testit-python-commons 5.1.5.post580__tar.gz → 5.1.6.post580__tar.gz

{testit_python_commons-5.1.5.post580 → testit_python_commons-5.1.6.post580}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: testit-python-commons
-Version: 5.1.5.post580
+Version: 5.1.6.post580
 Summary: Python commons for Test IT
 Home-page: https://github.com/testit-tms/adapters-python/
 Author: Integration team

{testit_python_commons-5.1.5.post580 → testit_python_commons-5.1.6.post580}/setup.py

@@ -1,6 +1,6 @@
 from setuptools import find_packages, setup
 
-VERSION = "5.1.5.post580"
+VERSION = "5.1.6.post580"
 
 setup(
     name='testit-python-commons',

{testit_python_commons-5.1.5.post580 → testit_python_commons-5.1.6.post580}/src/testit_python_commons/client/api_client.py

@@ -41,6 +41,7 @@ from testit_python_commons.services.retry import (
     retry,
     retry_on_connection_error,
 )
+from testit_python_commons.utils.html_escape_utils import HtmlEscapeUtils
 
 
 class ApiClientWorker:
@@ -469,6 +470,7 @@ class ApiClientWorker:
             test_result,
             self.__config.get_project_id())
 
+        HtmlEscapeUtils.escape_html_in_object(model)
         autotest_response = self.__autotest_api.adapters_auto_tests_post(
             adapters_auto_tests_post_request=model)
 
@@ -496,6 +498,7 @@ class ApiClientWorker:
         model = Converter.prepare_to_update_autotest(test_result, autotest, self.__config.get_project_id())
 
         try:
+            HtmlEscapeUtils.escape_html_in_object(model)
             self.__autotest_api.adapters_auto_tests_put(adapters_auto_tests_put_request=model)
         except Exception as exc:
             if is_retriable_connection_error(exc):
@@ -562,6 +565,7 @@ class ApiClientWorker:
             self.__config.get_configuration_id(),
             self.__status_codes)
 
+        HtmlEscapeUtils.escape_html_in_object(model)
         response = self.__test_run_api.adapters_test_runs_id_test_results_post(
             id=self.__config.get_test_run_id(),
             auto_test_results_for_test_run_model=[model])

{testit_python_commons-5.1.5.post580 → testit_python_commons-5.1.6.post580}/src/testit_python_commons/client/helpers/bulk_autotest_helper.py

@@ -156,7 +156,7 @@ class BulkAutotestHelper:
     def __create_tests(self, autotests_for_create: List[AutoTestCreateApiModel]):
         # logging.debug(f'Creating autotests: "{autotests_for_create}')
 
-        autotests_for_create = HtmlEscapeUtils.escape_html_in_object(autotests_for_create)
+        autotests_for_create = HtmlEscapeUtils.escape_html_in_object_list(autotests_for_create)
         self.__autotests_api.adapters_auto_tests_bulk_post(auto_test_create_api_model=autotests_for_create)
 
         logging.debug(f'Autotests were created')
@@ -165,7 +165,7 @@ class BulkAutotestHelper:
     def __update_tests(self, autotests_for_update: List[AutoTestUpdateApiModel]):
         # logging.debug(f'Updating autotests: {autotests_for_update}')
 
-        autotests_for_update = HtmlEscapeUtils.escape_html_in_object(autotests_for_update)
+        autotests_for_update = HtmlEscapeUtils.escape_html_in_object_list(autotests_for_update)
         self.__autotests_api.adapters_auto_tests_bulk_put(auto_test_update_api_model=autotests_for_update)
 
         logging.debug(f'Autotests were updated')
@@ -174,7 +174,7 @@ class BulkAutotestHelper:
     def __load_test_results(self, test_results: List[AutoTestResultsForTestRunModel]):
         # logging.debug(f'Loading test results: {test_results}')
 
-        test_results = HtmlEscapeUtils.escape_html_in_object(test_results)
+        test_results = HtmlEscapeUtils.escape_html_in_object_list(test_results)
         self.__test_runs_api.adapters_test_runs_id_test_results_post(
             id=self.__test_run_id,
             auto_test_results_for_test_run_model=test_results)

{testit_python_commons-5.1.5.post580 → testit_python_commons-5.1.6.post580}/src/testit_python_commons/models/test_result.py

@@ -288,7 +288,7 @@ class TestResult:
 
     @adapter_logger
     def set_external_key(self, external_key: str):
-        self.__external_key = external_key
+        self.__external_key = HtmlEscapeUtils.escape_html_tags(external_key)
 
         return self
 

{testit_python_commons-5.1.5.post580 → testit_python_commons-5.1.6.post580}/src/testit_python_commons/utils/html_escape_utils.py

@@ -80,7 +80,12 @@ class HtmlEscapeUtils:
             return obj
             
         try:
-            HtmlEscapeUtils._process_object_attributes(obj)
+            if isinstance(obj, list):
+                HtmlEscapeUtils._process_list(obj)
+            elif isinstance(obj, dict):
+                HtmlEscapeUtils._process_dict(obj)
+            else:
+                HtmlEscapeUtils._process_object_attributes(obj)
         except Exception as e:
             # Silently ignore reflection errors
             logging.debug(f"Error processing object attributes: {e}")
@@ -90,7 +95,7 @@ class HtmlEscapeUtils:
     @staticmethod
     def escape_html_in_object_list(obj_list: Optional[List[Any]]) -> Optional[List[Any]]:
         """
-        Escapes HTML tags in all string attributes of objects in a list using reflection.
+        Escapes HTML tags in list items: strings in-place, objects via reflection.
         Can be disabled by setting NO_ESCAPE_HTML environment variable to "true".
         
         Args:
@@ -106,47 +111,68 @@ class HtmlEscapeUtils:
         no_escape_html = os.environ.get(HtmlEscapeUtils.NO_ESCAPE_HTML_ENV_VAR, "").lower()
         if no_escape_html == "true":
             return obj_list
-            
-        for obj in obj_list:
-            HtmlEscapeUtils.escape_html_in_object(obj)
-            
+
+        HtmlEscapeUtils._process_list(obj_list)
         return obj_list
     
+    @staticmethod
+    def _process_dict(obj: dict) -> None:
+        for key, value in obj.items():
+            if isinstance(value, str):
+                obj[key] = HtmlEscapeUtils.escape_html_tags(value)
+            elif isinstance(value, list):
+                HtmlEscapeUtils._process_list(value)
+            elif isinstance(value, dict):
+                HtmlEscapeUtils._process_dict(value)
+            elif value is not None and not HtmlEscapeUtils._is_simple_type(type(value)):
+                HtmlEscapeUtils.escape_html_in_object(value)
+
+    @staticmethod
+    def _iter_object_attr_names(obj: Any):
+        """
+        OpenAPI models store fields in attribute_map/_data_store; they are not listed by dir().
+        Prefer those maps, fall back to public dir() attributes for plain objects.
+        """
+        attribute_map = getattr(obj, 'attribute_map', None)
+        if isinstance(attribute_map, dict) and attribute_map:
+            return attribute_map.keys()
+
+        data_store = getattr(obj, '_data_store', None)
+        if isinstance(data_store, dict) and data_store:
+            return data_store.keys()
+
+        return (
+            attr_name for attr_name in dir(obj)
+            if not attr_name.startswith('_') and not callable(getattr(obj, attr_name, None))
+        )
+
+    @staticmethod
+    def _should_skip_attr(attr_name: str) -> bool:
+        return (
+            attr_name.startswith('_')
+            or attr_name.startswith("external_id")
+            or attr_name.startswith("externalId")
+            or attr_name.startswith("auto_test_external_id")
+            or attr_name.startswith("autoTestExternalId")
+        )
+
     @staticmethod
     def _process_object_attributes(obj: Any) -> None:
         """
         Process all attributes of an object for HTML escaping.
         """
-        # Handle dictionary-like objects (common in API models)
-        if hasattr(obj, '__dict__'):
-            for attr_name in dir(obj):
-                # Skip private/protected attributes and methods
-                if attr_name.startswith('_') or callable(getattr(obj, attr_name, None)):
-                    continue
-                if (
-                    attr_name.startswith("external_id")
-                    or attr_name.startswith("externalId")
-                    or attr_name.startswith("auto_test_external_id")
-                    or attr_name.startswith("autoTestExternalId")
-                ):
+        for attr_name in HtmlEscapeUtils._iter_object_attr_names(obj):
+            if HtmlEscapeUtils._should_skip_attr(attr_name):
+                continue
+
+            try:
+                value = getattr(obj, attr_name, None)
+                if callable(value):
                     continue
-                    
-                try:
-                    value = getattr(obj, attr_name)
-                    HtmlEscapeUtils._process_attribute_value(obj, attr_name, value)
-                except Exception as e:
-                    # Silently ignore attribute errors
-                    logging.debug(f"Error processing attribute {attr_name}: {e}")
-                    
-        # Handle dictionary objects
-        elif isinstance(obj, dict):
-            for key, value in obj.items():
-                if isinstance(value, str):
-                    obj[key] = HtmlEscapeUtils.escape_html_tags(value)
-                elif isinstance(value, list):
-                    HtmlEscapeUtils._process_list(value)
-                elif not HtmlEscapeUtils._is_simple_type(type(value)):
-                    HtmlEscapeUtils.escape_html_in_object(value)
+                HtmlEscapeUtils._process_attribute_value(obj, attr_name, value)
+            except Exception as e:
+                # Silently ignore attribute errors
+                logging.debug(f"Error processing attribute {attr_name}: {e}")
     
     @staticmethod
     def _process_attribute_value(obj: Any, attr_name: str, value: Any) -> None:
@@ -162,6 +188,8 @@ class HtmlEscapeUtils:
                 pass
         elif isinstance(value, list):
             HtmlEscapeUtils._process_list(value)
+        elif isinstance(value, dict):
+            HtmlEscapeUtils._process_dict(value)
         elif value is not None and not HtmlEscapeUtils._is_simple_type(type(value)):
             # Process nested objects (but not simple types)
             HtmlEscapeUtils.escape_html_in_object(value)

{testit_python_commons-5.1.5.post580 → testit_python_commons-5.1.6.post580}/src/testit_python_commons.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: testit-python-commons
-Version: 5.1.5.post580
+Version: 5.1.6.post580
 Summary: Python commons for Test IT
 Home-page: https://github.com/testit-tms/adapters-python/
 Author: Integration team

{testit_python_commons-5.1.5.post580 → testit_python_commons-5.1.6.post580}/src/testit_python_commons.egg-info/SOURCES.txt

@@ -258,4 +258,5 @@ src/testit_python_commons/utils/__init__.py
 src/testit_python_commons/utils/html_escape_utils.py
 tests/test_app_properties.py
 tests/test_dynamic_methods.py
-tests/test_html_escape_utils.py
+tests/test_html_escape_utils.py
+tests/test_xss_parameters_escape.py

{testit_python_commons-5.1.5.post580 → testit_python_commons-5.1.6.post580}/tests/test_html_escape_utils.py

@@ -101,6 +101,32 @@ class TestHtmlEscapeUtils(unittest.TestCase):
         self.assertEqual(result[0].description, "<div>content</div>")
         self.assertEqual(result[1].description, "<span>more</span>")
 
+    def test_escape_html_in_object_accepts_list(self):
+        """Bulk send path passes a list — must escape each item, not no-op."""
+        test_list = [
+            SampleData("First", "<script>alert(1)</script>"),
+            SampleData("Second", "<img src=x onerror=alert(1)>"),
+        ]
+        result = HtmlEscapeUtils.escape_html_in_object(test_list)
+
+        self.assertEqual(result[0].description, "&lt;script&gt;alert(1)&lt;/script&gt;")
+        self.assertEqual(result[1].description, "&lt;img src=x onerror=alert(1)&gt;")
+
+    def test_escape_html_in_list_of_strings(self):
+        tags = ["<script>alert(1)</script>", "safe", "<b>x</b>"]
+        result = HtmlEscapeUtils.escape_html_in_object(tags)
+
+        self.assertEqual(result[0], "&lt;script&gt;alert(1)&lt;/script&gt;")
+        self.assertEqual(result[1], "safe")
+        self.assertEqual(result[2], "&lt;b&gt;x&lt;/b&gt;")
+
+    def test_escape_html_in_list_of_dicts(self):
+        labels = [{"name": "<script>alert(1)</script>"}, {"name": "ok"}]
+        result = HtmlEscapeUtils.escape_html_in_object(labels)
+
+        self.assertEqual(result[0]["name"], "&lt;script&gt;alert(1)&lt;/script&gt;")
+        self.assertEqual(result[1]["name"], "ok")
+
     def test_escape_disabled_by_env_var(self):
         """Test that escaping can be disabled via environment variable"""
         os.environ[HtmlEscapeUtils.NO_ESCAPE_HTML_ENV_VAR] = "true"
@@ -131,6 +157,25 @@ class TestHtmlEscapeUtils(unittest.TestCase):
         self.assertEqual(result["tags"][0], "&lt;tag&gt;")
         self.assertEqual(result["tags"][1], "normal_tag")
 
+    def test_escape_openapi_model_parameters(self):
+        """OpenAPI models hide fields from dir(); parameters must still be escaped."""
+        from adapters_api.models import AutoTestResultsForTestRunModel, TestStatusType
+
+        model = AutoTestResultsForTestRunModel(
+            configuration_id="cfg",
+            auto_test_external_id="ext",
+            status_type=TestStatusType("Succeeded"),
+            parameters={"description": '<script>alert("1")</script>'},
+            message='<img src=x onerror=alert(1)>',
+        )
+        HtmlEscapeUtils.escape_html_in_object(model)
+
+        self.assertEqual(
+            model.parameters["description"],
+            '&lt;script&gt;alert("1")&lt;/script&gt;',
+        )
+        self.assertEqual(model.message, "&lt;img src=x onerror=alert(1)&gt;")
+
 
 if __name__ == '__main__':
     unittest.main()

testit_python_commons-5.1.6.post580/tests/test_xss_parameters_escape.py

@@ -0,0 +1,72 @@
+"""Regression: XSS in pytest params must be escaped before TMS API payloads."""
+
+import importlib.util
+import unittest
+from pathlib import Path
+
+from adapters_api import ApiClient
+from testit_python_commons.client.converter import Converter
+from testit_python_commons.models.test_result import TestResult
+from testit_python_commons.utils.html_escape_utils import HtmlEscapeUtils
+
+
+def _load_xss_payloads():
+    path = Path(__file__).resolve().parents[2] / "test_files" / "test_xss_parametrize.py"
+    spec = importlib.util.spec_from_file_location("test_xss_parametrize", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module.XSS_PAYLOADS
+
+
+class TestXssParametersEscape(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.payloads = _load_xss_payloads()
+
+    def test_test_result_parameters_escaped_for_all_payloads(self):
+        for payload in self.payloads:
+            with self.subTest(payload=payload):
+                result = TestResult().set_parameters({"description": payload})
+                value = result.get_parameters()["description"]
+                if HtmlEscapeUtils._HTML_TAG_PATTERN.search(payload):
+                    self.assertNotIn("<script", value.lower().replace("&lt;", ""))
+                    self.assertIn("&lt;", value)
+                    self.assertNotEqual(value, payload)
+                # API model must keep escaped value
+                model = Converter.test_result_to_testrun_result_post_model(
+                    result.set_external_id("ext").set_outcome("Passed").set_status_type("Succeeded").set_duration(1),
+                    "cfg",
+                    ["PASSED"],
+                )
+                self.assertEqual(model.parameters["description"], value)
+                serialized = ApiClient.sanitize_for_serialization(model)
+                self.assertEqual(serialized["parameters"]["description"], value)
+
+    def test_external_key_with_nodeid_xss_is_escaped(self):
+        payload = '<script>alert("1")</script>'
+        node_key = f"tests and test_xss_parametrize.py and test_05_with_chg_xss[{payload}]"
+        result = TestResult().set_external_key(node_key)
+        escaped = result.get_external_key()
+        self.assertIn("&lt;script&gt;", escaped)
+        self.assertNotIn("<script>", escaped)
+
+    def test_bulk_list_escape_mutates_result_models(self):
+        payload = '<script>alert("1")</script>'
+        # Simulate model built WITHOUT going through TestResult setters (raw params)
+        class FakeResult:
+            def __init__(self):
+                self.parameters = {"description": payload}
+                self.message = payload
+
+        models = [FakeResult(), FakeResult()]
+        HtmlEscapeUtils.escape_html_in_object(models)
+        for model in models:
+            self.assertEqual(
+                model.parameters["description"],
+                '&lt;script&gt;alert("1")&lt;/script&gt;',
+            )
+            self.assertEqual(model.message, '&lt;script&gt;alert("1")&lt;/script&gt;')
+
+
+if __name__ == "__main__":
+    unittest.main()