添加error 测试用例，但是测试用例太复杂，还需要优化框架
This commit is contained in:
gongwenxin
@@ -0,0 +1 @@
|
||||
# This file marks the compliance_catalog directory as a Python package.
|
||||
@@ -0,0 +1 @@
|
||||
# This file marks the core_functionality directory as a Python package.
|
||||
BIN
Binary file not shown.
@@ -0,0 +1,81 @@
|
||||
from typing import Dict, Any, Optional, List
|
||||
from ddms_compliance_suite.test_framework_core import BaseAPITestCase, TestSeverity, ValidationResult, APIRequestContext, APIResponseContext
|
||||
import json
|
||||
|
||||
class ResponseSchemaValidationCase(BaseAPITestCase):
|
||||
id = "TC-CORE-FUNC-001"
|
||||
name = "Response Body JSON Schema Validation"
|
||||
description = "验证API响应体是否符合API规范中定义的JSON Schema。"
|
||||
severity = TestSeverity.CRITICAL
|
||||
tags = ["core-functionality", "schema-validation", "output-format"]
|
||||
execution_order = 100 # Default, can be adjusted
|
||||
|
||||
# This test is generally applicable, especially for GET requests or successful POST/PUT.
|
||||
# It might need refinement based on specific endpoint characteristics (e.g., no response body for DELETE)
|
||||
|
||||
def __init__(self, endpoint_spec: Dict[str, Any], global_api_spec: Dict[str, Any], json_schema_validator: Optional[Any] = None):
|
||||
super().__init__(endpoint_spec, global_api_spec, json_schema_validator)
|
||||
self.logger.info(f"测试用例 '{self.id}' 已为端点 '{self.endpoint_spec.get('method')} {self.endpoint_spec.get('path')}' 初始化。")
|
||||
|
||||
def validate_response(self, response_context: APIResponseContext, request_context: APIRequestContext) -> List[ValidationResult]:
|
||||
results = []
|
||||
method = request_context.method.upper()
|
||||
status_code = response_context.status_code
|
||||
|
||||
# Determine the expected response schema based on method and status code
|
||||
# This logic might need to be more sophisticated depending on how schemas are structured in your API spec (YAPI/Swagger)
|
||||
expected_schema = None
|
||||
response_spec_key = None
|
||||
|
||||
if 'responses' in self.endpoint_spec: # OpenAPI/Swagger style
|
||||
if str(status_code) in self.endpoint_spec['responses']:
|
||||
response_def = self.endpoint_spec['responses'][str(status_code)]
|
||||
if 'content' in response_def and 'application/json' in response_def['content']:
|
||||
expected_schema = response_def['content']['application/json'].get('schema')
|
||||
response_spec_key = f"responses.{status_code}.content.application/json.schema"
|
||||
elif 'default' in self.endpoint_spec['responses']: # Fallback to default response
|
||||
response_def = self.endpoint_spec['responses']['default']
|
||||
if 'content' in response_def and 'application/json' in response_def['content']:
|
||||
expected_schema = response_def['content']['application/json'].get('schema')
|
||||
response_spec_key = f"responses.default.content.application/json.schema"
|
||||
elif 'res_body_type' in self.endpoint_spec and self.endpoint_spec['res_body_type'] == 'json': # YAPI style (simplified)
|
||||
if 'res_body_is_json_schema' in self.endpoint_spec and self.endpoint_spec['res_body_is_json_schema']:
|
||||
if self.endpoint_spec.get('res_body'):
|
||||
try:
|
||||
# YAPI often stores schema as a JSON string
|
||||
expected_schema = json.loads(self.endpoint_spec['res_body'])
|
||||
response_spec_key = "res_body (从JSON字符串解析)"
|
||||
except json.JSONDecodeError as e:
|
||||
self.logger.error(f"从YAPI res_body解析JSON schema失败: {e}")
|
||||
results.append(self.failed(f"无法从YAPI规范解析响应schema: {e}"))
|
||||
return results
|
||||
|
||||
# Only proceed with schema validation if we have a schema and a JSON response body
|
||||
if expected_schema and response_context.json_content is not None:
|
||||
self.logger.info(f"将根据路径 '{response_spec_key or '未知位置'}' 的schema验证响应体。")
|
||||
schema_validation_results = self.validate_data_against_schema(
|
||||
data_to_validate=response_context.json_content,
|
||||
schema_definition=expected_schema,
|
||||
context_message_prefix=f"针对 {method} {request_context.url} (状态码 {status_code}) 的响应体"
|
||||
)
|
||||
results.extend(schema_validation_results)
|
||||
elif response_context.json_content is None and method not in ["DELETE", "HEAD", "OPTIONS"] and status_code in [200, 201, 202]:
|
||||
# If we expected a JSON body (e.g. for successful GET/POST) but got none
|
||||
if expected_schema: # and if a schema was defined
|
||||
results.append(self.failed(
|
||||
message=f"根据schema期望一个JSON响应体，但未收到可解析的JSON内容。",
|
||||
details={"status_code": status_code, "response_text_sample": (response_context.text_content or "")[:200]}
|
||||
))
|
||||
self.logger.warning(f"期望 {method} {request_context.url} 返回JSON响应体，但未收到或非JSON格式。")
|
||||
elif not expected_schema and response_context.json_content is not None and status_code // 100 == 2:
|
||||
# If there is a JSON body but no schema was found for successful responses
|
||||
self.logger.info(f"响应包含JSON体，但在API规范中未找到针对状态码 {status_code} 的JSON schema。跳过schema验证。")
|
||||
# Optionally, add an informational validation result:
|
||||
# results.append(ValidationResult(passed=True, message="Response has JSON body, but no schema defined for validation.", details={"status_code": status_code}))
|
||||
elif not expected_schema and response_context.json_content is None:
|
||||
self.logger.info(f"状态码 {status_code} 的响应无JSON体也无定义的schema。跳过schema验证。")
|
||||
|
||||
if not results: # If no specific validation was added (e.g. schema not found but not an error)
|
||||
results.append(self.passed("Schema验证步骤完成（未发现问题，或schema不适用/未为此响应定义）。"))
|
||||
|
||||
return results
|
||||
@@ -0,0 +1 @@
|
||||
# This file marks the error_handling directory as a Python package.
|
||||
BIN
Binary file not shown.
BIN
Binary file not shown.
+296
@@ -0,0 +1,296 @@
|
||||
from typing import Dict, Any, Optional, List
|
||||
from ddms_compliance_suite.test_framework_core import BaseAPITestCase, TestSeverity, ValidationResult, APIRequestContext, APIResponseContext
|
||||
import copy
|
||||
import logging
|
||||
|
||||
class MissingRequiredFieldBodyCase(BaseAPITestCase):
|
||||
id = "TC-ERROR-4003-BODY"
|
||||
name = "Error Code 4003 - Missing Required Request Body Field Validation"
|
||||
description = "测试当请求体中缺少API规范定义的必填字段时，API是否按预期返回类似4003的错误（或通用400错误）。"
|
||||
severity = TestSeverity.HIGH
|
||||
tags = ["error-handling", "appendix-b", "4003", "required-fields", "request-body"]
|
||||
execution_order = 210 # Before query, same as original combined
|
||||
|
||||
def __init__(self, endpoint_spec: Dict[str, Any], global_api_spec: Dict[str, Any], json_schema_validator: Optional[Any] = None):
|
||||
super().__init__(endpoint_spec, global_api_spec, json_schema_validator)
|
||||
self.logger.setLevel(logging.DEBUG) # Ensure detailed logging for this class
|
||||
self.removed_field_path: Optional[List[str]] = None # Path to the removed field, e.g., ['level1', 'level2_field']
|
||||
self.original_body_schema: Optional[Dict[str, Any]] = None
|
||||
self._try_find_removable_body_field()
|
||||
|
||||
def _resolve_ref_if_present(self, schema_to_resolve: Dict[str, Any]) -> Dict[str, Any]:
|
||||
ref_value = None
|
||||
if isinstance(schema_to_resolve, dict):
|
||||
if "$ref" in schema_to_resolve:
|
||||
ref_value = schema_to_resolve["$ref"]
|
||||
elif "$$ref" in schema_to_resolve:
|
||||
ref_value = schema_to_resolve["$$ref"]
|
||||
|
||||
if ref_value:
|
||||
self.logger.debug(f"发现引用 '{ref_value}'，尝试解析...")
|
||||
try:
|
||||
actual_global_spec_dict = None
|
||||
if hasattr(self.global_api_spec, 'spec') and isinstance(self.global_api_spec.spec, dict):
|
||||
actual_global_spec_dict = self.global_api_spec.spec
|
||||
elif isinstance(self.global_api_spec, dict):
|
||||
actual_global_spec_dict = self.global_api_spec
|
||||
|
||||
if not actual_global_spec_dict:
|
||||
self.logger.warning(f"无法从 self.global_api_spec (类型: {type(self.global_api_spec)}) 获取用于解析引用的字典。")
|
||||
return schema_to_resolve
|
||||
|
||||
resolved_schema = None
|
||||
if ref_value.startswith("#/components/schemas/"):
|
||||
schema_name = ref_value.split("/")[-1]
|
||||
components = actual_global_spec_dict.get("components")
|
||||
if components and isinstance(components.get("schemas"), dict):
|
||||
resolved_schema = components["schemas"].get(schema_name)
|
||||
if resolved_schema and isinstance(resolved_schema, dict):
|
||||
self.logger.info(f"成功从 #/components/schemas/ 解析引用 '{ref_value}'。")
|
||||
return resolved_schema
|
||||
else:
|
||||
self.logger.warning(f"解析引用 '{ref_value}' (路径: #/components/schemas/) 失败：未找到或找到的不是字典: {schema_name}")
|
||||
else:
|
||||
self.logger.warning(f"尝试从 #/components/schemas/ 解析引用 '{ref_value}' 失败：无法找到 'components.schemas' 结构。")
|
||||
|
||||
# 如果从 #/components/schemas/ 未成功解析，尝试 #/definitions/
|
||||
if not resolved_schema and ref_value.startswith("#/definitions/"):
|
||||
schema_name = ref_value.split("/")[-1]
|
||||
definitions = actual_global_spec_dict.get("definitions")
|
||||
if definitions and isinstance(definitions, dict):
|
||||
resolved_schema = definitions.get(schema_name)
|
||||
if resolved_schema and isinstance(resolved_schema, dict):
|
||||
self.logger.info(f"成功从 #/definitions/ 解析引用 '{ref_value}'。")
|
||||
return resolved_schema
|
||||
else:
|
||||
self.logger.warning(f"解析引用 '{ref_value}' (路径: #/definitions/) 失败：未找到或找到的不是字典: {schema_name}")
|
||||
else:
|
||||
self.logger.warning(f"尝试从 #/definitions/ 解析引用 '{ref_value}' 失败：无法找到 'definitions' 结构。")
|
||||
|
||||
if not resolved_schema:
|
||||
self.logger.warning(f"最终未能通过任一已知路径 (#/components/schemas/ 或 #/definitions/) 解析引用 '{ref_value}'。")
|
||||
|
||||
except Exception as e:
|
||||
self.logger.error(f"解析引用 '{ref_value}' 时发生错误: {e}", exc_info=True)
|
||||
return schema_to_resolve # 返回原始 schema 如果不是 ref 或者所有解析尝试都失败
|
||||
|
||||
def _find_required_field_in_schema_recursive(self, current_schema: Dict[str, Any], current_path: List[str]) -> Optional[List[str]]:
|
||||
"""递归查找第一个可移除的必填字段的路径。
|
||||
现在也会查找数组内对象中必填的字段。"""
|
||||
resolved_schema = self._resolve_ref_if_present(current_schema)
|
||||
|
||||
if not isinstance(resolved_schema, dict) or resolved_schema.get("type") != "object":
|
||||
# If not an object schema, cannot have 'required' or 'properties' in the way we expect.
|
||||
return None
|
||||
|
||||
required_fields_at_current_level = resolved_schema.get("required", [])
|
||||
properties = resolved_schema.get("properties", {})
|
||||
self.logger.debug(f"递归查找路径: {current_path}, 当前层级必填字段: {required_fields_at_current_level}, 属性: {list(properties.keys())}")
|
||||
|
||||
# 策略1: 查找当前层级直接声明的必填字段 (简单类型或复杂类型均可)
|
||||
if required_fields_at_current_level and properties:
|
||||
for field_name in required_fields_at_current_level:
|
||||
if field_name in properties:
|
||||
# 任何在 'required' 数组中列出的字段，无论其类型，都可以作为目标
|
||||
# (例如，移除一个必填的整个对象或数组也是一种有效的测试场景)
|
||||
self.logger.info(f"策略1: 在路径 {'.'.join(current_path) if current_path else 'root'} 找到可直接移除的必填字段: '{field_name}'")
|
||||
return current_path + [field_name]
|
||||
|
||||
# 策略2: 如果当前层级没有直接的必填字段可移除，则查找数组属性，看其内部item是否有必填字段
|
||||
# 这种情况下，数组本身可能不是必填的，但如果提供了数组，其item需要满足条件
|
||||
if properties: # 确保有属性可迭代
|
||||
for prop_name, prop_schema_orig in properties.items():
|
||||
prop_schema = self._resolve_ref_if_present(prop_schema_orig) # 解析属性自身的schema (可能也是ref)
|
||||
if isinstance(prop_schema, dict) and prop_schema.get("type") == "array":
|
||||
items_schema_orig = prop_schema.get("items")
|
||||
if isinstance(items_schema_orig, dict):
|
||||
items_schema = self._resolve_ref_if_present(items_schema_orig) # 解析 items 的 schema
|
||||
if isinstance(items_schema, dict) and items_schema.get("type") == "object":
|
||||
item_required_fields = items_schema.get("required", [])
|
||||
item_properties = items_schema.get("properties", {})
|
||||
if item_required_fields and item_properties:
|
||||
first_required_field_in_item = None
|
||||
for req_item_field in item_required_fields:
|
||||
if req_item_field in item_properties: # 确保该必填字段在属性中定义
|
||||
first_required_field_in_item = req_item_field
|
||||
break
|
||||
|
||||
if first_required_field_in_item:
|
||||
self.logger.info(f"策略2: 在数组属性 '{prop_name}' (路径 {'.'.join(current_path) if current_path else 'root'}) 的元素内找到必填字段: '{first_required_field_in_item}'. 将尝试移除路径: {current_path + [prop_name, 0, first_required_field_in_item]}")
|
||||
# 将路径指向数组的第一个元素 (index 0) 内的那个必填字段
|
||||
return current_path + [prop_name, 0, first_required_field_in_item]
|
||||
|
||||
# 策略3: （可选，如果需要更深层次的普通对象递归）
|
||||
# 如果以上策略都未找到，并且希望深入到非必填的子对象中查找，可以启用以下逻辑。
|
||||
# 但这通常不用于"顶层必填字段缺失"的测试目的，除非测试用例目标是验证任意深度的必填。
|
||||
# for prop_name, prop_schema_orig_for_recurse in properties.items():
|
||||
# prop_schema_for_recurse = self._resolve_ref_if_present(prop_schema_orig_for_recurse)
|
||||
# if isinstance(prop_schema_for_recurse, dict) and prop_schema_for_recurse.get("type") == "object":
|
||||
# # 确保不陷入无限循环，例如，如果一个对象属性是可选的但其内部有必填字段
|
||||
# # 这里需要小心，因为我们可能已经检查过当前级别的required字段
|
||||
# # 主要用于当某个对象不是顶层必填，但如果提供了它，它内部又有必填项的场景
|
||||
# # 但这与当前测试用例的 primary goal 可能不完全一致
|
||||
# self.logger.debug(f"策略3: 尝试递归进入对象属性 '{prop_name}' (路径 {'.'.join(current_path)}) (此对象本身在当前层级非必填或已检查)")
|
||||
# found_path_deeper = self._find_required_field_in_schema_recursive(prop_schema_for_recurse, current_path + [prop_name])
|
||||
# if found_path_deeper:
|
||||
# # 确保返回的路径确实比当前路径深，并且该深层路径的父级（即prop_name）不是当前层级已知的必填字段
|
||||
# # (以避免重复发现已被策略1覆盖的场景)
|
||||
# # if prop_name not in required_fields_at_current_level:
|
||||
# self.logger.info(f"策略3: 递归在对象属性 '{prop_name}' (路径 {'.'.join(current_path)}) 中找到必填字段路径: {found_path_deeper}")
|
||||
# return found_path_deeper
|
||||
|
||||
self.logger.debug(f"在路径 {'.'.join(current_path) if current_path else 'root'} 未通过任何策略找到可移除的必填字段。")
|
||||
return None
|
||||
def _try_find_removable_body_field(self):
|
||||
body_schema_to_check: Optional[Dict[str, Any]] = None
|
||||
request_body_spec = self.endpoint_spec.get("requestBody")
|
||||
if request_body_spec and isinstance(request_body_spec, dict):
|
||||
content = request_body_spec.get("content", {})
|
||||
json_schema_entry = content.get("application/json")
|
||||
if json_schema_entry and isinstance(json_schema_entry, dict) and isinstance(json_schema_entry.get("schema"), dict):
|
||||
body_schema_to_check = json_schema_entry["schema"]
|
||||
|
||||
if not body_schema_to_check:
|
||||
parameters = self.endpoint_spec.get("parameters", [])
|
||||
if isinstance(parameters, list):
|
||||
for param in parameters:
|
||||
if isinstance(param, dict) and param.get("in") == "body":
|
||||
if isinstance(param.get("schema"), dict):
|
||||
body_schema_to_check = param["schema"]
|
||||
break
|
||||
|
||||
if body_schema_to_check:
|
||||
self.original_body_schema = copy.deepcopy(body_schema_to_check)
|
||||
self.removed_field_path = self._find_required_field_in_schema_recursive(self.original_body_schema, [])
|
||||
if self.removed_field_path:
|
||||
self.logger.info(f"必填字段缺失测试的目标字段 (请求体): '{'.'.join(map(str, self.removed_field_path))}'")
|
||||
self.field_to_remove_details = {
|
||||
"path": self.removed_field_path,
|
||||
# ... existing code ...
|
||||
}
|
||||
else:
|
||||
self.logger.info('在请求体 schema 中未找到可用于测试 "必填字段缺失" 的字段。')
|
||||
else:
|
||||
self.logger.info('此端点规范中未定义请求体 schema。')
|
||||
|
||||
def generate_query_params(self, current_query_params: Dict[str, Any]) -> Dict[str, Any]:
|
||||
self.logger.debug(f"{self.id} is focused on request body, generate_query_params will not modify query parameters.")
|
||||
return current_query_params
|
||||
|
||||
def generate_request_body(self, current_body: Optional[Any]) -> Optional[Any]:
|
||||
if not self.removed_field_path:
|
||||
self.logger.debug("No field path identified for removal in request body.")
|
||||
return current_body
|
||||
|
||||
if current_body is None:
|
||||
self.logger.debug("current_body is None. Orchestrator should ideally provide a base body. Attempting to build minimal structure for removal.")
|
||||
new_body = {}
|
||||
else:
|
||||
new_body = copy.deepcopy(current_body)
|
||||
|
||||
temp_obj_ref = new_body
|
||||
|
||||
try:
|
||||
for i, key_or_index in enumerate(self.removed_field_path):
|
||||
is_last_element = (i == len(self.removed_field_path) - 1)
|
||||
|
||||
if is_last_element:
|
||||
if isinstance(key_or_index, str): # Key for a dictionary (field name)
|
||||
if isinstance(temp_obj_ref, dict) and key_or_index in temp_obj_ref:
|
||||
original_value = temp_obj_ref.pop(key_or_index)
|
||||
self.logger.info(f"为进行必填字段缺失测试，已从请求体中移除字段路径 '{'.'.join(map(str,self.removed_field_path))}' (原值: '{original_value}')。")
|
||||
return new_body
|
||||
elif isinstance(temp_obj_ref, dict): # Key not in dict, but it's a dict
|
||||
self.logger.warning(f"计划移除的请求体字段路径的最后一部分 '{key_or_index}' (string key) 在对象中未找到，但该对象是字典。可能该字段本就是可选的或不存在于提供的current_body。路径: {'.'.join(map(str,self.removed_field_path))}")
|
||||
return new_body
|
||||
else: # temp_obj_ref is not a dict
|
||||
self.logger.warning(f"计划移除的请求体字段路径的最后一部分 '{key_or_index}' (string key) 期望父级是字典，但找到 {type(temp_obj_ref)}。路径: {'.'.join(map(str,self.removed_field_path))}")
|
||||
return current_body
|
||||
else: # Last element of path is an index - this should not happen as we remove a *field name*
|
||||
self.logger.error(f"路径的最后一部分 '{key_or_index}' 预期为字符串字段名，但类型为 {type(key_or_index)}. Path: {'.'.join(map(str,self.removed_field_path))}")
|
||||
return current_body
|
||||
else: # Not the last element, so we are traversing or building the structure
|
||||
next_key_or_index = self.removed_field_path[i+1]
|
||||
|
||||
if isinstance(key_or_index, str): # Current path part is a dictionary key
|
||||
if not isinstance(temp_obj_ref, dict):
|
||||
self.logger.warning(f"路径期望字典，但在 '{key_or_index}' (父级)处找到 {type(temp_obj_ref)}. Path: {'.'.join(map(str,self.removed_field_path))}. 如果current_body为None，则尝试创建字典。")
|
||||
if temp_obj_ref is new_body and not new_body :
|
||||
temp_obj_ref = {}
|
||||
else:
|
||||
return current_body
|
||||
|
||||
if isinstance(next_key_or_index, int):
|
||||
if key_or_index not in temp_obj_ref or not isinstance(temp_obj_ref.get(key_or_index), list):
|
||||
self.logger.debug(f"路径 '{key_or_index}' 需要是列表 (为索引 {next_key_or_index} 做准备)，但未找到或类型不符。将创建空列表。")
|
||||
temp_obj_ref[key_or_index] = []
|
||||
temp_obj_ref = temp_obj_ref[key_or_index]
|
||||
else:
|
||||
if key_or_index not in temp_obj_ref or not isinstance(temp_obj_ref.get(key_or_index), dict):
|
||||
self.logger.debug(f"路径 '{key_or_index}' 需要是字典 (为键 '{next_key_or_index}' 做准备)，但未找到或类型不符。将创建空字典。")
|
||||
temp_obj_ref[key_or_index] = {}
|
||||
temp_obj_ref = temp_obj_ref[key_or_index]
|
||||
|
||||
elif isinstance(key_or_index, int):
|
||||
if not isinstance(temp_obj_ref, list):
|
||||
self.logger.error(f"路径期望列表以应用索引 '{key_or_index}'，但找到 {type(temp_obj_ref)}. Path: {'.'.join(map(str,self.removed_field_path))}")
|
||||
return current_body
|
||||
|
||||
while len(temp_obj_ref) <= key_or_index:
|
||||
self.logger.debug(f"数组在索引 {key_or_index} 处需要元素，将添加空字典作为占位符（因为后续预期是字段名）。")
|
||||
temp_obj_ref.append({})
|
||||
|
||||
if isinstance(next_key_or_index, str):
|
||||
if not isinstance(temp_obj_ref[key_or_index], dict):
|
||||
self.logger.debug(f"数组项 at index {key_or_index} 需要是字典 (为键 '{next_key_or_index}' 做准备)。如果它是其他类型，将被替换为空字典。")
|
||||
temp_obj_ref[key_or_index] = {}
|
||||
|
||||
temp_obj_ref = temp_obj_ref[key_or_index]
|
||||
|
||||
else:
|
||||
self.logger.error(f"路径部分 '{key_or_index}' 类型未知 ({type(key_or_index)}). Path: {'.'.join(map(str,self.removed_field_path))}")
|
||||
return current_body
|
||||
except Exception as e: # Ensuring the try has an except
|
||||
self.logger.error(f"在准备移除字段路径 '{'.'.join(map(str,self.removed_field_path))}' 时发生错误: {e}", exc_info=True)
|
||||
return current_body
|
||||
|
||||
self.logger.error(f"generate_request_body 未能在循环内按预期返回。路径: {'.'.join(map(str,self.removed_field_path))}")
|
||||
return current_body
|
||||
|
||||
def validate_response(self, response_context: APIResponseContext, request_context: APIRequestContext) -> List[ValidationResult]:
|
||||
results = []
|
||||
if not self.removed_field_path:
|
||||
results.append(self.passed("跳过测试：在API规范中未找到合适的必填请求体字段用于移除测试。"))
|
||||
self.logger.info("由于未识别到可移除的必填请求体字段，跳过此测试用例。")
|
||||
return results
|
||||
|
||||
status_code = response_context.status_code
|
||||
json_content = response_context.json_content
|
||||
expected_status_codes = [400, 422]
|
||||
specific_error_code_from_appendix_b = "4003"
|
||||
removed_field_str = '.'.join(map(str, self.removed_field_path))
|
||||
|
||||
msg_prefix = f"当移除必填请求体字段 '{removed_field_str}' 时，"
|
||||
|
||||
if status_code in expected_status_codes:
|
||||
status_msg = f"{msg_prefix}API响应了预期的错误状态码 {status_code}。"
|
||||
if json_content and isinstance(json_content, dict) and str(json_content.get("code")) == specific_error_code_from_appendix_b:
|
||||
results.append(self.passed(f"{status_msg} 且响应体中包含特定的错误码 '{specific_error_code_from_appendix_b}'。"))
|
||||
self.logger.info(f"正确接收到状态码 {status_code} 和错误码 '{specific_error_code_from_appendix_b}'。")
|
||||
elif json_content and isinstance(json_content, dict) and "code" in json_content:
|
||||
results.append(ValidationResult(passed=True,
|
||||
message=f"{status_msg} 响应体中的错误码为 '{json_content.get('code')}' (期望或类似 '{specific_error_code_from_appendix_b}')。",
|
||||
details=json_content
|
||||
))
|
||||
self.logger.warning(f"接收到状态码 {status_code}，但错误码是 '{json_content.get('code')}' 而不是期望的 '{specific_error_code_from_appendix_b}'。此结果仍标记为通过，因状态码正确。")
|
||||
else:
|
||||
results.append(self.passed(f"{status_msg} 但响应体中未找到特定的错误码字段或响应体结构不符合预期。"))
|
||||
self.logger.info(f"正确接收到状态码 {status_code}，但在响应体中未找到错误码字段或预期结构。")
|
||||
else:
|
||||
results.append(self.failed(
|
||||
message=f"{msg_prefix}期望API返回状态码 {expected_status_codes} 中的一个，但实际收到 {status_code}。",
|
||||
details={"status_code": status_code, "response_body": json_content, "removed_field": f"body.{removed_field_str}"}
|
||||
))
|
||||
self.logger.warning(f"必填请求体字段缺失测试失败：期望状态码 {expected_status_codes}，实际为 {status_code}。移除的字段：'body.{removed_field_str}'")
|
||||
|
||||
return results
|
||||
+84
@@ -0,0 +1,84 @@
|
||||
from typing import Dict, Any, Optional, List
|
||||
from ddms_compliance_suite.test_framework_core import BaseAPITestCase, TestSeverity, ValidationResult, APIRequestContext, APIResponseContext
|
||||
import copy
|
||||
|
||||
class MissingRequiredFieldQueryCase(BaseAPITestCase):
|
||||
id = "TC-ERROR-4003-QUERY"
|
||||
name = "Error Code 4003 - Missing Required Query Parameter Validation"
|
||||
description = "测试当请求中缺少API规范定义的必填查询参数时，API是否按预期返回类似4003的错误（或通用400错误）。"
|
||||
severity = TestSeverity.HIGH
|
||||
tags = ["error-handling", "appendix-b", "4003", "required-fields", "query-parameters"]
|
||||
execution_order = 211 # After body, before original combined one might have been
|
||||
|
||||
def __init__(self, endpoint_spec: Dict[str, Any], global_api_spec: Dict[str, Any], json_schema_validator: Optional[Any] = None):
|
||||
super().__init__(endpoint_spec, global_api_spec, json_schema_validator)
|
||||
self.removed_field_name: Optional[str] = None
|
||||
self._try_find_removable_query_param()
|
||||
|
||||
def _try_find_removable_query_param(self):
|
||||
query_params_spec_list = self.endpoint_spec.get("parameters", [])
|
||||
if query_params_spec_list:
|
||||
self.logger.debug(f"检查查询参数的必填字段，总共 {len(query_params_spec_list)} 个参数定义。")
|
||||
for param_spec in query_params_spec_list:
|
||||
if isinstance(param_spec, dict) and param_spec.get("in") == "query" and param_spec.get("required") is True:
|
||||
field_name = param_spec.get("name")
|
||||
if field_name:
|
||||
self.removed_field_name = field_name
|
||||
self.logger.info(f"必填字段缺失测试的目标字段 (查询参数): '{self.removed_field_name}'")
|
||||
return
|
||||
self.logger.info('在此端点规范中未找到可用于测试 "必填查询参数缺失" 的字段。')
|
||||
|
||||
def generate_request_body(self, current_body: Optional[Any]) -> Optional[Any]:
|
||||
# This test case focuses on query parameters, so it does not modify the request body.
|
||||
self.logger.debug(f"{self.id} is focused on query parameters, generate_request_body will not modify the request body.")
|
||||
return current_body
|
||||
|
||||
def generate_query_params(self, current_query_params: Dict[str, Any]) -> Dict[str, Any]:
|
||||
if self.removed_field_name and isinstance(current_query_params, dict):
|
||||
if self.removed_field_name in current_query_params:
|
||||
new_params = copy.deepcopy(current_query_params)
|
||||
original_value = new_params.pop(self.removed_field_name) # 移除参数
|
||||
self.logger.info(f"为进行必填查询参数缺失测试，已从查询参数中移除 '{self.removed_field_name}' (原值: '{original_value}')。")
|
||||
return new_params
|
||||
else:
|
||||
self.logger.warning(f"计划移除的查询参数 '{self.removed_field_name}' 在当前查询参数中未找到。")
|
||||
return current_query_params
|
||||
|
||||
def validate_response(self, response_context: APIResponseContext, request_context: APIRequestContext) -> List[ValidationResult]:
|
||||
results = []
|
||||
|
||||
if not self.removed_field_name:
|
||||
results.append(self.passed("跳过测试：在API规范中未找到合适的必填查询参数用于移除测试。"))
|
||||
self.logger.info("由于未识别到可移除的必填查询参数，跳过此测试用例。")
|
||||
return results
|
||||
|
||||
status_code = response_context.status_code
|
||||
json_content = response_context.json_content
|
||||
|
||||
expected_status_codes = [400, 422]
|
||||
specific_error_code_from_appendix_b = "4003"
|
||||
|
||||
msg_prefix = f"当移除必填查询参数 '{self.removed_field_name}' 时，"
|
||||
|
||||
if status_code in expected_status_codes:
|
||||
status_msg = f"{msg_prefix}API响应了预期的错误状态码 {status_code}。"
|
||||
if json_content and isinstance(json_content, dict) and str(json_content.get("code")) == specific_error_code_from_appendix_b:
|
||||
results.append(self.passed(f"{status_msg} 且响应体中包含特定的错误码 '{specific_error_code_from_appendix_b}'。"))
|
||||
self.logger.info(f"正确接收到状态码 {status_code} 和错误码 '{specific_error_code_from_appendix_b}'。")
|
||||
elif json_content and isinstance(json_content, dict) and "code" in json_content:
|
||||
results.append(ValidationResult(passed=True,
|
||||
message=f"{status_msg} 响应体中的错误码为 '{json_content.get('code')}' (期望或类似 '{specific_error_code_from_appendix_b}')。",
|
||||
details=json_content
|
||||
))
|
||||
self.logger.warning(f"接收到状态码 {status_code}，但错误码是 '{json_content.get('code')}' 而不是期望的 '{specific_error_code_from_appendix_b}'。此结果仍标记为通过，因状态码正确。")
|
||||
else:
|
||||
results.append(self.passed(f"{status_msg} 但响应体中未找到特定的错误码字段或响应体结构不符合预期。"))
|
||||
self.logger.info(f"正确接收到状态码 {status_code}，但在响应体中未找到错误码字段或预期结构。")
|
||||
else:
|
||||
results.append(self.failed(
|
||||
message=f"{msg_prefix}期望API返回状态码 {expected_status_codes} 中的一个，但实际收到 {status_code}。",
|
||||
details={"status_code": status_code, "response_body": json_content, "removed_field": f"query.{self.removed_field_name}"}
|
||||
))
|
||||
self.logger.warning(f"必填查询参数缺失测试失败：期望状态码 {expected_status_codes}，实际为 {status_code}。移除的参数：'{self.removed_field_name}'")
|
||||
|
||||
return results
|
||||
@@ -0,0 +1,386 @@
|
||||
from typing import Dict, Any, Optional, List
|
||||
from ddms_compliance_suite.test_framework_core import BaseAPITestCase, TestSeverity, ValidationResult, APIRequestContext, APIResponseContext
|
||||
import copy
|
||||
import logging
|
||||
|
||||
class TypeMismatchBodyCase(BaseAPITestCase):
|
||||
id = "TC-ERROR-4001-BODY"
|
||||
name = "Error Code 4001 - Request Body Type Mismatch Validation"
|
||||
description = "测试当发送的请求体中字段的数据类型与API规范定义不符时，API是否按预期返回类似4001的错误（或通用400错误）。"
|
||||
severity = TestSeverity.MEDIUM
|
||||
tags = ["error-handling", "appendix-b", "4001", "request-body"]
|
||||
execution_order = 202 # Slightly after query param one
|
||||
|
||||
def __init__(self, endpoint_spec: Dict[str, Any], global_api_spec: Dict[str, Any], json_schema_validator: Optional[Any] = None):
|
||||
super().__init__(endpoint_spec, global_api_spec, json_schema_validator)
|
||||
self.logger.setLevel(logging.DEBUG)
|
||||
self.target_field_path: Optional[List[str]] = None
|
||||
self.original_field_type: Optional[str] = None
|
||||
# Location is always 'body' for this class
|
||||
self.target_field_location: str = "body"
|
||||
self.target_field_schema: Optional[Dict[str, Any]] = None
|
||||
|
||||
self.logger.critical(f"{self.id} __INIT__ >>> STARTED")
|
||||
self.logger.debug(f"开始为端点 {self.endpoint_spec.get('method')} {self.endpoint_spec.get('path')} 初始化请求体类型不匹配测试的目标字段查找。")
|
||||
|
||||
body_schema_to_check: Optional[Dict[str, Any]] = None
|
||||
|
||||
# 优先尝试从顶层 'requestBody' (OpenAPI 3.0 style) 获取 schema
|
||||
request_body_spec = self.endpoint_spec.get("requestBody")
|
||||
if request_body_spec and isinstance(request_body_spec, dict):
|
||||
content = request_body_spec.get("content", {})
|
||||
json_schema_entry = content.get("application/json") # 或者其他相关mime-type
|
||||
if json_schema_entry and isinstance(json_schema_entry, dict) and isinstance(json_schema_entry.get("schema"), dict):
|
||||
body_schema_to_check = json_schema_entry["schema"]
|
||||
self.logger.debug(f"从顶层 'requestBody' 中获取到 schema: {list(body_schema_to_check.keys())}")
|
||||
|
||||
# 如果顶层 'requestBody' 未提供有效 schema，则尝试从 'parameters' 列表 (Swagger 2.0 style for 'in: body') 查找
|
||||
if not body_schema_to_check:
|
||||
self.logger.debug(f"未从顶层 'requestBody' 找到 schema，尝试从 'parameters' 列表查找 'in: body' 参数。")
|
||||
parameters = self.endpoint_spec.get("parameters", [])
|
||||
if isinstance(parameters, list):
|
||||
for param in parameters:
|
||||
if isinstance(param, dict) and param.get("in") == "body":
|
||||
if isinstance(param.get("schema"), dict):
|
||||
body_schema_to_check = param["schema"]
|
||||
self.logger.debug(f"从 'parameters' 列表中找到 'in: body' 参数的 schema: {list(body_schema_to_check.keys())}")
|
||||
break # 找到第一个 'in: body' 参数即可
|
||||
else:
|
||||
self.logger.warning(f"找到 'in: body' 参数 '{param.get('name', 'N/A')}'，但其 'schema' 字段无效或缺失。")
|
||||
else:
|
||||
self.logger.warning("'parameters' 字段不是列表或不存在。")
|
||||
|
||||
|
||||
if body_schema_to_check:
|
||||
self.logger.debug(f"最终用于检查的请求体 schema: {list(body_schema_to_check.keys())}")
|
||||
if self._find_target_field_in_schema(body_schema_to_check, base_path_for_log=""): # base_path_for_log 为空字符串代表 schema 的根
|
||||
self.logger.info(f"类型不匹配测试的目标字段(请求体): {'.'.join(str(p) for p in self.target_field_path) if self.target_field_path else 'N/A'}，原始类型: {self.original_field_type}")
|
||||
else:
|
||||
self.logger.debug(f"在提供的请求体 schema ({list(body_schema_to_check.keys())}) 中未找到适合类型不匹配测试的字段。")
|
||||
else:
|
||||
self.logger.debug("在此端点规范中未找到有效的请求体 schema 定义 (无论是通过 'requestBody' 还是 'parameters' in:body)。")
|
||||
|
||||
if not self.target_field_path:
|
||||
self.logger.info(f"最终，在端点 {self.endpoint_spec.get('method')} {self.endpoint_spec.get('path')} 的请求体中，均未找到可用于测试类型不匹配的字段。")
|
||||
|
||||
def _resolve_ref_if_present(self, schema_to_resolve: Dict[str, Any]) -> Dict[str, Any]:
|
||||
ref_value = None
|
||||
if isinstance(schema_to_resolve, dict):
|
||||
if "$ref" in schema_to_resolve:
|
||||
ref_value = schema_to_resolve["$ref"]
|
||||
elif "$$ref" in schema_to_resolve:
|
||||
ref_value = schema_to_resolve["$$ref"]
|
||||
|
||||
if ref_value:
|
||||
self.logger.debug(f"发现引用 '{ref_value}'，尝试解析...")
|
||||
try:
|
||||
actual_global_spec_dict = None
|
||||
if hasattr(self.global_api_spec, 'spec') and isinstance(self.global_api_spec.spec, dict):
|
||||
actual_global_spec_dict = self.global_api_spec.spec
|
||||
elif isinstance(self.global_api_spec, dict):
|
||||
actual_global_spec_dict = self.global_api_spec
|
||||
|
||||
if not actual_global_spec_dict:
|
||||
self.logger.warning(f"无法从 self.global_api_spec (类型: {type(self.global_api_spec)}) 获取用于解析引用的字典。")
|
||||
return schema_to_resolve
|
||||
|
||||
resolved_schema = None
|
||||
if ref_value.startswith("#/components/schemas/"):
|
||||
schema_name = ref_value.split("/")[-1]
|
||||
components = actual_global_spec_dict.get("components")
|
||||
if components and isinstance(components.get("schemas"), dict):
|
||||
resolved_schema = components["schemas"].get(schema_name)
|
||||
if resolved_schema and isinstance(resolved_schema, dict):
|
||||
self.logger.info(f"成功从 #/components/schemas/ 解析引用 '{ref_value}'。")
|
||||
return resolved_schema
|
||||
else:
|
||||
self.logger.warning(f"解析引用 '{ref_value}' (路径: #/components/schemas/) 失败：未找到或找到的不是字典: {schema_name}")
|
||||
else:
|
||||
self.logger.warning(f"尝试从 #/components/schemas/ 解析引用 '{ref_value}' 失败：无法找到 'components.schemas' 结构。")
|
||||
|
||||
if not resolved_schema and ref_value.startswith("#/definitions/"):
|
||||
schema_name = ref_value.split("/")[-1]
|
||||
definitions = actual_global_spec_dict.get("definitions")
|
||||
if definitions and isinstance(definitions, dict):
|
||||
resolved_schema = definitions.get(schema_name)
|
||||
if resolved_schema and isinstance(resolved_schema, dict):
|
||||
self.logger.info(f"成功从 #/definitions/ 解析引用 '{ref_value}'。")
|
||||
return resolved_schema
|
||||
else:
|
||||
self.logger.warning(f"解析引用 '{ref_value}' (路径: #/definitions/) 失败：未找到或找到的不是字典: {schema_name}")
|
||||
else:
|
||||
self.logger.warning(f"尝试从 #/definitions/ 解析引用 '{ref_value}' 失败：无法找到 'definitions' 结构。")
|
||||
|
||||
if not resolved_schema:
|
||||
self.logger.warning(f"最终未能通过任一已知路径 (#/components/schemas/ 或 #/definitions/) 解析引用 '{ref_value}'。")
|
||||
|
||||
except Exception as e:
|
||||
self.logger.error(f"解析引用 '{ref_value}' 时发生错误: {e}", exc_info=True)
|
||||
return schema_to_resolve
|
||||
|
||||
def _find_target_field_in_schema(self, schema_to_search: Dict[str, Any], base_path_for_log: str) -> bool:
|
||||
"""
|
||||
Recursively searches for a simple type field (string, integer, number, boolean) within a schema.
|
||||
Sets self.target_field_path, self.original_field_type, and self.target_field_schema if found.
|
||||
base_path_for_log is used to build the full path for logging.
|
||||
Returns True if a field is found, False otherwise.
|
||||
"""
|
||||
self.logger.debug(f"Enter _find_target_field_in_schema for base_path: '{base_path_for_log}', schema_to_search keys: {list(schema_to_search.keys()) if isinstance(schema_to_search, dict) else 'Not a dict'}")
|
||||
resolved_schema = self._resolve_ref_if_present(schema_to_search)
|
||||
|
||||
if not isinstance(resolved_schema, dict):
|
||||
self.logger.debug(f"_find_target_field_in_schema: Schema at '{base_path_for_log}' is not a dict after resolution. Schema: {resolved_schema}")
|
||||
return False
|
||||
|
||||
schema_type = resolved_schema.get("type")
|
||||
self.logger.debug(f"Path: '{base_path_for_log}', Resolved Schema Type: '{schema_type}', Keys: {list(resolved_schema.keys())}")
|
||||
|
||||
if schema_type == "object":
|
||||
properties = resolved_schema.get("properties", {})
|
||||
self.logger.debug(f"Path: '{base_path_for_log}', Type is 'object'. Checking properties: {list(properties.keys())}")
|
||||
for name, prop_schema_orig in properties.items():
|
||||
current_path_str = f"{base_path_for_log}.{name}" if base_path_for_log else name
|
||||
self.logger.debug(f"Path: '{current_path_str}', Property Schema (Original): {prop_schema_orig}")
|
||||
prop_schema_resolved = self._resolve_ref_if_present(prop_schema_orig)
|
||||
self.logger.debug(f"Path: '{current_path_str}', Property Schema (Resolved): {prop_schema_resolved}")
|
||||
|
||||
if not isinstance(prop_schema_resolved, dict):
|
||||
self.logger.debug(f"Path: '{current_path_str}', Resolved schema is not a dict. Skipping.")
|
||||
continue
|
||||
|
||||
prop_type = prop_schema_resolved.get("type")
|
||||
self.logger.debug(f"Path: '{current_path_str}', Resolved Property Type: '{prop_type}'")
|
||||
|
||||
if prop_type in ["string", "integer", "number", "boolean"]:
|
||||
# Construct path relative to the initial body schema
|
||||
path_parts = base_path_for_log.split('.') if base_path_for_log else []
|
||||
if path_parts == ['']: path_parts = [] # Handle initial empty base_path
|
||||
self.target_field_path = path_parts + [name]
|
||||
self.original_field_type = prop_type
|
||||
self.target_field_schema = prop_schema_resolved
|
||||
self.logger.info(f"目标字段(请求体): '{current_path_str}' (原始类型: '{prop_type}') FOUND!")
|
||||
return True
|
||||
elif prop_type == "object":
|
||||
self.logger.debug(f"Path: '{current_path_str}', Type is 'object'. Recursing...")
|
||||
if self._find_target_field_in_schema(prop_schema_resolved, current_path_str):
|
||||
return True
|
||||
self.logger.debug(f"Path: '{current_path_str}', Recursion for object did not find target.")
|
||||
elif prop_type == "array":
|
||||
self.logger.debug(f"Path: '{current_path_str}', Type is 'array'. Inspecting items...")
|
||||
items_schema = prop_schema_resolved.get("items")
|
||||
if isinstance(items_schema, dict):
|
||||
self.logger.debug(f"Path: '{current_path_str}', Array items schema is a dict. Resolving and checking item type.")
|
||||
items_schema_resolved = self._resolve_ref_if_present(items_schema)
|
||||
item_type = items_schema_resolved.get("type")
|
||||
self.logger.debug(f"Path: '{current_path_str}[*]', Resolved Item Type: '{item_type}'")
|
||||
if item_type in ["string", "integer", "number", "boolean"]:
|
||||
path_parts = base_path_for_log.split('.') if base_path_for_log else []
|
||||
if path_parts == ['']: path_parts = []
|
||||
self.target_field_path = path_parts + [name, 0] # Path like field.array_field.0
|
||||
self.original_field_type = item_type
|
||||
self.target_field_schema = items_schema_resolved # schema for the item, not the array
|
||||
self.logger.info(f"目标字段(请求体 - 数组内简单类型): '{current_path_str}[0]' (原始类型: '{item_type}') FOUND!")
|
||||
return True
|
||||
elif item_type == "object":
|
||||
self.logger.debug(f"Path: '{current_path_str}[*]', Item type is 'object'. Recursing into array item schema...")
|
||||
# Path for recursion: current_path_str + ".0" (representing first item)
|
||||
if self._find_target_field_in_schema(items_schema_resolved, f"{current_path_str}.0"):
|
||||
# self.target_field_path would be set by recursive call.
|
||||
# The path logic in _find_target_field_in_schema needs to correctly prepend array index if it comes from array item recursion.
|
||||
# Let's ensure the path construction at "FOUND!" handles this.
|
||||
# If current_path_str was "field.array.0" and recursion found "nested_prop",
|
||||
# the path should become "field.array.0.nested_prop".
|
||||
# The recursive call sets target_field_path starting from its base_path_for_log.
|
||||
# So if base_path_for_log was "field.array.0", and it found "item_prop",
|
||||
# self.target_field_path will be ["field", "array", 0, "item_prop"]. This seems correct.
|
||||
self.logger.info(f"目标字段(请求体 - 数组内对象属性) found via recursion from '{current_path_str}.0'")
|
||||
return True
|
||||
self.logger.debug(f"Path: '{current_path_str}[*]', Recursion for array item object did not find target.")
|
||||
else:
|
||||
self.logger.debug(f"Path: '{current_path_str}[*]', Item type '{item_type}' is not simple or object.")
|
||||
else:
|
||||
self.logger.debug(f"Path: '{current_path_str}', Array items schema is not a dict or missing. Items: {items_schema}")
|
||||
else:
|
||||
self.logger.debug(f"Path: '{current_path_str}', Property type '{prop_type}' is not a simple type, object, or array. Skipping further processing for this property.")
|
||||
elif schema_type == "array":
|
||||
self.logger.debug(f"Path: '{base_path_for_log}', Top-level schema type is 'array'. Inspecting items...")
|
||||
items_schema = resolved_schema.get("items")
|
||||
if isinstance(items_schema, dict):
|
||||
items_schema_resolved = self._resolve_ref_if_present(items_schema)
|
||||
item_type = items_schema_resolved.get("type")
|
||||
self.logger.debug(f"Path: '{base_path_for_log}[*]', Resolved Item Type: '{item_type}'")
|
||||
if item_type in ["string", "integer", "number", "boolean"]:
|
||||
# This means the body itself is an array of simple types.
|
||||
# We target the first item. Path will be [0] if base_path_for_log is empty.
|
||||
path_parts = base_path_for_log.split('.') if base_path_for_log else []
|
||||
if path_parts == ['']: path_parts = []
|
||||
# If base_path_for_log is empty (root schema is array), path is just [0]
|
||||
# If base_path_for_log is "field.array_prop", this case shouldn't be hit here, but in object prop loop.
|
||||
# This branch is for when the *entire request body schema* is an array.
|
||||
self.target_field_path = path_parts + [0] # if root is array, path_parts is [], so path is [0]
|
||||
self.original_field_type = item_type
|
||||
self.target_field_schema = items_schema_resolved
|
||||
self.logger.info(f"目标字段(请求体 - 根为简单类型数组): '{base_path_for_log}[0]' (原始类型: '{item_type}') FOUND!")
|
||||
return True
|
||||
elif item_type == "object":
|
||||
self.logger.debug(f"Path: '{base_path_for_log}[*]', Item type is 'object'. Recursing into root array item schema...")
|
||||
# Path for recursion: base_path_for_log + ".0" or just "0" if base_path is empty
|
||||
new_base_path = f"{base_path_for_log}.0" if base_path_for_log else "0"
|
||||
if self._find_target_field_in_schema(items_schema_resolved, new_base_path):
|
||||
self.logger.info(f"目标字段(请求体 - 根为对象数组，属性在对象内) found via recursion from '{new_base_path}'")
|
||||
return True
|
||||
self.logger.debug(f"Path: '{base_path_for_log}[*]', Recursion for root array item object did not find target.")
|
||||
else:
|
||||
self.logger.debug(f"Path: '{base_path_for_log}[*]', Item type '{item_type}' is not simple or object.")
|
||||
else:
|
||||
self.logger.debug(f"Path: '{base_path_for_log}', Root array items schema is not a dict or missing. Items: {items_schema}")
|
||||
else:
|
||||
self.logger.debug(f"Path: '{base_path_for_log}', Schema type is '{schema_type}', not 'object' or 'array'. Cannot find properties here.")
|
||||
|
||||
|
||||
self.logger.debug(f"Exit _find_target_field_in_schema for base_path: '{base_path_for_log if base_path_for_log else 'root'}'. Target NOT found in this path.")
|
||||
return False
|
||||
|
||||
def generate_query_params(self, current_query_params: Dict[str, Any]) -> Dict[str, Any]:
|
||||
self.logger.debug(f"{self.id} is focused on request body, generate_query_params will not modify query parameters.")
|
||||
return current_query_params
|
||||
|
||||
def generate_request_body(self, current_body: Optional[Any]) -> Optional[Any]:
|
||||
if not self.target_field_path: # target_field_location is always "body"
|
||||
return current_body
|
||||
|
||||
self.logger.debug(f"准备修改请求体以测试类型不匹配。目标路径: {self.target_field_path}, 原始类型: {self.original_field_type}")
|
||||
|
||||
modified_body = copy.deepcopy(current_body) if current_body is not None else {}
|
||||
|
||||
# Ensure body is a dict if path is not empty, or if it's empty and body is None, init to {}
|
||||
if self.target_field_path and not isinstance(modified_body, dict):
|
||||
if not modified_body and not self.target_field_path[0]: # Path is effectively root, and body is None/empty
|
||||
modified_body = {} # Initialize if targeting root of an empty body
|
||||
else:
|
||||
self.logger.warning(f"请求体不是字典类型 (is {type(modified_body)})，但目标字段路径为 {self.target_field_path}。无法安全应用修改。")
|
||||
return current_body
|
||||
elif not self.target_field_path and not modified_body: # No path (targeting root) and body is None
|
||||
self.logger.warning(f"目标字段路径为空 (表示根对象) 但当前请求体也为空，无法确定如何修改。")
|
||||
return current_body
|
||||
|
||||
|
||||
temp_obj_ref = modified_body
|
||||
try:
|
||||
for i, key_or_index in enumerate(self.target_field_path):
|
||||
is_last_part = (i == len(self.target_field_path) - 1)
|
||||
|
||||
if isinstance(key_or_index, int): # Array index
|
||||
if not isinstance(temp_obj_ref, list) or key_or_index >= len(temp_obj_ref):
|
||||
self.logger.warning(f"路径 {self.target_field_path[:i+1]} 指向数组索引，但当前对象不是列表或索引 ({key_or_index}) 越界 (len: {len(temp_obj_ref) if isinstance(temp_obj_ref, list) else 'N/A'})。")
|
||||
# Attempt to create list/elements if they don't exist up to this point (for safety, only if current is None or empty list)
|
||||
if isinstance(temp_obj_ref, list) and key_or_index == 0 and not temp_obj_ref: # Empty list, trying to set first element
|
||||
temp_obj_ref.append({}) # Add a dict placeholder for the first element
|
||||
elif temp_obj_ref is None and key_or_index == 0: # If parent was None, can't proceed here unless path logic is very robust for creation
|
||||
return current_body # Cannot proceed
|
||||
else:
|
||||
return current_body # Cannot proceed
|
||||
|
||||
if is_last_part:
|
||||
original_value = temp_obj_ref[key_or_index]
|
||||
new_value = self._get_mismatched_value(self.original_field_type, original_value, self.target_field_schema)
|
||||
self.logger.info(f"在路径 {self.target_field_path} (数组索引 {key_or_index}) 处，将值从 '{original_value}' 修改为 '{new_value}' (原始类型: {self.original_field_type})")
|
||||
temp_obj_ref[key_or_index] = new_value
|
||||
else:
|
||||
temp_obj_ref = temp_obj_ref[key_or_index]
|
||||
|
||||
elif isinstance(temp_obj_ref, dict): # Dictionary key
|
||||
if key_or_index not in temp_obj_ref and not is_last_part:
|
||||
self.logger.debug(f"路径 {self.target_field_path[:i+1]} 中的键 '{key_or_index}' 在当前对象中不存在，将创建它。")
|
||||
temp_obj_ref[key_or_index] = {} # Create path if not exists
|
||||
|
||||
if is_last_part:
|
||||
original_value = temp_obj_ref.get(key_or_index)
|
||||
new_value = self._get_mismatched_value(self.original_field_type, original_value, self.target_field_schema)
|
||||
self.logger.info(f"在路径 {self.target_field_path} (键 '{key_or_index}') 处，将值从 '{original_value}' 修改为 '{new_value}' (原始类型: {self.original_field_type})")
|
||||
temp_obj_ref[key_or_index] = new_value
|
||||
else:
|
||||
temp_obj_ref = temp_obj_ref[key_or_index]
|
||||
if temp_obj_ref is None and not is_last_part:
|
||||
self.logger.warning(f"路径 {self.target_field_path[:i+1]} 的值在深入时变为None。创建空字典继续。")
|
||||
# This part is tricky, if temp_obj_ref was a key in parent, parent[key_or_index] is None.
|
||||
# We need to set parent[key_or_index] = {} and then temp_obj_ref = parent[key_or_index]
|
||||
# This requires knowing the parent. Let's simplify: if it becomes None, we might not be able to proceed unless it's the dict itself.
|
||||
# The current logic `temp_obj_ref = temp_obj_ref[key_or_index]` means if `temp_obj_ref` was `obj[key]`, now `temp_obj_ref` IS `obj[key]`s value.
|
||||
# If this value is None, and we are not at the end, we should create a dict there if the next part of path is a string key.
|
||||
# This modification is done in the check `if key_or_index not in temp_obj_ref and not is_last_part:`
|
||||
# If it's None AFTER that, it means the schema might be complex (e.g. anyOf, oneOf) or data is unexpectedly null.
|
||||
# For robustness, if it's None and not the last part, we can assume we need a dict for the next key.
|
||||
# The path creation `temp_obj_ref[key_or_index] = {}` for the *next* key happens at the start of the loop for that next key.
|
||||
pass # Already handled by creation logic at the start of the loop iteration for the next key
|
||||
else:
|
||||
self.logger.warning(f"尝试访问路径 {self.target_field_path[:i+1]} 时，当前对象 ({type(temp_obj_ref)}) 不是字典或列表。")
|
||||
return current_body
|
||||
|
||||
except Exception as e:
|
||||
self.logger.error(f"在根据路径 {self.target_field_path} 修改请求体时发生错误: {e}", exc_info=True)
|
||||
return current_body
|
||||
|
||||
return modified_body
|
||||
|
||||
def _get_mismatched_value(self, original_type: Optional[str], original_value: Any, field_schema: Optional[Dict[str, Any]]) -> Any:
|
||||
if original_type == "string":
|
||||
if field_schema and "enum" in field_schema and isinstance(field_schema["enum"], list):
|
||||
if 123 not in field_schema["enum"]: return 123
|
||||
if False not in field_schema["enum"]: return False
|
||||
return 12345
|
||||
elif original_type == "integer":
|
||||
if field_schema and "enum" in field_schema and isinstance(field_schema["enum"], list):
|
||||
if "not-an-integer" not in field_schema["enum"]: return "not-an-integer"
|
||||
if 3.14 not in field_schema["enum"]: return 3.14
|
||||
return "not-an-integer"
|
||||
elif original_type == "number":
|
||||
if field_schema and "enum" in field_schema and isinstance(field_schema["enum"], list):
|
||||
if "not-a-number" not in field_schema["enum"]: return "not-a-number"
|
||||
return "not-a-number"
|
||||
elif original_type == "boolean":
|
||||
if field_schema and "enum" in field_schema and isinstance(field_schema["enum"], list):
|
||||
if "not-a-boolean" not in field_schema["enum"]: return "not-a-boolean"
|
||||
if 1 not in field_schema["enum"]: return 1
|
||||
return "not-a-boolean"
|
||||
elif original_type == "array":
|
||||
return {"value": "not-an-array"}
|
||||
elif original_type == "object":
|
||||
return ["not", "an", "object"]
|
||||
|
||||
self.logger.warning(f"类型不匹配测试（请求体）：原始类型 '{original_type}' 未知或无法生成不匹配值，将返回固定字符串 'mismatch_test'。")
|
||||
return "mismatch_test" # Fallback
|
||||
|
||||
def validate_response(self, response_context: APIResponseContext, request_context: APIRequestContext) -> List[ValidationResult]:
|
||||
results = []
|
||||
status_code = response_context.status_code
|
||||
json_content = response_context.json_content
|
||||
|
||||
if not self.target_field_path:
|
||||
results.append(self.passed("跳过测试：在请求体中未找到合适的字段来测试类型不匹配。"))
|
||||
self.logger.info(f"{self.id}: 由于未识别到目标请求体字段，跳过类型不匹配测试。")
|
||||
return results
|
||||
|
||||
expected_status_codes = [400, 422]
|
||||
specific_error_code_from_appendix_b = "4001" # Example
|
||||
|
||||
if status_code in expected_status_codes:
|
||||
msg = f"API对请求体字段 '{'.'.join(str(p) for p in self.target_field_path)}' 的类型不匹配响应了 {status_code}，符合预期。"
|
||||
error_code_in_response = json_content.get("code") if isinstance(json_content, dict) else None
|
||||
if error_code_in_response == specific_error_code_from_appendix_b:
|
||||
results.append(self.passed(f"{msg} 并成功接收到特定错误码 '{specific_error_code_from_appendix_b}'。"))
|
||||
elif error_code_in_response:
|
||||
results.append(ValidationResult(passed=True,
|
||||
message=f"{msg} 但响应体中的错误码是 '{error_code_in_response}' (期望类似 '{specific_error_code_from_appendix_b}')。",
|
||||
details=json_content if isinstance(json_content, dict) else {"raw_response": str(json_content)}
|
||||
))
|
||||
else:
|
||||
results.append(self.passed(f"{msg} 响应体中未找到错误码或结构不符合预期。"))
|
||||
else:
|
||||
results.append(self.failed(
|
||||
message=f"对请求体字段 '{'.'.join(str(p) for p in self.target_field_path)}' 的类型不匹配测试期望状态码为 {expected_status_codes} 之一，但收到 {status_code}。",
|
||||
details={"status_code": status_code, "response_body": json_content}
|
||||
))
|
||||
self.logger.warning(f"{self.id}: 类型不匹配测试失败。字段: body.{'.'.join(str(p) for p in self.target_field_path)}, 期望状态码: {expected_status_codes}, 实际: {status_code}。")
|
||||
|
||||
return results
|
||||
@@ -0,0 +1,229 @@
|
||||
from typing import Dict, Any, Optional, List
|
||||
from ddms_compliance_suite.test_framework_core import BaseAPITestCase, TestSeverity, ValidationResult, APIRequestContext, APIResponseContext
|
||||
import copy
|
||||
import logging
|
||||
|
||||
class TypeMismatchQueryParamCase(BaseAPITestCase):
|
||||
id = "TC-ERROR-4001-QUERY"
|
||||
name = "Error Code 4001 - Query Parameter Type Mismatch Validation"
|
||||
description = "测试当发送的查询参数数据类型与API规范定义不符时，API是否按预期返回类似4001的错误（或通用400错误）。"
|
||||
severity = TestSeverity.MEDIUM
|
||||
tags = ["error-handling", "appendix-b", "4001", "query-parameters"]
|
||||
execution_order = 201 # Slightly after the combined one might have been
|
||||
|
||||
def __init__(self, endpoint_spec: Dict[str, Any], global_api_spec: Dict[str, Any], json_schema_validator: Optional[Any] = None):
|
||||
super().__init__(endpoint_spec, global_api_spec, json_schema_validator)
|
||||
self.logger.setLevel(logging.DEBUG)
|
||||
self.target_field_path: Optional[List[str]] = None
|
||||
self.original_field_type: Optional[str] = None
|
||||
# Location is always 'query' for this class
|
||||
self.target_field_location: str = "query"
|
||||
self.target_field_schema: Optional[Dict[str, Any]] = None
|
||||
|
||||
self.logger.critical(f"{self.id} __INIT__ >>> STARTED")
|
||||
self.logger.debug(f"开始为端点 {self.endpoint_spec.get('method')} {self.endpoint_spec.get('path')} 初始化查询参数类型不匹配测试的目标字段查找。")
|
||||
|
||||
parameters = self.endpoint_spec.get("parameters", [])
|
||||
self.logger.critical(f"{self.id} __INIT__ >>> Parameters to be processed: {parameters}")
|
||||
self.logger.debug(f"传入的参数列表 (在 {self.id}中): {parameters}")
|
||||
|
||||
for param_spec in parameters:
|
||||
if param_spec.get("in") == "query":
|
||||
param_name = param_spec.get("name")
|
||||
if not param_name:
|
||||
self.logger.warning("发现一个没有名称的查询参数定义，已跳过。")
|
||||
continue
|
||||
|
||||
self.logger.debug(f"检查查询参数: '{param_name}'")
|
||||
|
||||
param_type = param_spec.get("type")
|
||||
param_schema = param_spec.get("schema")
|
||||
|
||||
# Scenario 1: Simple type directly in param_spec (e.g., type: string)
|
||||
if param_type in ["string", "number", "integer", "boolean"]:
|
||||
self.target_field_path = [param_name]
|
||||
self.original_field_type = param_type
|
||||
self.target_field_schema = param_spec
|
||||
self.logger.info(f"目标字段(查询参数 - 简单类型): {param_name}，原始类型: {self.original_field_type}")
|
||||
break
|
||||
# Scenario 2: Schema defined for the query parameter (OpenAPI 3.0 style, or complex objects in query)
|
||||
elif isinstance(param_schema, dict):
|
||||
self.logger.debug(f"查询参数 '{param_name}' 包含嵌套 schema，尝试在其内部查找简单类型字段。")
|
||||
# We need to find a simple type *within* this schema.
|
||||
# _find_target_field_in_schema is designed for requestBody, let's adapt or simplify.
|
||||
# For query parameters, complex objects are less common or might be flattened.
|
||||
# Let's try to find a simple type property directly within this schema if it's an object.
|
||||
resolved_param_schema = self._resolve_ref_if_present(param_schema)
|
||||
if resolved_param_schema.get("type") == "object":
|
||||
properties = resolved_param_schema.get("properties", {})
|
||||
for prop_name, prop_details_orig in properties.items():
|
||||
prop_details = self._resolve_ref_if_present(prop_details_orig)
|
||||
if prop_details.get("type") in ["string", "number", "integer", "boolean"]:
|
||||
self.target_field_path = [param_name, prop_name] # Path will be param_name.prop_name
|
||||
self.original_field_type = prop_details.get("type")
|
||||
self.target_field_schema = prop_details
|
||||
self.logger.info(f"目标字段(查询参数 - 对象属性): {param_name}.{prop_name}，原始类型: {self.original_field_type}")
|
||||
break # Found a suitable property
|
||||
if self.target_field_path: break # Break outer loop if found
|
||||
elif resolved_param_schema.get("type") in ["string", "number", "integer", "boolean"]: # Schema itself is simple after ref resolution
|
||||
self.target_field_path = [param_name]
|
||||
self.original_field_type = resolved_param_schema.get("type")
|
||||
self.target_field_schema = resolved_param_schema
|
||||
self.logger.info(f"目标字段(查询参数 - schema为简单类型): {param_name}，原始类型: {self.original_field_type}")
|
||||
break
|
||||
|
||||
else:
|
||||
self.logger.debug(f"查询参数 '{param_name}' (type: {param_type}, schema: {param_schema}) 不是直接的简单类型，也无直接可用的对象型 schema 属性。")
|
||||
|
||||
if not self.target_field_path:
|
||||
self.logger.info(f"最终，在端点 {self.endpoint_spec.get('method')} {self.endpoint_spec.get('path')} 的查询参数中，均未找到可用于测试类型不匹配的字段。")
|
||||
|
||||
def _resolve_ref_if_present(self, schema_to_resolve: Dict[str, Any]) -> Dict[str, Any]:
|
||||
ref_value = None
|
||||
if isinstance(schema_to_resolve, dict):
|
||||
if "$ref" in schema_to_resolve:
|
||||
ref_value = schema_to_resolve["$ref"]
|
||||
elif "$$ref" in schema_to_resolve:
|
||||
ref_value = schema_to_resolve["$$ref"]
|
||||
|
||||
if ref_value:
|
||||
self.logger.debug(f"发现引用 '{ref_value}'，尝试解析...")
|
||||
try:
|
||||
actual_global_spec_dict = None
|
||||
if hasattr(self.global_api_spec, 'spec') and isinstance(self.global_api_spec.spec, dict):
|
||||
actual_global_spec_dict = self.global_api_spec.spec
|
||||
elif isinstance(self.global_api_spec, dict):
|
||||
actual_global_spec_dict = self.global_api_spec
|
||||
|
||||
if not actual_global_spec_dict:
|
||||
self.logger.warning(f"无法从 self.global_api_spec (类型: {type(self.global_api_spec)}) 获取用于解析引用的字典。")
|
||||
return schema_to_resolve
|
||||
|
||||
resolved_schema = None
|
||||
if ref_value.startswith("#/components/schemas/"):
|
||||
schema_name = ref_value.split("/")[-1]
|
||||
components = actual_global_spec_dict.get("components")
|
||||
if components and isinstance(components.get("schemas"), dict):
|
||||
resolved_schema = components["schemas"].get(schema_name)
|
||||
if resolved_schema and isinstance(resolved_schema, dict):
|
||||
self.logger.info(f"成功从 #/components/schemas/ 解析引用 '{ref_value}'。")
|
||||
return resolved_schema
|
||||
else:
|
||||
self.logger.warning(f"解析引用 '{ref_value}' (路径: #/components/schemas/) 失败：未找到或找到的不是字典: {schema_name}")
|
||||
else:
|
||||
self.logger.warning(f"尝试从 #/components/schemas/ 解析引用 '{ref_value}' 失败：无法找到 'components.schemas' 结构。")
|
||||
|
||||
if not resolved_schema and ref_value.startswith("#/definitions/"):
|
||||
schema_name = ref_value.split("/")[-1]
|
||||
definitions = actual_global_spec_dict.get("definitions")
|
||||
if definitions and isinstance(definitions, dict):
|
||||
resolved_schema = definitions.get(schema_name)
|
||||
if resolved_schema and isinstance(resolved_schema, dict):
|
||||
self.logger.info(f"成功从 #/definitions/ 解析引用 '{ref_value}'。")
|
||||
return resolved_schema
|
||||
else:
|
||||
self.logger.warning(f"解析引用 '{ref_value}' (路径: #/definitions/) 失败：未找到或找到的不是字典: {schema_name}")
|
||||
else:
|
||||
self.logger.warning(f"尝试从 #/definitions/ 解析引用 '{ref_value}' 失败：无法找到 'definitions' 结构。")
|
||||
|
||||
if not resolved_schema:
|
||||
self.logger.warning(f"最终未能通过任一已知路径 (#/components/schemas/ 或 #/definitions/) 解析引用 '{ref_value}'。")
|
||||
|
||||
except Exception as e:
|
||||
self.logger.error(f"解析引用 '{ref_value}' 时发生错误: {e}", exc_info=True)
|
||||
return schema_to_resolve
|
||||
|
||||
# No generate_request_body, or it simply returns current_body
|
||||
def generate_request_body(self, current_body: Optional[Any]) -> Optional[Any]:
|
||||
self.logger.debug(f"{self.id} is focused on query parameters, generate_request_body will not modify the body.")
|
||||
return current_body
|
||||
|
||||
def generate_query_params(self, current_query_params: Dict[str, Any]) -> Dict[str, Any]:
|
||||
if not self.target_field_path: # target_field_location is always "query"
|
||||
return current_query_params
|
||||
|
||||
self.logger.debug(f"准备修改查询参数以测试类型不匹配。目标路径: {self.target_field_path}, 原始类型: {self.original_field_type}")
|
||||
|
||||
modified_params = copy.deepcopy(current_query_params) if current_query_params is not None else {}
|
||||
|
||||
temp_obj_ref = modified_params
|
||||
try:
|
||||
for i, key in enumerate(self.target_field_path):
|
||||
is_last_part = (i == len(self.target_field_path) - 1)
|
||||
if is_last_part:
|
||||
original_value = temp_obj_ref.get(key)
|
||||
new_value = self._get_mismatched_value(self.original_field_type, original_value, self.target_field_schema)
|
||||
self.logger.info(f"在查询参数路径 {self.target_field_path} (键 '{key}') 处，将值从 '{original_value}' 修改为 '{new_value}' (原始类型: {self.original_field_type})")
|
||||
temp_obj_ref[key] = new_value
|
||||
else: # Navigating a nested structure within a query param (e.g. filter[field]=value)
|
||||
if key not in temp_obj_ref or not isinstance(temp_obj_ref[key], dict):
|
||||
# If path expects a dict but it's not there, create it.
|
||||
# This is crucial for structured query params like "filter[name]=value"
|
||||
# where target_field_path might be ["filter", "name"].
|
||||
temp_obj_ref[key] = {}
|
||||
temp_obj_ref = temp_obj_ref[key]
|
||||
|
||||
except Exception as e:
|
||||
self.logger.error(f"在根据路径 {self.target_field_path} 修改查询参数时发生错误: {e}", exc_info=True)
|
||||
return current_query_params
|
||||
|
||||
return modified_params
|
||||
|
||||
def _get_mismatched_value(self, original_type: Optional[str], original_value: Any, field_schema: Optional[Dict[str, Any]]) -> Any:
|
||||
if original_type == "string":
|
||||
if field_schema and "enum" in field_schema and isinstance(field_schema["enum"], list):
|
||||
if 123 not in field_schema["enum"]: return 123
|
||||
if False not in field_schema["enum"]: return False
|
||||
return 12345
|
||||
elif original_type == "integer":
|
||||
if field_schema and "enum" in field_schema and isinstance(field_schema["enum"], list):
|
||||
if "not-an-integer" not in field_schema["enum"]: return "not-an-integer"
|
||||
if 3.14 not in field_schema["enum"]: return 3.14
|
||||
return "not-an-integer"
|
||||
elif original_type == "number":
|
||||
if field_schema and "enum" in field_schema and isinstance(field_schema["enum"], list):
|
||||
if "not-a-number" not in field_schema["enum"]: return "not-a-number"
|
||||
return "not-a-number"
|
||||
elif original_type == "boolean":
|
||||
if field_schema and "enum" in field_schema and isinstance(field_schema["enum"], list):
|
||||
if "not-a-boolean" not in field_schema["enum"]: return "not-a-boolean"
|
||||
if 1 not in field_schema["enum"]: return 1
|
||||
return "not-a-boolean"
|
||||
|
||||
self.logger.warning(f"类型不匹配测试（查询参数）：原始类型 '{original_type}' 未知或无法生成不匹配值，将返回固定字符串 'mismatch_test'。")
|
||||
return "mismatch_test" # Fallback for other types or if logic is incomplete
|
||||
|
||||
def validate_response(self, response_context: APIResponseContext, request_context: APIRequestContext) -> List[ValidationResult]:
|
||||
results = []
|
||||
status_code = response_context.status_code
|
||||
json_content = response_context.json_content
|
||||
|
||||
if not self.target_field_path:
|
||||
results.append(self.passed("跳过测试：在查询参数中未找到合适的字段来测试类型不匹配。"))
|
||||
self.logger.info(f"{self.id}: 由于未识别到目标查询参数字段，跳过类型不匹配测试。")
|
||||
return results
|
||||
|
||||
expected_status_codes = [400, 422]
|
||||
specific_error_code_from_appendix_b = "4001" # Example
|
||||
|
||||
if status_code in expected_status_codes:
|
||||
msg = f"API对查询参数 '{'.'.join(self.target_field_path)}' 的类型不匹配响应了 {status_code}，符合预期。"
|
||||
# Further check for specific error code in body if applicable
|
||||
error_code_in_response = json_content.get("code") if isinstance(json_content, dict) else None
|
||||
if error_code_in_response == specific_error_code_from_appendix_b:
|
||||
results.append(self.passed(f"{msg} 并成功接收到特定错误码 '{specific_error_code_from_appendix_b}'。"))
|
||||
elif error_code_in_response:
|
||||
results.append(ValidationResult(passed=True,
|
||||
message=f"{msg} 但响应体中的错误码是 '{error_code_in_response}' (期望类似 '{specific_error_code_from_appendix_b}')。",
|
||||
details=json_content if isinstance(json_content, dict) else {"raw_response": str(json_content)}
|
||||
))
|
||||
else:
|
||||
results.append(self.passed(f"{msg} 响应体中未找到错误码或结构不符合预期。"))
|
||||
else:
|
||||
results.append(self.failed(
|
||||
message=f"对查询参数 '{'.'.join(self.target_field_path)}' 的类型不匹配测试期望状态码为 {expected_status_codes} 之一，但收到 {status_code}。",
|
||||
details={"status_code": status_code, "response_body": json_content}
|
||||
))
|
||||
self.logger.warning(f"{self.id}: 类型不匹配测试失败。字段: query.{'.'.join(self.target_field_path)}, 期望状态码: {expected_status_codes}, 实际: {status_code}。")
|
||||
|
||||
return results
|
||||
@@ -0,0 +1 @@
|
||||
# This file marks the normative_spec directory as a Python package.
|
||||
BIN
Binary file not shown.
@@ -0,0 +1,67 @@
|
||||
from typing import Dict, Any, Optional, List
|
||||
from ddms_compliance_suite.test_framework_core import BaseAPITestCase, TestSeverity, ValidationResult, APIRequestContext, APIResponseContext
|
||||
|
||||
# class HTTPMethodUsageCase(BaseAPITestCase):
|
||||
# id = "TC-NORMATIVE-001"
|
||||
# name = "HTTP Method Usage Verification"
|
||||
# description = "验证API是否恰当使用HTTP方法（例如，GET用于检索，POST用于创建）。目前不测试对不支持方法的405响应。"
|
||||
# severity = TestSeverity.MEDIUM
|
||||
# tags = ["normative-spec", "http", "restful"]
|
||||
# execution_order = 110
|
||||
|
||||
# # 此测试通常适用。
|
||||
# # 检查对不支持方法的405响应会比较复杂，需要知道哪些方法对于每个路径是明确不支持的，
|
||||
# # 或者尝试所有其他方法，这在API规范中并不总是明确的。
|
||||
|
||||
# def __init__(self, endpoint_spec: Dict[str, Any], global_api_spec: Dict[str, Any], json_schema_validator: Optional[Any] = None):
|
||||
# super().__init__(endpoint_spec, global_api_spec, json_schema_validator)
|
||||
# self.logger.info(f"测试用例 '{self.id}' 已为端点 '{self.endpoint_spec.get('method')} {self.endpoint_spec.get('path')}' 初始化。")
|
||||
|
||||
# def validate_response(self, response_context: APIResponseContext, request_context: APIRequestContext) -> List[ValidationResult]:
|
||||
# results = []
|
||||
# method = request_context.method.upper()
|
||||
# status_code = response_context.status_code
|
||||
|
||||
# # 基于常见RESTful约定的基本检查
|
||||
# # 这些是通用指南，可能需要根据具体的API设计进行调整。
|
||||
|
||||
# if method == "GET":
|
||||
# if status_code // 100 == 2: # 成功的GET
|
||||
# results.append(self.passed(f"GET请求 {request_context.url} 返回了成功的状态码 {status_code}。"))
|
||||
# elif status_code == 404:
|
||||
# results.append(self.passed(f"GET请求 {request_context.url} 返回404，如果资源不存在则这是有效的响应。"))
|
||||
# # GET请求的其他状态码可能是错误或此处未覆盖的特定条件。
|
||||
|
||||
# elif method == "POST":
|
||||
# if status_code == 201: # 已创建
|
||||
# results.append(self.passed(f"POST请求 {request_context.url} 返回201 Created，符合资源创建的预期。"))
|
||||
# elif status_code == 200 or status_code == 202: # OK或已接受（例如，用于异步任务）
|
||||
# results.append(self.passed(f"POST请求 {request_context.url} 返回{status_code}，这可以是有效的响应。"))
|
||||
# # 可添加对400（错误请求，例如payload无效）等的检查。
|
||||
|
||||
# elif method == "PUT":
|
||||
# if status_code == 200: # OK（已更新）
|
||||
# results.append(self.passed(f"PUT请求 {request_context.url} 返回200 OK，符合资源更新的预期。"))
|
||||
# elif status_code == 201: # 已创建（如果PUT在资源不存在时创建资源）
|
||||
# results.append(self.passed(f"PUT请求 {request_context.url} 返回201 Created，这可以是有效的响应。"))
|
||||
# elif status_code == 204: # 无内容（已更新，不返回响应体）
|
||||
# results.append(self.passed(f"PUT请求 {request_context.url} 返回204 No Content，这可以是有效的响应。"))
|
||||
# # 可添加对404（未找到，如果要更新的资源不存在，除非PUT会创建）的检查。
|
||||
|
||||
# elif method == "DELETE":
|
||||
# if status_code == 200 or status_code == 202 or status_code == 204: # OK、已接受或无内容
|
||||
# results.append(self.passed(f"DELETE请求 {request_context.url} 返回{status_code}，表示成功删除。"))
|
||||
# # 可添加对404（未找到，如果要删除的资源不存在）的检查。
|
||||
|
||||
# # 405（方法不允许）检查的占位符 - 这比较复杂
|
||||
# # 要测试405，通常需要：
|
||||
# # 1. 知道哪些方法是此路径明确不允许的。
|
||||
# # 2. 或者，尝试使用其他常见方法（OPTIONS, PATCH等）发送请求，
|
||||
# # 如果这些方法未在此路径的规范中定义，则期望405。
|
||||
# # 这通常需要更具针对性的测试用例或不同的方法。
|
||||
# # self.logger.info("此通用测试用例未实现405（方法不允许）检查。")
|
||||
|
||||
# if not results: # 如果没有为该方法触发特定的验证
|
||||
# results.append(self.passed(f"针对 {method} {request_context.url} 的HTTP方法使用检查完成（基于通用约定未发现特定问题）。"))
|
||||
|
||||
# return results
|
||||
@@ -0,0 +1 @@
|
||||
# This file marks the security directory as a Python package.
|
||||
BIN
Binary file not shown.
@@ -0,0 +1,84 @@
|
||||
from typing import Dict, Any, Optional, List
|
||||
from ddms_compliance_suite.test_framework_core import BaseAPITestCase, TestSeverity, ValidationResult, APIRequestContext, APIResponseContext
|
||||
import urllib.parse
|
||||
|
||||
class HTTPSMandatoryCase(BaseAPITestCase):
|
||||
id = "TC-SECURITY-001"
|
||||
name = "HTTPS Protocol Mandatory Verification"
|
||||
description = "验证API端点是否通过HTTPS提供服务，以及HTTP请求是否被拒绝或重定向到HTTPS。"
|
||||
severity = TestSeverity.CRITICAL
|
||||
tags = ["security", "https", "transport-security"]
|
||||
execution_order = 120
|
||||
|
||||
# 此测试会修改URL为HTTP，应适用于大多数端点。
|
||||
|
||||
def __init__(self, endpoint_spec: Dict[str, Any], global_api_spec: Dict[str, Any], json_schema_validator: Optional[Any] = None):
|
||||
super().__init__(endpoint_spec, global_api_spec, json_schema_validator)
|
||||
self.logger.info(f"测试用例 '{self.id}' 已为端点 '{self.endpoint_spec.get('method')} {self.endpoint_spec.get('path')}' 初始化。")
|
||||
|
||||
def modify_request_url(self, current_url: str) -> str:
|
||||
parsed_url = urllib.parse.urlparse(current_url)
|
||||
if parsed_url.scheme.lower() == "httpss":
|
||||
# 将 https 替换为 http
|
||||
modified_url = parsed_url._replace(scheme="http").geturl()
|
||||
self.logger.info(f"为进行HTTPS检查修改URL：原始 '{current_url}', 修改为 '{modified_url}'")
|
||||
return modified_url
|
||||
else:
|
||||
self.logger.warning(f"原始URL '{current_url}' 不是HTTPS。跳过此测试用例的URL修改。")
|
||||
# 如果原始URL不是HTTPS，此测试可能无效，
|
||||
# 或者暗示基础URL本身可能未正确配置以进行HTTPS测试。
|
||||
return current_url # 如果不是HTTPS则返回原始URL
|
||||
|
||||
def validate_response(self, response_context: APIResponseContext, request_context: APIRequestContext) -> List[ValidationResult]:
|
||||
results = []
|
||||
status_code = response_context.status_code
|
||||
# request_context.url 是调用 modify_request_url 之后，APICaller实际发送的URL
|
||||
request_url_scheme = urllib.parse.urlparse(request_context.url).scheme
|
||||
|
||||
# 检查URL是否确实被此测试的钩子修改为了HTTP
|
||||
if request_url_scheme.lower() != "http":
|
||||
results.append(self.passed(
|
||||
message=f"测试已跳过，因为发送的URL已经是 {request_url_scheme.upper()}（可能是由于原始基础URL非HTTPS或测试设置问题）。"
|
||||
))
|
||||
self.logger.info("HTTPS强制性检查已跳过，因为有效URL不是HTTP。")
|
||||
return results
|
||||
|
||||
# 如果请求是通过HTTP发出的，我们期望几种结果：
|
||||
# 1. 拒绝（例如400、403，或连接被拒绝 - 尽管APICaller可能在此之前处理连接拒绝）
|
||||
# 2. 重定向到HTTPS（例如301、302、307、308，并带有指向HTTPS的Location头）
|
||||
|
||||
if status_code in [301, 302, 307, 308]: # 重定向状态码
|
||||
location_header = response_context.headers.get("Location")
|
||||
if location_header and urllib.parse.urlparse(location_header).scheme.lower() == "httpss":
|
||||
results.append(self.passed(
|
||||
message=f"对 {request_context.url} 的HTTP请求被正确重定向到HTTPS ({location_header})，状态码 {status_code}。"
|
||||
))
|
||||
self.logger.info(f"HTTP被正确重定向到HTTPS: {location_header}")
|
||||
else:
|
||||
results.append(self.failed(
|
||||
message=f"对 {request_context.url} 的HTTP请求被重定向（状态码 {status_code}），但Location头 '{location_header}' 未指向HTTPS URL。",
|
||||
details={"status_code": status_code, "location_header": location_header}
|
||||
))
|
||||
self.logger.warning(f"HTTP被重定向，状态码 {status_code}，但Location '{location_header}' 不是HTTPS。")
|
||||
elif status_code // 100 == 4: # 客户端错误（例如400错误请求，403禁止访问）
|
||||
results.append(self.passed(
|
||||
message=f"对 {request_context.url} 的HTTP请求被客户端错误（状态码 {status_code}）拒绝，表明不允许HTTP访问。"
|
||||
))
|
||||
self.logger.info(f"HTTP请求被客户端错误 {status_code} 拒绝。")
|
||||
elif status_code // 100 == 2: # 通过HTTP成功返回2xx响应
|
||||
results.append(self.failed(
|
||||
message=f"API通过HTTP ({request_context.url}) 响应了成功的状态码 {status_code}，这违反了HTTPS强制策略。",
|
||||
details={"status_code": status_code}
|
||||
))
|
||||
self.logger.error(f"安全漏洞：API允许通过HTTP成功响应 ({status_code})。")
|
||||
else:
|
||||
# 其他状态码（例如5xx）可能表示与HTTPS强制执行无关的服务器错误，
|
||||
# 或者连接在更底层被拒绝（APICaller可能会抛出异常）。
|
||||
results.append(ValidationResult(
|
||||
passed=False, # 或True，取决于严格程度 - 5xx不是通过，但不一定是HTTPS失败
|
||||
message=f"对 {request_context.url} 的HTTP请求返回了意外的状态码 {status_code}。需要手动调查。",
|
||||
details={"status_code": status_code, "response_text_sample": (response_context.text_content or "")[:200]}
|
||||
))
|
||||
self.logger.warning(f"HTTP请求返回意外状态码 {status_code}。潜在问题或服务器错误。")
|
||||
|
||||
return results
|
||||
Reference in New Issue
Block a user