testit-python-commons 5.2.0__tar.gz → 5.2.2__tar.gz

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: testit-python-commons
-Version: 5.2.0
+Version: 5.2.2
 Summary: Python commons for Test IT
 Home-page: https://github.com/testit-tms/adapters-python/
 Author: Integration team

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/setup.py

@@ -1,6 +1,6 @@
 from setuptools import find_packages, setup
 
-VERSION = "5.2.0"
+VERSION = "5.2.2"
 
 setup(
     name='testit-python-commons',

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/src/testit_python_commons/client/api_client.py

@@ -41,6 +41,7 @@ from testit_python_commons.services.retry import (
     retry,
     retry_on_connection_error,
 )
+from testit_python_commons.utils.html_escape_utils import HtmlEscapeUtils
 
 
 class ApiClientWorker:
@@ -265,9 +266,9 @@ class ApiClientWorker:
             self,
             test_results: List[TestResult],
             fixture_containers: dict,
-            finalized_external_ids: set = None) -> None:
+            finalized_result_keys: set = None) -> None:
         logging.debug("call __write_tests")
-        finalized_external_ids = finalized_external_ids or set()
+        finalized_result_keys = finalized_result_keys or set()
         bulk_autotest_helper = BulkAutotestHelper(self.__autotest_api, self.__test_run_api, self.__config)
         create_count = 0
         update_count = 0
@@ -277,8 +278,11 @@ class ApiClientWorker:
         for test_result in test_results:
             test_result = self.__add_fixtures_to_test_result(test_result, fixture_containers)
             external_id = test_result.get_external_id()
+            finalize_key = test_result.get_finalize_key()
 
-            if external_id in finalized_external_ids:
+            # Skip only the same invocation (Java: by UUID). Bare externalId would
+            # drop other parametrize iterations that share one autotest id.
+            if finalize_key in finalized_result_keys:
                 skip_count += 1
                 logging.info(
                     'Bulk import: skip sendTestResults for %s (already finalized at test finish)',
@@ -469,6 +473,7 @@ class ApiClientWorker:
             test_result,
             self.__config.get_project_id())
 
+        HtmlEscapeUtils.escape_html_in_object(model)
         autotest_response = self.__autotest_api.adapters_auto_tests_post(
             adapters_auto_tests_post_request=model)
 
@@ -496,6 +501,7 @@ class ApiClientWorker:
         model = Converter.prepare_to_update_autotest(test_result, autotest, self.__config.get_project_id())
 
         try:
+            HtmlEscapeUtils.escape_html_in_object(model)
             self.__autotest_api.adapters_auto_tests_put(adapters_auto_tests_put_request=model)
         except Exception as exc:
             if is_retriable_connection_error(exc):
@@ -562,6 +568,7 @@ class ApiClientWorker:
             self.__config.get_configuration_id(),
             self.__status_codes)
 
+        HtmlEscapeUtils.escape_html_in_object(model)
         response = self.__test_run_api.adapters_test_runs_id_test_results_post(
             id=self.__config.get_test_run_id(),
             auto_test_results_for_test_run_model=[model])

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/src/testit_python_commons/client/converter.py

@@ -45,9 +45,19 @@ from testit_python_commons.models.step_result import StepResult
 from testit_python_commons.models.test_result import TestResult
 from testit_python_commons.models.test_result_with_all_fixture_step_results_model import TestResultWithAllFixtureStepResults
 from testit_python_commons.services.logger import adapter_logger
+from testit_python_commons.utils.html_escape_utils import HtmlEscapeUtils
 
 
 class Converter:
+    @staticmethod
+    def _escape_string_map(values: Optional[dict]) -> Optional[dict]:
+        if not values:
+            return values
+        return {
+            str(key): HtmlEscapeUtils.escape_html_tags(str(value)) if value is not None else value
+            for key, value in values.items()
+        }
+
     @staticmethod
     @adapter_logger
     def test_run_to_test_run_short_model(
@@ -402,8 +412,8 @@ class Converter:
                 test_result.get_teardown_results()),
             traces=test_result.get_traces(),
             attachments=test_result.get_attachments(),
-            parameters=test_result.get_parameters(),
-            properties=test_result.get_properties(),
+            parameters=cls._escape_string_map(test_result.get_parameters()),
+            properties=cls._escape_string_map(test_result.get_properties()),
             links=cls.links_to_links_post_model(
                 test_result.get_result_links()),
             duration=round(test_result.get_duration()),

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/src/testit_python_commons/client/helpers/bulk_autotest_helper.py

@@ -156,7 +156,7 @@ class BulkAutotestHelper:
     def __create_tests(self, autotests_for_create: List[AutoTestCreateApiModel]):
         # logging.debug(f'Creating autotests: "{autotests_for_create}')
 
-        autotests_for_create = HtmlEscapeUtils.escape_html_in_object(autotests_for_create)
+        autotests_for_create = HtmlEscapeUtils.escape_html_in_object_list(autotests_for_create)
         self.__autotests_api.adapters_auto_tests_bulk_post(auto_test_create_api_model=autotests_for_create)
 
         logging.debug(f'Autotests were created')
@@ -165,7 +165,7 @@ class BulkAutotestHelper:
     def __update_tests(self, autotests_for_update: List[AutoTestUpdateApiModel]):
         # logging.debug(f'Updating autotests: {autotests_for_update}')
 
-        autotests_for_update = HtmlEscapeUtils.escape_html_in_object(autotests_for_update)
+        autotests_for_update = HtmlEscapeUtils.escape_html_in_object_list(autotests_for_update)
         self.__autotests_api.adapters_auto_tests_bulk_put(auto_test_update_api_model=autotests_for_update)
 
         logging.debug(f'Autotests were updated')
@@ -174,7 +174,7 @@ class BulkAutotestHelper:
     def __load_test_results(self, test_results: List[AutoTestResultsForTestRunModel]):
         # logging.debug(f'Loading test results: {test_results}')
 
-        test_results = HtmlEscapeUtils.escape_html_in_object(test_results)
+        test_results = HtmlEscapeUtils.escape_html_in_object_list(test_results)
         self.__test_runs_api.adapters_test_runs_id_test_results_post(
             id=self.__test_run_id,
             auto_test_results_for_test_run_model=test_results)

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/src/testit_python_commons/models/test_result.py

@@ -1,3 +1,4 @@
+import json
 from typing import List
 
 from testit_python_commons.models.link import Link
@@ -289,7 +290,7 @@ class TestResult:
 
     @adapter_logger
     def set_external_key(self, external_key: str):
-        self.__external_key = external_key
+        self.__external_key = HtmlEscapeUtils.escape_html_tags(external_key)
 
         return self
 
@@ -297,6 +298,19 @@ class TestResult:
     def get_external_key(self) -> str:
         return self.__external_key
 
+    def get_finalize_key(self) -> str:
+        """
+        Identity of one test invocation for bulk dedupe (parametrize-safe).
+        Prefer externalKey (e.g. pytest node id); else externalId + parameters.
+        """
+        if self.__external_key:
+            return self.__external_key
+        params = self.__parameters or {}
+        return '{0}\n{1}'.format(
+            self.__external_id,
+            json.dumps(params, sort_keys=True, default=str, ensure_ascii=False),
+        )
+
     @adapter_logger
     def set_layer(self, layer: str):
         self.__layer = HtmlEscapeUtils.escape_html_tags(layer) if layer else None

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/src/testit_python_commons/services/adapter_manager.py

@@ -5,6 +5,7 @@ import uuid
 from testit_python_commons.client.api_client import ApiClientWorker
 from testit_python_commons.client.client_configuration import ClientConfiguration
 from testit_python_commons.models.adapter_mode import AdapterMode
+from testit_python_commons.models.status_type import StatusType
 from testit_python_commons.models.test_result import TestResult
 from testit_python_commons.services.adapter_manager_configuration import (
     AdapterManagerConfiguration,
@@ -18,6 +19,7 @@ from testit_python_commons.services.sync_storage.sync_storage_runner import (
 )
 
 SYNC_STORAGE_AVAILABLE = True
+IN_PROGRESS_LITERAL = "InProgress"
 
 
 class AdapterManager:
@@ -33,6 +35,9 @@ class AdapterManager:
         self.__api_client = ApiClientWorker(client_configuration)
         self.__fixture_manager = fixture_manager
         self.__test_result_map = {}
+        # Keys of results already sent at test finish (externalKey or externalId+params).
+        # Must not be bare externalId — parametrize shares one externalId.
+        self.__finalized_result_keys = set()
         self.__test_results = []
         self.__test_run_metadata_applied = False
 
@@ -146,23 +151,32 @@ class AdapterManager:
 
     @adapter_logger
     def write_test(self, test_result: TestResult) -> None:
-        if self.__config.should_import_realtime():
-            self.__write_test_realtime(test_result)
-            return
-
-        # for realtime false
-        # if
-        logging.debug("Is already in progress: " + str(self.__is_already_in_progress()))
-        # Handle Sync Storage integration if available
-        # Check if current worker is master and no test is in progress
-        if self.__is_active_syncstorage_instance() and self.__is_master_and_no_in_progress():
-            logging.debug(f"Outcome: {test_result.get_outcome()}")
-            is_ok = self.on_master_no_already_in_progress(test_result)
-            if is_ok:
+        try:
+            if self.__config.should_import_realtime():
+                self.__write_test_realtime(test_result)
                 return
-            # else continue normal processing
 
-        self.__test_results.append(test_result)
+            # for realtime false
+            # if
+            logging.debug("Is already in progress: " + str(self.__is_already_in_progress()))
+            # Handle Sync Storage integration if available
+            # Check if current worker is master and no test is in progress
+            if self.__is_active_syncstorage_instance() and self.__is_master_and_no_in_progress():
+                logging.debug(f"Outcome: {test_result.get_outcome()}")
+                is_ok = self.on_master_no_already_in_progress(test_result)
+                if is_ok:
+                    return
+                # else continue normal processing
+
+            self.__test_results.append(test_result)
+        except Exception as exc:
+            # Do not abort the pytest/session run if TMS rejects one result (e.g. XSS validation)
+            logging.error(
+                'Failed to write test result for external_id="%s", parameters=%s: %s',
+                test_result.get_external_id(),
+                test_result.get_parameters(),
+                exc,
+            )
 
 
     @adapter_logger
@@ -189,12 +203,31 @@ class AdapterManager:
         self.__sync_storage_runner.set_is_already_in_progress(True)
 
         try:
-            # Final status via sendTestResults (create); never change status via PUT.
+            # Mode 0: finalize in TMS now (TP-bound InProgress / orphan fix).
+            # Modes 1/2: post InProgress to TMS; Work X finalizes from the cut.
+            if self.__config.get_mode() == AdapterMode.USE_FILTER:
+                logging.debug(
+                    "SyncStorage accepted %s; sendTestResults with final status (mode 0)",
+                    test_result.get_external_id(),
+                )
+                self._write_test_realtime_internal(test_result)
+                return True
+
+            final_outcome = test_result.get_outcome()
+            final_status_type = test_result.get_status_type()
             logging.debug(
-                "SyncStorage accepted %s; sendTestResults with final status",
+                "SyncStorage accepted %s; sendTestResults InProgress (Work X will finalize)",
                 test_result.get_external_id(),
             )
-            self._write_test_realtime_internal(test_result)
+            try:
+                test_result.set_outcome(IN_PROGRESS_LITERAL)
+                test_result.set_status_type(StatusType.INPROGRESS)
+                self._write_test_realtime_internal(test_result)
+            finally:
+                if final_outcome is not None:
+                    test_result.set_outcome(final_outcome)
+                if final_status_type is not None:
+                    test_result.set_status_type(final_status_type)
             return True
         except Exception as e:
             logging.warning(
@@ -233,7 +266,9 @@ class AdapterManager:
             logging.warning(test_result)
             return
 
+        # Fixture attach (realtime) still indexes by externalId.
         self.__test_result_map[ext_id] = test_result_id
+        self.__finalized_result_keys.add(test_result.get_finalize_key())
 
     @adapter_logger
     def write_tests(self) -> None:
@@ -265,7 +300,7 @@ class AdapterManager:
         self.__api_client.write_tests(
             self.__test_results,
             fixtures,
-            finalized_external_ids=set(self.__test_result_map.keys()),
+            finalized_result_keys=set(self.__finalized_result_keys),
         )
 
     @adapter_logger

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/src/testit_python_commons/utils/html_escape_utils.py

@@ -15,23 +15,18 @@ class HtmlEscapeUtils:
     
     NO_ESCAPE_HTML_ENV_VAR = "NO_ESCAPE_HTML"
     
-    # Regex pattern to detect HTML tags (requires at least one non-whitespace character after <)
-    # This ensures empty <> brackets are not considered HTML tags
-    _HTML_TAG_PATTERN = re.compile(r'<\S.*?(?:>|/>)')
-    
-    # Regex patterns to escape only non-escaped characters
-    # Using negative lookbehind to avoid double escaping
-    _LESS_THAN_PATTERN = re.compile('<')
-    _GREATER_THAN_PATTERN = re.compile('>')
-    
+    # Align with Java adapters: tag must start with letter, '!' or '/'
+    _HTML_TAG_PATTERN = re.compile(
+        r'''<[a-zA-Z!/][^<>"']*(?:"[^"]*"[^<>"']*|'[^']*'[^<>"']*)*>'''
+    )
+
     @staticmethod
     def escape_html_tags(text: Optional[str]) -> Optional[str]:
         """
         Escapes HTML tags to prevent XSS attacks.
         First checks if the string contains HTML tags using regex pattern.
         Only performs escaping if HTML tags are detected.
-        Escapes all < as \\< and > as \\> only if they are not already escaped.
-        Uses regex with negative lookbehind to avoid double escaping.
+        Escapes < as &lt; and > as &gt; (idempotent for already-escaped text).
         
         Args:
             text: The text to escape
@@ -51,11 +46,7 @@ class HtmlEscapeUtils:
         if not HtmlEscapeUtils._HTML_TAG_PATTERN.search(text):
             return text  # No HTML tags found, return original string
             
-        # Use regex with negative lookbehind to escape only non-escaped characters
-        result = HtmlEscapeUtils._LESS_THAN_PATTERN.sub('&lt;', text)
-        result = HtmlEscapeUtils._GREATER_THAN_PATTERN.sub('&gt;', result)
-        
-        return result
+        return text.replace('<', '&lt;').replace('>', '&gt;')
     
     @staticmethod
     def escape_html_in_object(obj: Any) -> Any:
@@ -80,7 +71,12 @@ class HtmlEscapeUtils:
             return obj
             
         try:
-            HtmlEscapeUtils._process_object_attributes(obj)
+            if isinstance(obj, list):
+                HtmlEscapeUtils._process_list(obj)
+            elif isinstance(obj, dict):
+                HtmlEscapeUtils._process_dict(obj)
+            else:
+                HtmlEscapeUtils._process_object_attributes(obj)
         except Exception as e:
             # Silently ignore reflection errors
             logging.debug(f"Error processing object attributes: {e}")
@@ -90,7 +86,7 @@ class HtmlEscapeUtils:
     @staticmethod
     def escape_html_in_object_list(obj_list: Optional[List[Any]]) -> Optional[List[Any]]:
         """
-        Escapes HTML tags in all string attributes of objects in a list using reflection.
+        Escapes HTML tags in list items: strings in-place, objects via reflection.
         Can be disabled by setting NO_ESCAPE_HTML environment variable to "true".
         
         Args:
@@ -106,47 +102,68 @@ class HtmlEscapeUtils:
         no_escape_html = os.environ.get(HtmlEscapeUtils.NO_ESCAPE_HTML_ENV_VAR, "").lower()
         if no_escape_html == "true":
             return obj_list
-            
-        for obj in obj_list:
-            HtmlEscapeUtils.escape_html_in_object(obj)
-            
+
+        HtmlEscapeUtils._process_list(obj_list)
         return obj_list
     
+    @staticmethod
+    def _process_dict(obj: dict) -> None:
+        for key, value in obj.items():
+            if isinstance(value, str):
+                obj[key] = HtmlEscapeUtils.escape_html_tags(value)
+            elif isinstance(value, list):
+                HtmlEscapeUtils._process_list(value)
+            elif isinstance(value, dict):
+                HtmlEscapeUtils._process_dict(value)
+            elif value is not None and not HtmlEscapeUtils._is_simple_type(type(value)):
+                HtmlEscapeUtils.escape_html_in_object(value)
+
+    @staticmethod
+    def _iter_object_attr_names(obj: Any):
+        """
+        OpenAPI models store fields in attribute_map/_data_store; they are not listed by dir().
+        Prefer those maps, fall back to public dir() attributes for plain objects.
+        """
+        attribute_map = getattr(obj, 'attribute_map', None)
+        if isinstance(attribute_map, dict) and attribute_map:
+            return attribute_map.keys()
+
+        data_store = getattr(obj, '_data_store', None)
+        if isinstance(data_store, dict) and data_store:
+            return data_store.keys()
+
+        return (
+            attr_name for attr_name in dir(obj)
+            if not attr_name.startswith('_') and not callable(getattr(obj, attr_name, None))
+        )
+
+    @staticmethod
+    def _should_skip_attr(attr_name: str) -> bool:
+        return (
+            attr_name.startswith('_')
+            or attr_name.startswith("external_id")
+            or attr_name.startswith("externalId")
+            or attr_name.startswith("auto_test_external_id")
+            or attr_name.startswith("autoTestExternalId")
+        )
+
     @staticmethod
     def _process_object_attributes(obj: Any) -> None:
         """
         Process all attributes of an object for HTML escaping.
         """
-        # Handle dictionary-like objects (common in API models)
-        if hasattr(obj, '__dict__'):
-            for attr_name in dir(obj):
-                # Skip private/protected attributes and methods
-                if attr_name.startswith('_') or callable(getattr(obj, attr_name, None)):
-                    continue
-                if (
-                    attr_name.startswith("external_id")
-                    or attr_name.startswith("externalId")
-                    or attr_name.startswith("auto_test_external_id")
-                    or attr_name.startswith("autoTestExternalId")
-                ):
+        for attr_name in HtmlEscapeUtils._iter_object_attr_names(obj):
+            if HtmlEscapeUtils._should_skip_attr(attr_name):
+                continue
+
+            try:
+                value = getattr(obj, attr_name, None)
+                if callable(value):
                     continue
-                    
-                try:
-                    value = getattr(obj, attr_name)
-                    HtmlEscapeUtils._process_attribute_value(obj, attr_name, value)
-                except Exception as e:
-                    # Silently ignore attribute errors
-                    logging.debug(f"Error processing attribute {attr_name}: {e}")
-                    
-        # Handle dictionary objects
-        elif isinstance(obj, dict):
-            for key, value in obj.items():
-                if isinstance(value, str):
-                    obj[key] = HtmlEscapeUtils.escape_html_tags(value)
-                elif isinstance(value, list):
-                    HtmlEscapeUtils._process_list(value)
-                elif not HtmlEscapeUtils._is_simple_type(type(value)):
-                    HtmlEscapeUtils.escape_html_in_object(value)
+                HtmlEscapeUtils._process_attribute_value(obj, attr_name, value)
+            except Exception as e:
+                # Silently ignore attribute errors
+                logging.debug(f"Error processing attribute {attr_name}: {e}")
     
     @staticmethod
     def _process_attribute_value(obj: Any, attr_name: str, value: Any) -> None:
@@ -162,6 +179,13 @@ class HtmlEscapeUtils:
                 pass
         elif isinstance(value, list):
             HtmlEscapeUtils._process_list(value)
+        elif isinstance(value, dict):
+            HtmlEscapeUtils._process_dict(value)
+            try:
+                # Write back so OpenAPI models that return dict copies keep escaped values
+                setattr(obj, attr_name, value)
+            except AttributeError:
+                pass
         elif value is not None and not HtmlEscapeUtils._is_simple_type(type(value)):
             # Process nested objects (but not simple types)
             HtmlEscapeUtils.escape_html_in_object(value)

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/src/testit_python_commons.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: testit-python-commons
-Version: 5.2.0
+Version: 5.2.2
 Summary: Python commons for Test IT
 Home-page: https://github.com/testit-tms/adapters-python/
 Author: Integration team

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/src/testit_python_commons.egg-info/SOURCES.txt

@@ -275,4 +275,5 @@ src/testit_python_commons/utils/__init__.py
 src/testit_python_commons/utils/html_escape_utils.py
 tests/test_app_properties.py
 tests/test_dynamic_methods.py
-tests/test_html_escape_utils.py
+tests/test_html_escape_utils.py
+tests/test_xss_parameters_escape.py

{testit_python_commons-5.2.0 → testit_python_commons-5.2.2}/tests/test_html_escape_utils.py

@@ -101,6 +101,32 @@ class TestHtmlEscapeUtils(unittest.TestCase):
         self.assertEqual(result[0].description, "<div>content</div>")
         self.assertEqual(result[1].description, "<span>more</span>")
 
+    def test_escape_html_in_object_accepts_list(self):
+        """Bulk send path passes a list — must escape each item, not no-op."""
+        test_list = [
+            SampleData("First", "<script>alert(1)</script>"),
+            SampleData("Second", "<img src=x onerror=alert(1)>"),
+        ]
+        result = HtmlEscapeUtils.escape_html_in_object(test_list)
+
+        self.assertEqual(result[0].description, "&lt;script&gt;alert(1)&lt;/script&gt;")
+        self.assertEqual(result[1].description, "&lt;img src=x onerror=alert(1)&gt;")
+
+    def test_escape_html_in_list_of_strings(self):
+        tags = ["<script>alert(1)</script>", "safe", "<b>x</b>"]
+        result = HtmlEscapeUtils.escape_html_in_object(tags)
+
+        self.assertEqual(result[0], "&lt;script&gt;alert(1)&lt;/script&gt;")
+        self.assertEqual(result[1], "safe")
+        self.assertEqual(result[2], "&lt;b&gt;x&lt;/b&gt;")
+
+    def test_escape_html_in_list_of_dicts(self):
+        labels = [{"name": "<script>alert(1)</script>"}, {"name": "ok"}]
+        result = HtmlEscapeUtils.escape_html_in_object(labels)
+
+        self.assertEqual(result[0]["name"], "&lt;script&gt;alert(1)&lt;/script&gt;")
+        self.assertEqual(result[1]["name"], "ok")
+
     def test_escape_disabled_by_env_var(self):
         """Test that escaping can be disabled via environment variable"""
         os.environ[HtmlEscapeUtils.NO_ESCAPE_HTML_ENV_VAR] = "true"
@@ -131,6 +157,36 @@ class TestHtmlEscapeUtils(unittest.TestCase):
         self.assertEqual(result["tags"][0], "&lt;tag&gt;")
         self.assertEqual(result["tags"][1], "normal_tag")
 
+    def test_escape_openapi_model_parameters(self):
+        """OpenAPI models hide fields from dir(); parameters must still be escaped."""
+        from adapters_api.models import AutoTestResultsForTestRunModel, TestStatusType
+
+        model = AutoTestResultsForTestRunModel(
+            configuration_id="cfg",
+            auto_test_external_id="ext",
+            status_type=TestStatusType("Succeeded"),
+            parameters={"description": '<script>alert("1")</script>'},
+            message='<img src=x onerror=alert(1)>',
+        )
+        HtmlEscapeUtils.escape_html_in_object(model)
+
+        self.assertEqual(
+            model.parameters["description"],
+            '&lt;script&gt;alert("1")&lt;/script&gt;',
+        )
+        self.assertEqual(model.message, "&lt;img src=x onerror=alert(1)&gt;")
+
+    def test_client_s_tag_param_and_legacy_entities(self):
+        """Plain <s>/<script> params escape to entities; already-escaped text stays stable."""
+        self.assertEqual(
+            HtmlEscapeUtils.escape_html_tags('<s>alert("1")</s>'),
+            '&lt;s&gt;alert("1")&lt;/s&gt;',
+        )
+        self.assertEqual(
+            HtmlEscapeUtils.escape_html_tags('&lt;script&gt;alert("1")&lt;/script&gt;'),
+            '&lt;script&gt;alert("1")&lt;/script&gt;',
+        )
+
 
 if __name__ == '__main__':
     unittest.main()

testit_python_commons-5.2.2/tests/test_xss_parameters_escape.py

@@ -0,0 +1,72 @@
+"""Regression: XSS in pytest params must be escaped before TMS API payloads."""
+
+import importlib.util
+import unittest
+from pathlib import Path
+
+from adapters_api import ApiClient
+from testit_python_commons.client.converter import Converter
+from testit_python_commons.models.test_result import TestResult
+from testit_python_commons.utils.html_escape_utils import HtmlEscapeUtils
+
+
+def _load_xss_payloads():
+    path = Path(__file__).resolve().parents[2] / "test_files" / "test_xss_parametrize.py"
+    spec = importlib.util.spec_from_file_location("test_xss_parametrize", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module.XSS_PAYLOADS
+
+
+class TestXssParametersEscape(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.payloads = _load_xss_payloads()
+
+    def test_test_result_parameters_escaped_for_all_payloads(self):
+        for payload in self.payloads:
+            with self.subTest(payload=payload):
+                result = TestResult().set_parameters({"description": payload})
+                value = result.get_parameters()["description"]
+                if HtmlEscapeUtils._HTML_TAG_PATTERN.search(payload):
+                    self.assertNotIn("<script", value.lower().replace("&lt;", ""))
+                    self.assertIn("&lt;", value)
+                    self.assertNotEqual(value, payload)
+                # API model must keep escaped value
+                model = Converter.test_result_to_testrun_result_post_model(
+                    result.set_external_id("ext").set_outcome("Passed").set_status_type("Succeeded").set_duration(1),
+                    "cfg",
+                    ["PASSED"],
+                )
+                self.assertEqual(model.parameters["description"], value)
+                serialized = ApiClient.sanitize_for_serialization(model)
+                self.assertEqual(serialized["parameters"]["description"], value)
+
+    def test_external_key_with_nodeid_xss_is_escaped(self):
+        payload = '<script>alert("1")</script>'
+        node_key = f"tests and test_xss_parametrize.py and test_05_with_chg_xss[{payload}]"
+        result = TestResult().set_external_key(node_key)
+        escaped = result.get_external_key()
+        self.assertIn("&lt;script&gt;", escaped)
+        self.assertNotIn("<script>", escaped)
+
+    def test_bulk_list_escape_mutates_result_models(self):
+        payload = '<script>alert("1")</script>'
+        # Simulate model built WITHOUT going through TestResult setters (raw params)
+        class FakeResult:
+            def __init__(self):
+                self.parameters = {"description": payload}
+                self.message = payload
+
+        models = [FakeResult(), FakeResult()]
+        HtmlEscapeUtils.escape_html_in_object(models)
+        for model in models:
+            self.assertEqual(
+                model.parameters["description"],
+                '&lt;script&gt;alert("1")&lt;/script&gt;',
+            )
+            self.assertEqual(model.message, '&lt;script&gt;alert("1")&lt;/script&gt;')
+
+
+if __name__ == "__main__":
+    unittest.main()