.14}/src/schemathesis/config/_generation.py

@@ -105,34 +105,34 @@ class GenerationConfig(DiffBase):
         *,
         modes: list[GenerationMode] | None = None,
         max_examples: int | None = None,
-        no_shrink: bool = False,
+        no_shrink: bool | None = None,
         deterministic: bool | None = None,
-        allow_x00: bool = True,
+        allow_x00: bool | None = None,
         codec: str | None = None,
         maximize: list[MetricFunction] | None = None,
         with_security_parameters: bool | None = None,
-        graphql_allow_null: bool = True,
+        graphql_allow_null: bool | None = None,
         database: str | None = None,
-        unique_inputs: bool = False,
+        unique_inputs: bool | None = None,
         exclude_header_characters: str | None = None,
     ) -> None:
         if modes is not None:
             self.modes = modes
         if max_examples is not None:
             self.max_examples = max_examples
-        self.no_shrink = no_shrink
+        self.no_shrink = no_shrink or False
         self.deterministic = deterministic or False
-        self.allow_x00 = allow_x00
+        self.allow_x00 = allow_x00 if allow_x00 is not None else True
         if codec is not None:
             self.codec = codec
         if maximize is not None:
             self.maximize = maximize
         if with_security_parameters is not None:
             self.with_security_parameters = with_security_parameters
-        self.graphql_allow_null = graphql_allow_null
+        self.graphql_allow_null = graphql_allow_null if graphql_allow_null is not None else True
         if database is not None:
             self.database = database
-        self.unique_inputs = unique_inputs
+        self.unique_inputs = unique_inputs or False
         if exclude_header_characters is not None:
             self.exclude_header_characters = exclude_header_characters
 

{schemathesis-4.0.12 → schemathesis-4.0.14}/src/schemathesis/config/_operations.py

@@ -159,9 +159,15 @@ class OperationsConfig(DiffBase):
         if exclude_deprecated:
             exclude_set.include(is_deprecated)
 
+        return self.filter_set_with(include=include_set, exclude=exclude_set)
+
+    def filter_set_with(self, include: FilterSet, exclude: FilterSet | None = None) -> FilterSet:
+        if not self.operations and exclude is None:
+            return include
         operations = list(self.operations)
 
         final = FilterSet()
+        exclude = exclude or FilterSet()
 
         def priority_filter(ctx: HasAPIOperation) -> bool:
             """Filter operations according to CLI and config priority."""
@@ -169,12 +175,12 @@ class OperationsConfig(DiffBase):
                 if op_config._filter_set.match(ctx) and not op_config.enabled:
                     return False
 
-            if not include_set.is_empty():
-                if exclude_set.is_empty():
-                    return include_set.match(ctx)
-                return include_set.match(ctx) and not exclude_set.match(ctx)
-            elif not exclude_set.is_empty():
-                return not exclude_set.match(ctx)
+            if not include.is_empty():
+                if exclude.is_empty():
+                    return include.match(ctx)
+                return include.match(ctx) and not exclude.match(ctx)
+            elif not exclude.is_empty():
+                return not exclude.match(ctx)
 
             return True
 

{schemathesis-4.0.12 → schemathesis-4.0.14}/src/schemathesis/config/_projects.py

@@ -98,7 +98,7 @@ class ProjectConfig(DiffBase):
         workers: int | Literal["auto"] = DEFAULT_WORKERS,
         proxy: str | None = None,
         continue_on_failure: bool | None = None,
-        tls_verify: bool | str | None = None,
+        tls_verify: bool | str = True,
         rate_limit: str | None = None,
         request_timeout: float | int | None = None,
         request_cert: str | None = None,
@@ -155,7 +155,7 @@ class ProjectConfig(DiffBase):
             workers=data.get("workers", DEFAULT_WORKERS),
             proxy=resolve(data.get("proxy")),
             continue_on_failure=data.get("continue-on-failure", None),
-            tls_verify=resolve(data.get("tls-verify")),
+            tls_verify=resolve(data.get("tls-verify", True)),
             rate_limit=resolve(data.get("rate-limit")),
             request_timeout=data.get("request-timeout"),
             request_cert=resolve(data.get("request-cert")),

{schemathesis-4.0.12 → schemathesis-4.0.14}/src/schemathesis/config/_report.py

@@ -94,7 +94,7 @@ class ReportsConfig(DiffBase):
         vcr_path: str | None = None,
         har_path: str | None = None,
         directory: Path = DEFAULT_REPORT_DIRECTORY,
-        preserve_bytes: bool = False,
+        preserve_bytes: bool | None = None,
     ) -> None:
         formats = formats or []
         if junit_path is not None or ReportFormat.JUNIT in formats:

{schemathesis-4.0.12 → schemathesis-4.0.14}/src/schemathesis/generation/coverage.py

@@ -8,8 +8,9 @@ from functools import lru_cache, partial
 from itertools import combinations
 from json.encoder import _make_iterencode, c_make_encoder, encode_basestring_ascii  # type: ignore
 from typing import Any, Callable, Generator, Iterator, TypeVar, cast
+from urllib.parse import quote_plus
 
-import jsonschema
+import jsonschema.protocols
 from hypothesis import strategies as st
 from hypothesis.errors import InvalidArgument, Unsatisfiable
 from hypothesis_jsonschema import from_schema
@@ -19,7 +20,7 @@ from hypothesis_jsonschema._from_schema import STRING_FORMATS as BUILT_IN_STRING
 from schemathesis.core import INTERNAL_BUFFER_SIZE, NOT_SET
 from schemathesis.core.compat import RefResolutionError
 from schemathesis.core.transforms import deepclone
-from schemathesis.core.validation import has_invalid_characters, is_latin_1_encodable
+from schemathesis.core.validation import contains_unicode_surrogate_pair, has_invalid_characters, is_latin_1_encodable
 from schemathesis.generation import GenerationMode
 from schemathesis.generation.hypothesis import examples
 from schemathesis.openapi.generation.filters import is_invalid_path_parameter
@@ -34,7 +35,7 @@ def _replace_zero_with_nonzero(x: float) -> float:
 
 
 def json_recursive_strategy(strategy: st.SearchStrategy) -> st.SearchStrategy:
-    return st.lists(strategy, max_size=3) | st.dictionaries(st.text(), strategy, max_size=3)
+    return st.lists(strategy, max_size=2) | st.dictionaries(st.text(), strategy, max_size=2)
 
 
 NEGATIVE_MODE_MAX_LENGTH_WITH_PATTERN = 100
@@ -42,10 +43,12 @@ NEGATIVE_MODE_MAX_ITEMS = 15
 FLOAT_STRATEGY: st.SearchStrategy = st.floats(allow_nan=False, allow_infinity=False).map(_replace_zero_with_nonzero)
 NUMERIC_STRATEGY: st.SearchStrategy = st.integers() | FLOAT_STRATEGY
 JSON_STRATEGY: st.SearchStrategy = st.recursive(
-    st.none() | st.booleans() | NUMERIC_STRATEGY | st.text(), json_recursive_strategy
+    st.none() | st.booleans() | NUMERIC_STRATEGY | st.text(max_size=16),
+    json_recursive_strategy,
+    max_leaves=2,
 )
-ARRAY_STRATEGY: st.SearchStrategy = st.lists(JSON_STRATEGY, min_size=2)
-OBJECT_STRATEGY: st.SearchStrategy = st.dictionaries(st.text(), JSON_STRATEGY)
+ARRAY_STRATEGY: st.SearchStrategy = st.lists(JSON_STRATEGY, min_size=2, max_size=3)
+OBJECT_STRATEGY: st.SearchStrategy = st.dictionaries(st.text(max_size=16), JSON_STRATEGY, max_size=2)
 
 
 STRATEGIES_FOR_TYPE = {
@@ -112,8 +115,9 @@ class CoverageContext:
     is_required: bool
     path: list[str | int]
     custom_formats: dict[str, st.SearchStrategy]
+    validator_cls: type[jsonschema.protocols.Validator]
 
-    __slots__ = ("location", "generation_modes", "is_required", "path", "custom_formats")
+    __slots__ = ("location", "generation_modes", "is_required", "path", "custom_formats", "validator_cls")
 
     def __init__(
         self,
@@ -123,12 +127,14 @@ class CoverageContext:
         is_required: bool,
         path: list[str | int] | None = None,
         custom_formats: dict[str, st.SearchStrategy],
+        validator_cls: type[jsonschema.protocols.Validator],
     ) -> None:
         self.location = location
         self.generation_modes = generation_modes if generation_modes is not None else list(GenerationMode)
         self.is_required = is_required
         self.path = path or []
         self.custom_formats = custom_formats
+        self.validator_cls = validator_cls
 
     @contextmanager
     def at(self, key: str | int) -> Generator[None, None, None]:
@@ -149,6 +155,7 @@ class CoverageContext:
             is_required=self.is_required,
             path=self.path,
             custom_formats=self.custom_formats,
+            validator_cls=self.validator_cls,
         )
 
     def with_negative(self) -> CoverageContext:
@@ -158,6 +165,7 @@ class CoverageContext:
             is_required=self.is_required,
             path=self.path,
             custom_formats=self.custom_formats,
+            validator_cls=self.validator_cls,
         )
 
     def is_valid_for_location(self, value: Any) -> bool:
@@ -173,20 +181,21 @@ class CoverageContext:
             if isinstance(value, list) and not self.is_required:
                 # Optional parameters should be present
                 return any(item not in [{}, []] for item in value)
-            if isinstance(value, dict) and not self.is_required:
-                return bool(value)
         return True
 
+    def will_be_serialized_to_string(self) -> bool:
+        return self.location in ("query", "path", "header", "cookie")
+
     def can_be_negated(self, schema: dict[str, Any]) -> bool:
         # Path, query, header, and cookie parameters will be stringified anyway
         # If there are no constraints, then anything will match the original schema after serialization
-        if self.location in ("query", "path", "header", "cookie"):
+        if self.will_be_serialized_to_string():
             cleaned = {
                 k: v
                 for k, v in schema.items()
                 if not k.startswith("x-") and k not in ["description", "example", "examples"]
             }
-            return cleaned != {}
+            return cleaned not in [{}, {"type": "string"}]
         return True
 
     def generate_from(self, strategy: st.SearchStrategy) -> Any:
@@ -411,7 +420,7 @@ def cover_schema_iter(
                     for value_ in _negative_enum(ctx, [value], seen):
                         yield value_
                 elif key == "type":
-                    yield from _negative_type(ctx, value, seen)
+                    yield from _negative_type(ctx, value, seen, schema)
                 elif key == "properties":
                     template = template or ctx.generate_from_schema(_get_template_schema(schema, "object"))
                     yield from _negative_properties(ctx, template, value)
@@ -1038,7 +1047,7 @@ def _negative_multiple_of(
 
 
 def _negative_unique_items(ctx: CoverageContext, schema: dict) -> Generator[GeneratedValue, None, None]:
-    unique = ctx.generate_from_schema({**schema, "type": "array", "minItems": 1, "maxItems": 1})
+    unique = jsonify(ctx.generate_from_schema({**schema, "type": "array", "minItems": 1, "maxItems": 1}))
     yield NegativeValue(unique + unique, description="Non-unique items", location=ctx.current_path)
 
 
@@ -1086,22 +1095,120 @@ def _is_non_integer_float(x: float) -> bool:
     return x != int(x)
 
 
+def is_valid_header_value(value: Any) -> bool:
+    value = str(value)
+    if not is_latin_1_encodable(value):
+        return False
+    if has_invalid_characters("A", value):
+        return False
+    return True
+
+
+def jsonify(value: Any) -> Any:
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    elif value is None:
+        return "null"
+
+    stack: list = [value]
+    while stack:
+        item = stack.pop()
+        if isinstance(item, dict):
+            for key, sub_item in item.items():
+                if isinstance(sub_item, bool):
+                    item[key] = "true" if sub_item else "false"
+                elif sub_item is None:
+                    item[key] = "null"
+                elif isinstance(sub_item, dict):
+                    stack.append(sub_item)
+                elif isinstance(sub_item, list):
+                    stack.extend(item)
+        elif isinstance(item, list):
+            for idx, sub_item in enumerate(item):
+                if isinstance(sub_item, bool):
+                    item[idx] = "true" if sub_item else "false"
+                elif sub_item is None:
+                    item[idx] = "null"
+                else:
+                    stack.extend(item)
+    return value
+
+
+def quote_path_parameter(value: Any) -> str:
+    if isinstance(value, str):
+        if value == ".":
+            return "%2E"
+        elif value == "..":
+            return "%2E%2E"
+        else:
+            return quote_plus(value)
+    if isinstance(value, list):
+        return ",".join(map(str, value))
+    return str(value)
+
+
 def _negative_type(
-    ctx: CoverageContext,
-    ty: str | list[str],
-    seen: HashSet,
+    ctx: CoverageContext, ty: str | list[str], seen: HashSet, schema: dict[str, Any]
 ) -> Generator[GeneratedValue, None, None]:
     if isinstance(ty, str):
         types = [ty]
     else:
         types = ty
     strategies = {ty: strategy for ty, strategy in STRATEGIES_FOR_TYPE.items() if ty not in types}
+
+    filter_func = {
+        "path": lambda x: not is_invalid_path_parameter(x),
+        "header": is_valid_header_value,
+        "cookie": is_valid_header_value,
+        "query": lambda x: not contains_unicode_surrogate_pair(x),
+    }.get(ctx.location)
+
     if "number" in types:
         del strategies["integer"]
     if "integer" in types:
         strategies["number"] = FLOAT_STRATEGY.filter(_is_non_integer_float)
     if ctx.location == "query":
         strategies.pop("object", None)
+    if filter_func is not None:
+        for ty, strategy in strategies.items():
+            strategies[ty] = strategy.filter(filter_func)
+
+    pattern = schema.get("pattern")
+    if pattern is not None:
+        try:
+            re.compile(pattern)
+        except re.error:
+            schema = schema.copy()
+            del schema["pattern"]
+            return
+
+    validator = ctx.validator_cls(
+        schema,
+        format_checker=jsonschema.Draft202012Validator.FORMAT_CHECKER,
+    )
+    is_valid = validator.is_valid
+    try:
+        is_valid(None)
+        apply_validation = True
+    except Exception:
+        # Schema is not correct and we can't validate the generated instances.
+        # In such a scenario it is better to generate at least something with some chances to have a false
+        # positive failure
+        apply_validation = False
+
+    def _does_not_match_the_original_schema(value: Any) -> bool:
+        return not is_valid(str(value))
+
+    if ctx.location == "path":
+        for ty, strategy in strategies.items():
+            strategies[ty] = strategy.map(jsonify).map(quote_path_parameter)
+    elif ctx.location == "query":
+        for ty, strategy in strategies.items():
+            strategies[ty] = strategy.map(jsonify)
+
+    if apply_validation and ctx.will_be_serialized_to_string():
+        for ty, strategy in strategies.items():
+            strategies[ty] = strategy.filter(_does_not_match_the_original_schema)
     for strategy in strategies.values():
         value = ctx.generate_from(strategy)
         if seen.insert(value) and ctx.is_valid_for_location(value):