schemathesis 4.0.18__tar.gz → 4.0.20__tar.gz

{schemathesis-4.0.18 → schemathesis-4.0.20}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.29.4
+        uses: github/codeql-action/init@v3.29.5
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.29.4
+        uses: github/codeql-action/autobuild@v3.29.5
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.29.4
+        uses: github/codeql-action/analyze@v3.29.5

{schemathesis-4.0.18 → schemathesis-4.0.20}/.pre-commit-config.yaml

@@ -25,7 +25,7 @@ repos:
       - id: yamllint
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.17.0
+    rev: v1.17.1
     hooks:
       - id: mypy
         exclude: ^(docs/|test/|test-corpus/|example/|benches/).*$
@@ -33,11 +33,11 @@ repos:
         additional_dependencies: [types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.5
+    rev: v0.12.7
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.5
+    rev: v0.12.7
     hooks:
       - id: ruff-check

{schemathesis-4.0.18 → schemathesis-4.0.20}/CHANGELOG.md

@@ -1,6 +1,24 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.18...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.0.20...HEAD) - TBD
+
+## [4.0.20](https://github.com/schemathesis/schemathesis/compare/v4.0.19...v4.0.20) - 2025-08-04
+
+### :bug: Fixed
+
+- Internal error in the `ignored_auth` check in ASGI/WSGI integration.
+- Handle octal escapes during updating quantifiers in regular expressions.
+- Handle nested match groups during updating quantifiers in regular expressions.
+
+## [4.0.19](https://github.com/schemathesis/schemathesis/compare/v4.0.18...v4.0.19) - 2025-08-03
+
+### :bug: Fixed
+
+- `AttributeError` during response conformance checks if the response schema contains an error in `properties` definition.
+
+### :wrench: Changed
+
+- Report schema errors in response definitions.
 
 ## [4.0.18](https://github.com/schemathesis/schemathesis/compare/v4.0.17...v4.0.18) - 2025-08-02
 

{schemathesis-4.0.18 → schemathesis-4.0.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.0.18
+Version: 4.0.20
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.0.18 → schemathesis-4.0.20}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.0.18"
+version = "4.0.20"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.0.18 → schemathesis-4.0.20}/src/schemathesis/core/errors.py

@@ -52,7 +52,7 @@ class InvalidSchema(SchemathesisError):
 
     @classmethod
     def from_jsonschema_error(
-        cls, error: ValidationError, path: str | None, method: str | None, config: OutputConfig
+        cls, error: ValidationError | JsonSchemaError, path: str | None, method: str | None, config: OutputConfig
     ) -> InvalidSchema:
         if error.absolute_path:
             part = error.absolute_path[-1]

{schemathesis-4.0.18 → schemathesis-4.0.20}/src/schemathesis/specs/openapi/checks.py

@@ -513,6 +513,8 @@ def ignored_auth(ctx: CheckContext, response: Response, case: Case) -> bool | No
                     _remove_auth_from_container(container, security_parameters, location=location)
                     kwargs[container_name] = container
             kwargs.pop("session", None)
+            if case.operation.app is not None:
+                kwargs.setdefault("app", case.operation.app)
             ctx._record_case(parent_id=case.id, case=no_auth_case)
             no_auth_response = case.operation.schema.transport.send(no_auth_case, **kwargs)
             ctx._record_response(case_id=no_auth_case.id, response=no_auth_response)

{schemathesis-4.0.18 → schemathesis-4.0.20}/src/schemathesis/specs/openapi/converter.py

@@ -34,7 +34,7 @@ def to_json_schema(
         update_pattern_in_schema(schema)
     # Sometimes `required` is incorrectly has a boolean value
     properties = schema.get("properties")
-    if properties:
+    if isinstance(properties, dict):
         for name, subschema in properties.items():
             if not isinstance(subschema, dict):
                 continue

{schemathesis-4.0.18 → schemathesis-4.0.20}/src/schemathesis/specs/openapi/patterns.py

@@ -174,8 +174,18 @@ def _handle_anchored_pattern(parsed: list, pattern: str, min_length: int | None,
                 continue
             if pattern[current_position] == "\\":
                 # Escaped value
-                current_position += 2
                 result += "\\"
+                # Could be an octal value
+                if (
+                    current_position + 2 < len(pattern)
+                    and pattern[current_position + 1] == "0"
+                    and pattern[current_position + 2] in ("0", "1", "2", "3", "4", "5", "6", "7")
+                ):
+                    result += pattern[current_position + 1]
+                    result += pattern[current_position + 2]
+                    current_position += 3
+                    continue
+                current_position += 2
             else:
                 current_position += 1
             result += chr(value)
@@ -349,13 +359,58 @@ def _handle_repeat_quantifier(
 ) -> str:
     """Handle repeat quantifiers (e.g., '+', '*', '?')."""
     min_repeat, max_repeat, _ = value
-    min_length, max_length = _build_size(min_repeat, max_repeat, min_length, max_length)
-    if min_length > max_length:
-        return pattern
+
+    # First, analyze the inner pattern
     inner = _strip_quantifier(pattern)
     if inner.startswith("(") and inner.endswith(")"):
         inner = inner[1:-1]
-    return f"({inner})" + _build_quantifier(min_length, max_length)
+
+    # Determine the length of the inner pattern
+    inner_length = 1  # default assumption for non-literal patterns
+    try:
+        parsed = sre_parse.parse(inner)
+        if all(item[0] == LITERAL for item in parsed):
+            inner_length = len(parsed)
+            if max_length and max_length > 0 and inner_length > max_length:
+                return pattern
+    except re.error:
+        pass
+
+    if inner_length == 0:
+        # Empty pattern contributes 0 chars regardless of repetitions
+        # For length constraints, only 0 repetitions make sense
+        if min_length is not None and min_length > 0:
+            return pattern  # Can't satisfy positive length with empty pattern
+        return f"({inner})" + _build_quantifier(0, 0)
+
+    # Convert external length constraints to repetition constraints
+    external_min_repeat = None
+    external_max_repeat = None
+
+    if min_length is not None:
+        # Need at least ceil(min_length / inner_length) repetitions
+        external_min_repeat = (min_length + inner_length - 1) // inner_length
+
+    if max_length is not None:
+        # Can have at most floor(max_length / inner_length) repetitions
+        external_max_repeat = max_length // inner_length
+
+    # Merge original repetition constraints with external constraints
+    final_min_repeat = min_repeat
+    if external_min_repeat is not None:
+        final_min_repeat = max(min_repeat, external_min_repeat)
+
+    final_max_repeat = max_repeat
+    if external_max_repeat is not None:
+        if max_repeat == MAXREPEAT:
+            final_max_repeat = external_max_repeat
+        else:
+            final_max_repeat = min(max_repeat, external_max_repeat)
+
+    if final_min_repeat > final_max_repeat:
+        return pattern
+
+    return f"({inner})" + _build_quantifier(final_min_repeat, final_max_repeat)
 
 
 def _handle_literal_or_in_quantifier(pattern: str, min_length: int | None, max_length: int | None) -> str:

{schemathesis-4.0.18 → schemathesis-4.0.20}/src/schemathesis/specs/openapi/schemas.py

@@ -646,6 +646,10 @@ class BaseOpenAPISchema(BaseSchema):
                     # Use a recent JSON Schema format checker to get most of formats checked for older drafts as well
                     format_checker=jsonschema.Draft202012Validator.FORMAT_CHECKER,
                 )
+            except jsonschema.SchemaError as exc:
+                raise InvalidSchema.from_jsonschema_error(
+                    exc, path=operation.path, method=operation.method, config=self.config.output
+                ) from exc
             except jsonschema.ValidationError as exc:
                 failures.append(
                     JsonSchemaError.from_exception(

{schemathesis-4.0.18 → schemathesis-4.0.20}/test/auth/test_pytest.py

@@ -206,6 +206,74 @@ def test(case):
     result.assert_outcomes(passed=2)
 
 
+def test_ignored_auth_with_wsgi(testdir):
+    testdir.make_test(
+        """
+from flask import Flask, request
+app = Flask(__name__)
+
+
+@app.route("/users/<int:user_id>")
+def get_user(user_id):
+    scheme, _, token = request.headers.get("Authorization", "").partition(" ")
+    if scheme.lower() != "bearer" or token != "secret-token":
+        return {"error": "Unauthorized"}, 401
+    return {"user_id": user_id}
+
+
+@app.route("/openapi.json")
+def openapi():
+    return {
+        "openapi": "3.0.3",
+        "info": {"version": "0.1", "title": "Test API"},
+        "paths": {
+            "/users/{user_id}": {
+                "get": {
+                    "parameters": [
+                        {
+                            "name": "user_id",
+                            "in": "path",
+                            "required": True,
+                            "schema": {"type": "integer"},
+                        }
+                    ],
+                    "responses": {
+                        "200": {
+                            "description": "OK",
+                            "content": {
+                                "application/json": {"schema": {"type": "object"}}
+                            },
+                        },
+                        "401": {
+                            "description": "Unauthorized",
+                        },
+                        "404": {"description": "Not Found"},
+                    },
+                    "security": [{"MyBearer": []}],
+                }
+            }
+        },
+        "components": {
+            "securitySchemes": {
+                "MyBearer": {"type": "http", "scheme": "bearer"},
+            }
+        },
+    }
+
+
+schema = schemathesis.openapi.from_wsgi("/openapi.json", app)
+
+
+@schema.parametrize()
+@settings(max_examples=3)
+def test_api(case):
+    case.call_and_validate(headers={"Authorization": "Bearer secret-token"})
+""",
+    )
+    result = testdir.runpytest("-s")
+    result.assert_outcomes(passed=1)
+
+
 @pytest.mark.openapi_version("3.0")
 @pytest.mark.operations("success", "text")
 def test_conditional(testdir, app_schema, openapi3_base_url):

schemathesis-4.0.20/test/cli/__snapshots__/test_commands/test_invalid_response_definition.raw

@@ -0,0 +1,71 @@
+Exit code: 1
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ⏭   Examples (in 0.00s)
+
+     ⏭  1 skipped
+
+ 🚫  Coverage (in 0.00s)
+
+     🚫 1 error
+
+ 🚫  Fuzzing (in 0.00s)
+
+     🚫 1 error
+
+==================================== ERRORS ====================================
+_________________________________ GET /success _________________________________
+Schema Error
+
+Invalid `properties` definition
+
+Location:
+    properties
+
+Problematic definition:
+"ABC"
+
+Error details:
+    'ABC' is not of type 'object'
+
+Ensure that the definition complies with the OpenAPI specification
+
+Need more help?
+    Join our Discord server: https://discord.gg/R9ASRAmHnA
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 0
+  Errored: 1
+
+Test Phases:
+  ⏭  Examples
+  🚫 Coverage
+  🚫 Fuzzing
+  ⏭  Stateful (not applicable)
+
+Errors:
+  🚫 Schema Error: 1
+
+Test cases:
+  N generated, N skipped
+
+Seed: 42
+
+=============================== 1 error in 1.00s ===============================

{schemathesis-4.0.18 → schemathesis-4.0.20}/test/cli/test_commands.py

@@ -601,6 +601,34 @@ def test_required_as_boolean(ctx, cli, snapshot_cli, openapi3_base_url, required
     )
 
 
+def test_invalid_response_definition(ctx, cli, snapshot_cli, openapi3_base_url):
+    schema_path = ctx.openapi.write_schema(
+        {
+            "/success": {
+                "get": {
+                    "responses": {
+                        "default": {
+                            "description": "text",
+                            "content": {
+                                "application/json": {
+                                    "schema": {
+                                        # Seen in real-life schema
+                                        "properties": "ABC",
+                                    }
+                                }
+                            },
+                        }
+                    }
+                }
+            }
+        }
+    )
+    assert (
+        cli.run(str(schema_path), f"--url={openapi3_base_url}", "-c response_schema_conformance", "--max-examples=1")
+        == snapshot_cli
+    )
+
+
 def test_no_useless_traceback(ctx, cli, snapshot_cli, openapi3_base_url):
     schema_path = ctx.openapi.write_schema(
         {

{schemathesis-4.0.18 → schemathesis-4.0.20}/test/engine/test_checks.py

@@ -453,6 +453,30 @@ def test_response_schema_conformance_openapi_31_boolean(openapi_30, response_fac
     assert case.operation.is_valid_response(response)
 
 
+def test_response_schema_conformance_invalid_properties(openapi_30, response_factory):
+    response = Response.from_requests(response_factory.requests(content=b'{"success": true}'), True)
+    case = make_case(
+        openapi_30,
+        {
+            "responses": {
+                "default": {
+                    "description": "text",
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                # Seen in real-life schema
+                                "properties": "ABC",
+                            }
+                        }
+                    },
+                }
+            }
+        },
+    )
+    with pytest.raises(InvalidSchema):
+        assert response_schema_conformance(CTX, response, case) is None
+
+
 @pytest.mark.parametrize(
     "extra",
     [

{schemathesis-4.0.18 → schemathesis-4.0.20}/test/specs/openapi/test_patterns.py

@@ -130,6 +130,13 @@ SKIP_BEFORE_PY11 = pytest.mark.skipif(
         (r"^[\W\w]{2,}$", 1, 3, r"^(.){2,3}$"),
         (r"^prefix[|]+(?:,prefix[|]+)*$", 4000, 4000, r"^prefix([|]){2}(?:,prefix[|]+){499}$"),
         (r"^bar\.spam\.[^,]+(?:,bar\.spam\.[^,]+)*$", 10, 10, r"^bar\.spam\.([^,]){1}(?:,bar\.spam\.[^,]+){0}$"),
+        (r"^\008+()?$", None, 2, r"^\00(8){1}(){0}$"),
+        (r"^\008+()?$", 2, None, r"^\00(8){1,}(){0}$"),
+        (r"^000(000)?$", 4, 5, r"^000(000)?$"),
+        ("(abc)+", 1, 10, "(abc){1,3}"),
+        ("(hello){2,5}", None, 12, "(hello){2}"),
+        ("(abcd)*", 3, 7, "(abcd){1}"),
+        ("^()?$", 4, 5, "^()?$"),
     ],
 )
 def test_update_quantifier(pattern, min_length, max_length, expected):