Catch API bugs before your users do
This report summarizes scanner evidence for schemathesis/schemathesis, a Python project with 3,659 GitHub stars. SynthScan examined 307,512 lines of code across 1364 source files, recording 5892 pattern matches distributed across 21 syntactic categories. The legacy adjusted pattern signal is 18.2 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 4848 finding(s).
Are imports declared and package/API names verified? 841 finding(s).
Are wrappers, guards, and repeated structures necessary? 4725 finding(s).
Which changes need focused human review? 5892 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 5892 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/corpus/metrics.py | 21 | def collect_dependency_metrics(raw_schema: JsonSchemaObject) -> DependencyMetrics: | CODE |
| LOW | tools/corpus/io.py | 222 | def iter_corpus_entries_from_refs( | CODE |
| LOW | test/conftest.py | 93 | def _isolate_schemathesis_state(tmp_path, monkeypatch): | CODE |
| LOW | test/conftest.py | 266 | def schema_with_recursive_references(): | CODE |
| LOW | test/test_package.py | 20 | def test_builtin_check_importable_from_checks_module(): | CODE |
| LOW | test/utils.py | 38 | def has_hypothesis_failure_header(text: str, test_name: str = "") -> bool: | CODE |
| LOW | test/utils.py | 289 | def assert_after_execution_status(self, status: Status) -> None: | CODE |
| LOW | test/filters/test_matching.py | 250 | def test_forbid_value_and_auth(): | CODE |
| LOW | test/filters/test_matching.py | 287 | def test_unmatched_filter_carries_schema_terms_not_cli_spelling(ctx): | CODE |
| LOW⚡ | test/reporting/test_crashes.py | 340 | def test_crash_step_roundtrips_dict_that_looks_like_bytes_sentinel(): | CODE |
| LOW⚡ | test/reporting/test_crashes.py | 350 | def test_crash_step_roundtrips_real_bytes_body(): | CODE |
| LOW⚡ | test/reporting/test_crashes.py | 358 | def test_crash_step_roundtrips_bytes_in_param_containers(): | CODE |
| LOW | test/reporting/test_crashes.py | 93 | def test_build_crashes_skips_scenario_with_missing_interaction(case_factory): | CODE |
| LOW | test/reporting/test_crashes.py | 105 | def test_build_crashes_captures_request_body_link(case_factory): | CODE |
| LOW | test/reporting/test_crashes.py | 144 | def test_build_crashes_includes_related_sibling_case(case_factory): | CODE |
| LOW | test/reporting/test_crashes.py | 176 | def test_remove_by_operation_matches_exact_operation(tmp_path, case_factory): | CODE |
| LOW | test/reporting/test_crashes.py | 191 | def test_remove_by_operation_skips_malformed_file(tmp_path): | CODE |
| LOW | test/reporting/test_crashes.py | 204 | def test_remove_by_operation_skips_non_object_file(tmp_path): | CODE |
| LOW | test/reporting/test_crashes.py | 218 | def test_remove_by_operation_retries_a_locked_file(tmp_path): | CODE |
| LOW | test/reporting/test_crashes.py | 237 | def test_remove_by_operation_skips_a_file_it_cannot_delete(tmp_path): | CODE |
| LOW | test/reporting/test_crashes.py | 253 | def test_remove_by_operation_tolerates_concurrent_removal(tmp_path): | CODE |
| LOW | test/reporting/test_crashes.py | 280 | def test_remove_files_ignores_already_dropped_file(tmp_path): | CODE |
| LOW | test/reporting/test_crashes.py | 292 | def test_rerun_refreshes_stored_case_id(tmp_path): | CODE |
| LOW | test/reporting/test_crashes.py | 306 | def test_same_run_keeps_first_case_id(tmp_path): | CODE |
| LOW | test/reporting/test_crashes.py | 317 | def test_build_crashes_skips_timing_only_failure(case_factory): | CODE |
| LOW | test/reporting/test_crashes.py | 329 | def test_build_crashes_tolerates_unknown_response_charset(case_factory): | CODE |
| LOW | test/reporting/test_crashes.py | 369 | def test_crash_step_roundtrips_bytes_in_mutation_metadata(): | CODE |
| LOW | test/reporting/test_crashes.py | 390 | def test_request_headers_are_sanitized(case_factory): | CODE |
| LOW | test/reporting/test_crashes.py | 419 | def test_list_root_request_body_is_sanitized(case_factory): | CODE |
| LOW | test/reporting/test_crashes.py | 441 | def test_load_manifest_rejects_unknown_format_version(tmp_path): | CODE |
| LOW | test/reporting/test_writers.py | 16 | def test_ndjson_writer_context_manager(): | CODE |
| LOW | test/reporting/test_writers.py | 25 | def test_ndjson_writer_context_manager_closes_file(): | CODE |
| LOW | test/reporting/test_writers.py | 36 | def test_junitxml_writer_context_manager(): | CODE |
| LOW | test/reporting/test_writers.py | 45 | def test_vcr_writer_writes_header_to_stream(): | CODE |
| LOW | test/reporting/test_writers.py | 65 | def test_writer_context_manager_no_error_without_open(writer_cls, kwargs): | CODE |
| LOW | test/reporting/test_writers.py | 136 | def test_command_representation(monkeypatch, entrypoint, expected): | CODE |
| LOW | test/code_samples/test_curl.py | 111 | def test_graphql_schema_loaded_from_file(ctx, curl, tmp_path, loader): | CODE |
| LOW | test/code_samples/test_curl.py | 137 | def test_as_curl_command_sanitizes_string_query_params(curl): | CODE |
| LOW | test/code_samples/test_curl.py | 150 | def test_as_curl_command_sanitizes_raw_query_with_empty_segments(ctx): | CODE |
| LOW | test/code_samples/test_curl.py | 173 | def test_as_curl_command_sanitizes_json_body(ctx, body, expected): | CODE |
| LOW | test/code_samples/test_curl.py | 191 | def test_as_curl_command_keeps_non_sensitive_raw_query_pairs(ctx): | CODE |
| LOW | test/code_samples/test_curl.py | 217 | def test_cli_output_includes_insecure(ctx, cli, curl): | CODE |
| LOW | test/code_samples/test_curl.py | 241 | def _send_then_validate_with_base_url(case, base_url): | CODE |
| LOW | test/code_samples/test_curl.py | 249 | def test_reproduce_with_overridden_base_url(ctx, tmp_path, validate): | CODE |
| LOW | test/code_samples/test_curl.py | 264 | def test_reproduce_after_same_host_redirect(ctx, app_runner, validate): | CODE |
| LOW | test/code_samples/test_curl.py | 296 | def test_reproduce_when_validated_response_has_no_request_url(ctx, response_factory): | CODE |
| LOW | test/code_samples/test_curl.py | 310 | def test_pytest_subtests_output(ctx, testdir): | CODE |
| LOW | test/code_samples/test_curl.py | 331 | def test_curl_command_validity(curl, loose_schema): | STRING |
| LOW | test/code_samples/test_curl.py | 391 | def test_shell_aware_escaping(curl, monkeypatch, shell_type, case_kwargs, expected_command): | STRING |
| LOW | test/code_samples/test_curl.py | 407 | def test_truncated_printable_body_is_quoted(monkeypatch, shell_type): | STRING |
| LOW | test/code_samples/test_curl.py | 421 | def test_multipart_with_array_of_bytes_body(curl): | STRING |
| LOW | test/code_samples/test_curl.py | 502 | def test_raw_multipart_bytes_body_boundary(ctx, monkeypatch, body, expected): | STRING |
| LOW | test/code_samples/test_curl.py | 563 | def test_multipart_boundary_matches_between_header_and_body(multipart_schema, monkeypatch, path, body): | STRING |
| LOW | test/code_samples/test_curl.py | 576 | def test_multipart_curl_command_is_stable(multipart_schema, path, body): | STRING |
| LOW | test/code_samples/test_curl.py | 581 | def test_empty_multipart_curl_body_keeps_closing_delimiter(multipart_schema, monkeypatch): | STRING |
| LOW | test/tooling/test_changelog.py | 57 | def test_issue_numbers_for_unknown_version(): | STRING |
| LOW⚡ | test/tooling/corpus/test_metrics.py | 6 | def test_add_dependency_metrics_empty_returns_zero(): | CODE |
| LOW⚡ | test/tooling/corpus/test_metrics.py | 10 | def test_add_dependency_metrics_sums_field_by_field(): | CODE |
| LOW⚡ | test/tooling/corpus/test_metrics.py | 19 | def test_collect_dependency_metrics_counts_resources_inputs_outputs(ctx): | CODE |
| LOW | test/tooling/corpus/test_locator.py | 10 | def test_parse_corpus_path_splits_corpus_and_member(): | CODE |
| 4425 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | changelog.py | 3 | CODE | |
| LOW | tools/corpus/metrics.py | 1 | CODE | |
| LOW | tools/corpus/io.py | 1 | CODE | |
| LOW | tools/corpus/locator.py | 1 | CODE | |
| LOW | tools/corpus/conformance.py | 1 | CODE | |
| LOW | test/conftest.py | 1 | CODE | |
| LOW | test/conftest.py | 7 | CODE | |
| LOW | test/conftest.py | 20 | CODE | |
| LOW | test/conftest.py | 29 | CODE | |
| LOW | test/conftest.py | 30 | CODE | |
| LOW | test/utils.py | 1 | CODE | |
| LOW | test/reporting/test_crashes.py | 1 | CODE | |
| LOW | test/reporting/test_writers.py | 1 | CODE | |
| LOW | test/code_samples/conftest.py | 1 | CODE | |
| LOW | test/tooling/test_changelog.py | 1 | CODE | |
| LOW | test/tooling/corpus/conftest.py | 1 | CODE | |
| LOW | test/tooling/corpus/test_metrics.py | 1 | CODE | |
| LOW | test/tooling/corpus/test_locator.py | 1 | CODE | |
| LOW | test/tooling/corpus/test_io.py | 1 | CODE | |
| LOW | test/tooling/corpus/test_conformance.py | 1 | CODE | |
| LOW | test/tooling/analyze/conftest.py | 1 | CODE | |
| LOW | test/transport/conftest.py | 1 | CODE | |
| LOW | test/core/test_text.py | 1 | CODE | |
| LOW | test/core/test_rate_limit_auto.py | 1 | CODE | |
| LOW | test/core/cache/test_writer.py | 1 | CODE | |
| LOW | test/core/cache/test_bounded.py | 1 | CODE | |
| LOW | test/core/cache/test_io.py | 1 | CODE | |
| LOW | test/core/jsonschema/test_resolver_adapter.py | 1 | CODE | |
| LOW | test/core/error_feedback/test_field_inference.py | 1 | CODE | |
| LOW | test/core/error_feedback/test_store.py | 1 | CODE | |
| LOW | test/core/error_feedback/test_collector.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_registry.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_jackson.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_drf.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_marshmallow.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_confluent.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_spring.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_rails.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_pydantic.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_flask_rest.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_restler.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_zod.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_go_validator.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_litestar.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_aspnet.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_ajv.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_symfony.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/helpers.py | 1 | CODE | |
| LOW | test/core/error_feedback/parsers/test_laravel.py | 1 | CODE | |
| LOW | test/python/test_server_exception.py | 1 | CODE | |
| LOW | test/auth/test_dynamic_auth.py | 1 | CODE | |
| LOW | test/auth/test_wfc.py | 1 | CODE | |
| LOW | test/auth/test_provider.py | 1 | CODE | |
| LOW | test/specs/openapi/test_resources.py | 1 | CODE | |
| LOW | test/specs/openapi/test_error_feedback.py | 1 | CODE | |
| LOW | test/specs/openapi/test_semantic_pool.py | 1 | CODE | |
| LOW | test/specs/openapi/test_body_overrides.py | 1 | CODE | |
| LOW | test/specs/openapi/test_swagger_v2.py | 1 | CODE | |
| LOW | test/specs/openapi/test_randomized.py | 1 | CODE | |
| LOW | test/specs/openapi/test_dictionary_generation.py | 1 | CODE | |
| 669 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/corpus/io.py | 95 | CODE | |
| LOW | tools/corpus/io.py | 181 | CODE | |
| LOW | test/utils.py | 325 | CODE | |
| LOW | test/pytest/test_asgi.py | 323 | CODE | |
| LOW | test/pytest/test_asgi.py | 328 | CODE | |
| LOW | test/config/test_doc_examples.py | 138 | CODE | |
| LOW | test/specs/openapi/test_swagger_v2.py | 112 | CODE | |
| LOW | test/specs/openapi/test_hypothesis.py | 550 | CODE | |
| LOW | test/specs/openapi/test_media_types.py | 250 | CODE | |
| LOW | test/specs/openapi/test_media_types.py | 285 | CODE | |
| LOW | …/specs/openapi/stateful/inference/test_dependencies.py | 7235 | CODE | |
| LOW | …/specs/openapi/stateful/inference/test_dependencies.py | 7294 | CODE | |
| LOW | …/specs/openapi/stateful/inference/test_dependencies.py | 8527 | CODE | |
| LOW | …st/specs/openapi/parameters/test_multipart_encoding.py | 479 | CODE | |
| LOW | …st/specs/openapi/parameters/test_multipart_encoding.py | 498 | CODE | |
| LOW | test/cli/test_ndjson.py | 296 | CODE | |
| LOW | test/cli/test_ndjson.py | 575 | CODE | |
| LOW | test/cli/test_error_feedback.py | 142 | CODE | |
| LOW | test/cli/test_error_feedback.py | 153 | CODE | |
| LOW | test/cli/test_cassettes.py | 108 | CODE | |
| LOW | test/cli/test_cassettes.py | 221 | CODE | |
| LOW | test/engine/test_engine.py | 1794 | CODE | |
| LOW | test/engine/test_operation_ordering.py | 337 | CODE | |
| LOW | scripts/profile.py | 250 | CODE | |
| LOW | scripts/analyze/metrics.py | 616 | CODE | |
| LOW | scripts/analyze/metrics.py | 683 | CODE | |
| LOW | scripts/analyze/metrics.py | 756 | CODE | |
| LOW | scripts/analyze/metrics.py | 881 | CODE | |
| LOW | scripts/analyze/metrics.py | 934 | CODE | |
| LOW | benches/bundler.py | 206 | CODE | |
| LOW | test-corpus/test_schemastore.py | 235 | CODE | |
| LOW | test-corpus/test_schemastore.py | 282 | CODE | |
| LOW | test-corpus/test_schemastore.py | 238 | CODE | |
| LOW | test-corpus/test_schemastore.py | 262 | CODE | |
| LOW | src/schemathesis/hooks.py | 385 | CODE | |
| LOW | src/schemathesis/hooks.py | 413 | CODE | |
| LOW | src/schemathesis/checks.py | 503 | CODE | |
| LOW | src/schemathesis/auths.py | 142 | CODE | |
| LOW | src/schemathesis/reporting/allure.py | 207 | CODE | |
| LOW | src/schemathesis/reporting/vcr.py | 228 | CODE | |
| LOW | src/schemathesis/reporting/vcr.py | 48 | CODE | |
| LOW | src/schemathesis/reporting/crashes/__init__.py | 277 | CODE | |
| LOW | src/schemathesis/reporting/html/render.py | 296 | CODE | |
| LOW | src/schemathesis/transport/__init__.py | 87 | CODE | |
| LOW | src/schemathesis/transport/requests.py | 344 | CODE | |
| LOW | src/schemathesis/transport/requests.py | 484 | CODE | |
| LOW | src/schemathesis/transport/prepare.py | 46 | CODE | |
| LOW | src/schemathesis/transport/prepare.py | 167 | CODE | |
| LOW | src/schemathesis/transport/serialization.py | 17 | CODE | |
| LOW | src/schemathesis/core/transforms.py | 47 | CODE | |
| LOW | src/schemathesis/core/transforms.py | 154 | CODE | |
| LOW | src/schemathesis/core/transport.py | 143 | CODE | |
| LOW | src/schemathesis/core/shell.py | 170 | CODE | |
| LOW | src/schemathesis/core/loaders.py | 85 | CODE | |
| LOW | src/schemathesis/core/deserialization.py | 271 | CODE | |
| LOW | src/schemathesis/core/errors.py | 635 | CODE | |
| LOW | src/schemathesis/core/errors.py | 279 | CODE | |
| LOW | src/schemathesis/core/output/sanitization.py | 23 | CODE | |
| LOW | src/schemathesis/core/jsonschema/bundler.py | 278 | CODE | |
| LOW | src/schemathesis/core/jsonschema/bundler.py | 68 | CODE | |
| 198 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/transport/test_serialization.py | 2028 | except SerializationError: | CODE |
| HIGH | test/specs/openapi/test_expressions.py | 215 | except RuntimeExpressionError: | CODE |
| HIGH | test/specs/openapi/test_ignored_auth.py | 103 | except FailureGroup: | CODE |
| HIGH | test/specs/openapi/test_dereferencing.py | 175 | except RecursionError: | CODE |
| HIGH | test/specs/openapi/stateful/test_stateful.py | 530 | except FailureGroup: | CODE |
| HIGH | test/engine/test_engine.py | 1425 | except KeyboardInterrupt: | CODE |
| HIGH | scripts/profile.py | 202 | except SystemExit: | CODE |
| HIGH | benches/multi_operation.py | 50 | except Exception: | CODE |
| HIGH | test-corpus/test_corpus.py | 274 | except ( | CODE |
| HIGH | test-corpus/test_corpus.py | 182 | except (Failure, FailureGroup): | CODE |
| HIGH | src/schemathesis/reporting/crashes/__init__.py | 265 | except FileNotFoundError: | CODE |
| HIGH | src/schemathesis/transport/requests.py | 305 | except requests.exceptions.RequestException: | CODE |
| HIGH | src/schemathesis/transport/prepare.py | 147 | except (IndexError, ValueError): | CODE |
| HIGH | src/schemathesis/transport/serialization.py | 211 | except KeyError: | CODE |
| HIGH | src/schemathesis/core/transforms.py | 53 | except ValueError: | CODE |
| HIGH | src/schemathesis/core/transport.py | 282 | except ImportError: | CODE |
| HIGH | src/schemathesis/core/transport.py | 289 | except ImportError: | CODE |
| HIGH | src/schemathesis/core/rate_limit.py | 44 | except ValueError: | CODE |
| HIGH | src/schemathesis/core/cache/bounded.py | 28 | except KeyError: | CODE |
| HIGH | src/schemathesis/pytest/plugin.py | 587 | except ImportError: | CODE |
| HIGH | src/schemathesis/python/django.py | 41 | except DisallowedHost: | CODE |
| HIGH | src/schemathesis/python/asgi.py | 90 | except Exception: | CODE |
| HIGH | src/schemathesis/python/_constants/walk.py | 57 | except BaseException: | CODE |
| HIGH | src/schemathesis/specs/openapi/schemas.py | 642 | except TypeError: | CODE |
| HIGH | src/schemathesis/specs/openapi/utils.py | 53 | except (ValueError, TypeError): | CODE |
| HIGH | src/schemathesis/specs/openapi/utils.py | 58 | except (ValueError, TypeError): | CODE |
| HIGH | src/schemathesis/specs/openapi/extra_data_source.py | 848 | except TypeError: # unhashable value (e.g. list); fall through, eviction still runs | CODE |
| HIGH | src/schemathesis/specs/openapi/examples.py | 646 | except requests.RequestException: | CODE |
| HIGH | src/schemathesis/specs/openapi/adapter/responses.py | 238 | except RefResolutionError: | CODE |
| HIGH | src/schemathesis/specs/openapi/adapter/validators.py | 35 | except ValueError: | CODE |
| HIGH | src/schemathesis/cli/commands/run/handlers/crashes.py | 105 | except OSError: | CODE |
| HIGH | src/schemathesis/openapi/loaders.py | 293 | except ValueError: | CODE |
| HIGH | src/schemathesis/engine/outage.py | 231 | except OSError: | CODE |
| HIGH | src/schemathesis/engine/run/cache.py | 144 | except OSError: | CODE |
| HIGH | src/schemathesis/engine/run/cache.py | 215 | except OSError: | CODE |
| HIGH | src/schemathesis/generation/case.py | 336 | except (TypeError, ValueError): | CODE |
| HIGH | src/schemathesis/generation/case.py | 462 | except Exception: | CODE |
| HIGH | src/schemathesis/generation/jsonschema/strategy.py | 780 | except DECLINED: | CODE |
| HIGH | src/schemathesis/generation/jsonschema/strategy.py | 1627 | except InvalidArgument: | CODE |
| HIGH | src/schemathesis/generation/jsonschema/strategy.py | 1636 | except InvalidArgument: | CODE |
| HIGH | src/schemathesis/generation/jsonschema/strategy.py | 773 | except DECLINED: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | test/transport/test_serialization.py | 503 | (["x", {"b": None}], ["x", '{"b": null}']), | CODE |
| HIGH⚡ | test/transport/test_serialization.py | 1722 | ({"a": 1, "b": None}, b'{"a": 1, "b": null}'), | CODE |
| HIGH⚡ | test/transport/test_serialization.py | 1723 | ([1, "x", None], b'[1, "x", null]'), | CODE |
| HIGH⚡ | test/transport/test_serialization.py | 1724 | ({"outer": {"inner": None}}, b'{"outer": {"inner": null}}'), | CODE |
| HIGH | test/transport/test_serialization.py | 628 | ("text/plain", {"type": "object"}, {"x": None}, [["f", "text/plain", '{"x": null}']]), | CODE |
| HIGH | test/core/error_feedback/parsers/test_spring.py | 32 | b'rejected value [null]; codes [...]; default message [must not be null]] ",' | CODE |
| HIGH | test/core/error_feedback/parsers/test_spring.py | 88 | {"detail": "... [Field error in object 'X' on field 'y': default message [must not be null]]"}, | CODE |
| HIGH | test/core/error_feedback/parsers/test_spring.py | 715 | b"[Field error in object 'X' on field 'email': rejected value [null]; " | CODE |
| HIGH | test/core/error_feedback/parsers/test_spring.py | 716 | b"codes [...]; default message [must not be null]] " | CODE |
| HIGH | test/specs/openapi/test_negative.py | 472 | # FastAPI's `Optional[Enum]` query param shape: `anyOf:[{$ref}, {type:null}]` with a sibling enum. | COMMENT |
| HIGH | test/specs/openapi/test_resilience.py | 34 | [{"url": "http://x/{undefined}"}], | CODE |
| HIGH⚡ | test/specs/openapi/test_error_feedback.py | 75 | """Detect OpenAPI 3.1 / JSON Schema 2020-12 type-union syntax (`type: [..., null]`).""" | STRING |
| HIGH⚡ | test/specs/openapi/test_error_feedback.py | 88 | The validator is auto-selected: schemas using `type: [..., null]` syntax are | STRING |
| HIGH⚡ | test/specs/openapi/test_serializing.py | 961 | (openapi3_delimited_parameter("form"), "3.0.2", "color=null,true,false,1,1.5,x"), | STRING |
| HIGH⚡ | test/specs/openapi/test_serializing.py | 965 | (swagger2_delimited_parameter("csv"), "2.0", "color=null,true,false,1,1.5,x"), | STRING |
| HIGH | test/specs/openapi/test_serializing.py | 626 | # Example from OAS 3.2: {"numbers":[1,2],"flag":null} | STRING |
| HIGH | test/specs/openapi/test_serializing.py | 1013 | _WIRE_FORM_RENDERED = (("arr", "null,true,false,1,1.5,x"), ("flag", "true"), ("opt", "null")) | STRING |
| HIGH | test/specs/openapi/test_hypothesis.py | 196 | # No mainstream framework reads `?limit=null` as a JSON null; absence is how a query string says "no value". | COMMENT |
| HIGH | test/specs/openapi/test_checks.py | 2172 | (MULTIPART, None, ["x", {"b": None}], b'name="description"\r\n\r\n{"b": null}\r\n'), | CODE |
| HIGH⚡ | test/specs/graphql/test_resource_pool.py | 257 | [b"not-json", b"{}", b'{"data": null}', b'{"data": "scalar"}'], | STRING |
| HIGH | test/specs/graphql/test_basic.py | 439 | "wrongly returned a null value. The graphql specification requires that the parent field be set to null, or if " | CODE |
| HIGH⚡ | test/specs/graphql/test_basic.py | 1030 | (b'{"data": null, "errors": [{"message": "Boom", "path": ["getBooks"]}]}', CallOutcome.REJECTED), | STRING |
| HIGH⚡ | test/specs/graphql/test_basic.py | 1032 | (b'{"data": null}', CallOutcome.REJECTED), | STRING |
| HIGH | test/cli/test_replay.py | 1216 | ('{"id": 1}', '{"id": null}', ["/id"], False), | CODE |
| HIGH | test/engine/test_checks.py | 415 | b'{"success": null}', | CODE |
| HIGH | test/engine/test_checks.py | 526 | response_factory.requests(content=b'{"direction": ["N", "E", "S", "W", null]}'), True | CODE |
| HIGH | test/apps/catalog/openapi/wfc.py | 30 | # Rich body covers every token-extraction branch: string, coerced number, null, and non-string. | COMMENT |
| HIGH | test/generation/test_hypothesis.py | 304 | # A 3.1 `type: [null, boolean]` body lifts to a multi-type union; values stay null or boolean. | COMMENT |
| HIGH | src/schemathesis/core/error_feedback/parsers/spring.py | 31 | r"|can(?:not|'?t) be (?:blank|empty|null)" | CODE |
| HIGH | src/schemathesis/core/error_feedback/parsers/spring.py | 140 | # `detail`, e.g. `... [Field error in object 'X' on field 'Y': ...; default message [must not be null]]`. | COMMENT |
| HIGH | src/schemathesis/specs/openapi/_hypothesis.py | 1131 | Query strings have no rendering for a JSON null; leaving the parameter out is what "no value" means there. | STRING |
| HIGH | src/schemathesis/specs/openapi/converter.py | 124 | # An `enum` that omits null forbids null, so requests keep it as written; responses stay lenient. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | test/code_samples/test_curl.py | 81 | case.operation.schema.config.output.sanitization.update(enabled=False) | CODE |
| CRITICAL | test/pytest/test_config_options.py | 132 | schema.config.phases.fuzzing.generation.update(max_examples={max_examples}) | CODE |
| CRITICAL | test/specs/openapi/negative/test_deep_distribution.py | 45 | schema.config.phases.fuzzing.generation.update(max_examples=500) | CODE |
| CRITICAL | test/specs/openapi/negative/test_deep_distribution.py | 75 | schema.config.phases.fuzzing.generation.update(max_examples=500) | CODE |
| CRITICAL | test/specs/openapi/negative/test_deep_distribution.py | 106 | schema.config.phases.fuzzing.generation.update(max_examples=300) | CODE |
| CRITICAL | test/cli/test_negative_metadata.py | 191 | schema.config.phases.fuzzing.generation.update(max_examples=20) | CODE |
| CRITICAL | test/cli/test_negative_metadata.py | 213 | schema.config.phases.fuzzing.generation.update(max_examples=50) | CODE |
| CRITICAL | test/generation/test_hypothesis.py | 81 | schema.config.phases.fuzzing.generation.update(modes=[GenerationMode.NEGATIVE]) | CODE |
| CRITICAL | src/schemathesis/auths.py | 682 | for scheme in schema.config.auth.dynamic.schemes.values(): | CODE |
| CRITICAL | src/schemathesis/specs/openapi/object_authorization.py | 135 | node = case.operation.schema.analysis.dependency_graph.operations.get(case.operation.label) | CODE |
| CRITICAL | src/schemathesis/specs/openapi/analysis.py | 197 | and self.schema.config.phases.stateful.inference.is_algorithm_enabled( | CODE |
| CRITICAL | src/schemathesis/specs/openapi/checks.py | 1016 | for scheme in operation.schema.config.auth.dynamic.schemes.values(): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/corpus/io.py | 116 | print(f"Error parsing {file_path}") # noqa: T201 | CODE |
| LOW | tools/corpus/locator.py | 46 | except Exception: | CODE |
| LOW | test/conftest.py | 61 | except Exception: | CODE |
| LOW | test/conftest.py | 65 | except Exception: | CODE |
| MEDIUM | test/conftest.py | 58 | def _get_current_coverage() -> Any | None: | CODE |
| LOW | test/utils.py | 185 | except Exception: | CODE |
| LOW | test/core/cache/test_bounded.py | 33 | except Exception as exc: | CODE |
| LOW⚡ | test/specs/openapi/test_resources.py | 152 | except Exception as exc: | CODE |
| LOW | test/specs/openapi/test_resources.py | 108 | except Exception as exc: | CODE |
| LOW | test/cli/test_commands.py | 3131 | except Exception as exc: | STRING |
| LOW | docs/guides/custom-response-deserializers.md | 49 | except Exception as exc: | CODE |
| LOW | scripts/profile.py | 204 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | benches/multi_operation.py | 34 | except Exception: | CODE |
| LOW | benches/multi_operation.py | 50 | except Exception: | CODE |
| LOW | src/schemathesis/hooks.py | 67 | except Exception: | CODE |
| MEDIUM | src/schemathesis/hooks.py | 64 | def _reset_on_error() -> Generator: | CODE |
| LOW | src/schemathesis/checks.py | 303 | except Exception as exc: | CODE |
| LOW | src/schemathesis/checks.py | 531 | except Exception as exc: | CODE |
| LOW | src/schemathesis/checks.py | 569 | except Exception as exc: | CODE |
| LOW | src/schemathesis/auths.py | 172 | except Exception as exc: | CODE |
| LOW | src/schemathesis/auths.py | 337 | except Exception as exc: | CODE |
| LOW | src/schemathesis/auths.py | 708 | except Exception: | CODE |
| LOW | src/schemathesis/core/hooks.py | 25 | except Exception as exc: | CODE |
| LOW | src/schemathesis/core/rate_limit.py | 51 | except Exception: | CODE |
| LOW | src/schemathesis/core/jsonschema/__init__.py | 361 | except Exception: | CODE |
| LOW | src/schemathesis/core/error_feedback/pipeline.py | 61 | except Exception: | CODE |
| LOW | src/schemathesis/pytest/xdist.py | 372 | except Exception: | CODE |
| LOW | src/schemathesis/pytest/plugin.py | 301 | except Exception: | CODE |
| LOW | src/schemathesis/pytest/plugin.py | 341 | except Exception: | CODE |
| LOW | src/schemathesis/pytest/plugin.py | 362 | except Exception: | CODE |
| LOW | src/schemathesis/python/asgi.py | 77 | except Exception as exc: | CODE |
| LOW | src/schemathesis/python/asgi.py | 90 | except Exception: | CODE |
| LOW | src/schemathesis/python/asgi.py | 141 | except Exception: | CODE |
| MEDIUM | src/schemathesis/python/asgi.py | 120 | def stop(self) -> None: | CODE |
| LOW | src/schemathesis/python/_constants/orchestrator.py | 171 | except Exception: | CODE |
| LOW | src/schemathesis/python/_constants/orchestrator.py | 196 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/auth_inference.py | 91 | except Exception: # noqa: BLE001 - probe must not propagate; one bad scheme can't kill the loop. | CODE |
| LOW⚡ | src/schemathesis/specs/openapi/checks.py | 589 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/checks.py | 315 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/checks.py | 408 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/checks.py | 486 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/checks.py | 553 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/checks.py | 697 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/checks.py | 816 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/checks.py | 1262 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/auths.py | 198 | except Exception as exc: | CODE |
| LOW | src/schemathesis/specs/openapi/auths.py | 227 | except Exception as exc: | CODE |
| LOW | src/schemathesis/specs/openapi/operations.py | 302 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/content_keywords.py | 97 | except Exception as exc: | CODE |
| LOW | src/schemathesis/specs/openapi/examples.py | 829 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/validation.py | 130 | except Exception as exc: | CODE |
| LOW | src/schemathesis/specs/openapi/stateful/links.py | 172 | except Exception as exc: | CODE |
| LOW | src/schemathesis/specs/openapi/stateful/links.py | 227 | except Exception as exc: | CODE |
| LOW | src/schemathesis/specs/openapi/stateful/links.py | 242 | except Exception as exc: | CODE |
| LOW | …c/schemathesis/specs/openapi/stateful/_link_chooser.py | 34 | except Exception: | CODE |
| MEDIUM | …c/schemathesis/specs/openapi/stateful/_link_chooser.py | 31 | def in response_def.iter_links(): | CODE |
| LOW⚡ | src/schemathesis/specs/openapi/adapter/parameters.py | 951 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/adapter/parameters.py | 341 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/adapter/parameters.py | 370 | except Exception: | CODE |
| LOW | src/schemathesis/specs/openapi/adapter/parameters.py | 1032 | except Exception: | CODE |
| 28 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/schemathesis/__init__.py | 19 | __all__ = [ | CODE |
| LOW | src/schemathesis/auths.py | 195 | def _set_cache_entry(self, data: Auth, case: Case, context: AuthContext) -> None: | CODE |
| LOW | src/schemathesis/auths.py | 223 | def _set_cache_entry(self, data: Auth, case: Case, context: AuthContext) -> None: | CODE |
| LOW | src/schemathesis/auths.py | 569 | def set_on_case(case: Case, context: AuthContext, auth_storage: AuthStorage | None) -> None: | CODE |
| LOW | src/schemathesis/errors.py | 30 | __all__ = [ | CODE |
| LOW | src/schemathesis/reporting/__init__.py | 7 | __all__ = [ | CODE |
| LOW | src/schemathesis/reporting/html/__init__.py | 13 | __all__ = ["write_report"] | CODE |
| LOW | src/schemathesis/core/compat.py | 9 | __all__ = ["BaseExceptionGroup"] | CODE |
| LOW | src/schemathesis/core/cache/__init__.py | 13 | __all__ = [ | CODE |
| LOW | src/schemathesis/core/jsonschema/__init__.py | 374 | __all__ = [ | CODE |
| LOW | src/schemathesis/core/error_feedback/__init__.py | 19 | __all__ = [ | CODE |
| LOW | src/schemathesis/core/error_feedback/parsers/zod.py | 186 | __all__ = ["ZodParser"] | CODE |
| LOW | src/schemathesis/core/error_feedback/parsers/aspnet.py | 216 | __all__ = ["AspNetParser"] | CODE |
| LOW | …chemathesis/core/error_feedback/parsers/marshmallow.py | 206 | __all__ = ["MarshmallowParser"] | CODE |
| LOW | src/schemathesis/core/error_feedback/parsers/restler.py | 174 | __all__ = ["RestlerParser"] | CODE |
| LOW | src/schemathesis/core/error_feedback/parsers/ajv.py | 371 | __all__ = ["AjvParser"] | CODE |
| LOW | …/schemathesis/core/error_feedback/parsers/confluent.py | 154 | __all__ = ["ConfluentParser"] | CODE |
| LOW | …hemathesis/core/error_feedback/parsers/go_validator.py | 253 | __all__ = ["GoValidatorParser"] | CODE |
| LOW | src/schemathesis/core/error_feedback/parsers/laravel.py | 190 | __all__ = ["LaravelParser"] | CODE |
| LOW | …c/schemathesis/core/error_feedback/parsers/litestar.py | 191 | __all__ = ["LitestarParser"] | CODE |
| LOW | …schemathesis/core/error_feedback/parsers/flask_rest.py | 226 | __all__ = ["FlaskRestParser"] | CODE |
| LOW | src/schemathesis/core/error_feedback/parsers/symfony.py | 239 | __all__ = ["SymfonyParser"] | CODE |
| LOW | src/schemathesis/pytest/__init__.py | 13 | __all__ = [ | CODE |
| LOW | src/schemathesis/python/__init__.py | 3 | __all__ = ["constants"] | CODE |
| LOW | src/schemathesis/python/_constants/__init__.py | 4 | __all__ = ["ConstantEntry", "ConstantsPool", "Origin", "constants"] | CODE |
| LOW | src/schemathesis/config/__init__.py | 52 | __all__ = [ | CODE |
| LOW | src/schemathesis/config/_warnings.py | 10 | __all__ = ["SchemathesisWarning", "WarningsConfig"] | CODE |
| LOW | src/schemathesis/config/_checks.py | 314 | def _set_enabled(self, name: str, *, known_names: set[str], enabled: bool) -> None: | CODE |
| LOW | src/schemathesis/config/_projects.py | 709 | def _set_parent(self, parent: SchemathesisConfig) -> None: | CODE |
| LOW | src/schemathesis/specs/openapi/_auth_retry.py | 31 | def set_auth_for_case(case: Case, parameter: Mapping[str, Any]) -> None: | CODE |
| LOW | src/schemathesis/specs/openapi/definitions.py | 2572 | __all__ = ["SWAGGER_20", "OPENAPI_30", "OPENAPI_31", "OPENAPI_32", *_VALIDATORS] | CODE |
| LOW | src/schemathesis/specs/openapi/converter.py | 611 | def update_pattern_in_schema(schema: dict[str, Any]) -> None: | CODE |
| LOW | src/schemathesis/specs/openapi/__init__.py | 12 | __all__ = [ | CODE |
| LOW | src/schemathesis/specs/openapi/examples.py | 551 | def _update_dict_keyword(merged: dict[str, Any], key: str, value: Any) -> None: | CODE |
| LOW | src/schemathesis/specs/openapi/types/__init__.py | 9 | __all__ = ["OperationObject", "common", "v2", "v3"] | CODE |
| LOW | …thesis/specs/openapi/stateful/dependencies/__init__.py | 57 | __all__ = [ | CODE |
| LOW | …mathesis/specs/openapi/stateful/dependencies/inputs.py | 623 | def update_input_field_bindings(resource_name: str, operations: OperationMap) -> None: | CODE |
| LOW | src/schemathesis/specs/openapi/adapter/v3_2.py | 49 | __all__ = [ | CODE |
| LOW | src/schemathesis/specs/openapi/adapter/__init__.py | 4 | __all__ = [ | CODE |
| LOW | src/schemathesis/specs/openapi/expressions/__init__.py | 19 | __all__ = ["MultiMatch", "lexer", "nodes", "parser"] | CODE |
| LOW | src/schemathesis/specs/graphql/nodes.py | 10 | __all__ = [ # noqa: F822 | CODE |
| LOW | src/schemathesis/specs/graphql/stateful/__init__.py | 127 | __all__ = ["GraphQLStateMachine", "create_state_machine"] | CODE |
| LOW | src/schemathesis/wfc/__init__.py | 14 | __all__ = [ | CODE |
| LOW | src/schemathesis/resources/__init__.py | 116 | __all__ = [ | CODE |
| LOW | src/schemathesis/baseline/__init__.py | 3 | __all__ = ["Baseline", "BaselineEntry", "Identity", "failure_identity"] | CODE |
| LOW | src/schemathesis/cli/__init__.py | 10 | __all__ = [ | CODE |
| LOW | src/schemathesis/cli/commands/fuzz/handlers/output.py | 203 | def update_error_count(self, error_count: int) -> None: | CODE |
| LOW | src/schemathesis/cli/commands/run/handlers/__init__.py | 9 | __all__ = [ | CODE |
| LOW | src/schemathesis/cli/commands/run/handlers/output.py | 748 | def set_suffix(self, suffix: str) -> None: | CODE |
| LOW | src/schemathesis/cli/commands/run/handlers/output.py | 752 | def _update_stats_display(self) -> None: | CODE |
| LOW | src/schemathesis/cli/commands/run/handlers/output.py | 787 | def update_progress(self) -> None: | CODE |
| LOW | src/schemathesis/cli/commands/run/handlers/output.py | 829 | def update_stats(self, label: str, status: Status) -> None: | CODE |
| LOW | src/schemathesis/cli/commands/run/handlers/output.py | 994 | def _update_progress_display(self) -> None: | CODE |
| LOW | src/schemathesis/cli/commands/run/handlers/output.py | 1016 | def _update_stats_display(self) -> None: | CODE |
| LOW | src/schemathesis/openapi/__init__.py | 4 | __all__ = [ | CODE |
| LOW | src/schemathesis/openapi/generation/filters.py | 7 | __all__ = [ | CODE |
| LOW | src/schemathesis/graphql/__init__.py | 5 | __all__ = [ | CODE |
| LOW | src/schemathesis/engine/core.py | 274 | def _settle_stateful(self, engine: EngineContext) -> None: | CODE |
| LOW | src/schemathesis/engine/errors.py | 39 | __all__ = ["EngineErrorInfo", "DeadlineExceeded", "UnexpectedError"] | CODE |
| LOW | src/schemathesis/generation/__init__.py | 8 | __all__ = [ | CODE |
| 3 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/filters/test_expressions.py | 9 | ('/user/name == "John Doe"', ("/user/name", "==", "John Doe")), | CODE |
| LOW | test/filters/test_expressions.py | 20 | (' /user/name == "John Doe" ', ("/user/name", "==", "John Doe")), | CODE |
| LOW | test/filters/test_expressions.py | 23 | ('/user/email == "user@example.com"', ("/user/email", "==", "user@example.com")), | CODE |
| LOW⚡ | test/filters/test_expressions.py | 35 | '/user/name "John Doe"', | CODE |
| LOW⚡ | test/filters/test_expressions.py | 36 | '/user/name <> "John Doe"', | CODE |
| LOW⚡ | test/filters/test_expressions.py | 40 | '== "John Doe"', | CODE |
| LOW | test/python/test_case_metadata.py | 848 | original_value="user@example.com", | STRING |
| LOW | test/python/_constants/test_filter.py | 13 | ("user@example.com", True), | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 746 | assert _draw(data, source, schema_properties={"blob": schema}) == "placeholder" | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 767 | assert _draw(data, _source("bytes", b"OK"), schema_properties={"blob": schema}) == "placeholder" | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 774 | assert _draw(data, _source("bytes", b"x"), schema_properties={"blob": schema}) == "placeholder" | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 784 | assert blob == "placeholder" | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 796 | assert _draw(data, source, schema_properties={"blob": schema}) == "placeholder" | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 804 | source = _source("string", "user@example.com") | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 806 | assert _draw(data, source, schema_properties={"blob": schema}) == "user@example.com" | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 816 | assert _draw(data, source, schema_properties={"blob": schema}) == "placeholder" | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 842 | st.just(GeneratedValue(value={"blob": "placeholder"}, meta=None)), | CODE |
| LOW⚡ | test/python/_constants/test_generation.py | 1026 | assert blob == "placeholder" | CODE |
| LOW | test/python/_constants/test_generation.py | 727 | st.just({"blob": "placeholder"}), | CODE |
| LOW | test/python/_constants/test_generation.py | 1043 | assert blob == "placeholder" | CODE |
| LOW | test/specs/openapi/test_semantic_pool.py | 329 | {"description": "lorem ipsum dolor sit"}, | CODE |
| LOW | test/specs/openapi/test_semantic_pool.py | 330 | [IngestionLeaf("string", None, None, "description", "lorem ipsum dolor sit")], | CODE |
| LOW | test/specs/openapi/test_semantic_pool.py | 819 | body={"email": "user@example.com", "country": "DE"}, | CODE |
| LOW | test/specs/openapi/test_semantic_pool.py | 827 | assert "user@example.com" in _lookup_by_descriptor(extra_data_source.semantic_index, email_desc) | CODE |
| LOW | test/specs/openapi/test_semantic_pool.py | 2198 | st.fixed_dictionaries({"code": st.just("placeholder")}), | CODE |
| LOW | test/specs/openapi/test_examples.py | 2117 | "name": {"type": "string", "example": "John Doe"}, | STRING |
| LOW | test/specs/openapi/test_examples.py | 2124 | "name": "John Doe", | STRING |
| LOW | test/specs/openapi/negative/test_metadata.py | 113 | original_value="user@example.com", | CODE |
| LOW | test/specs/openapi/negative/test_metadata.py | 116 | 'violates `format:email` at /properties/email (was "user@example.com", became "useratexample.com")', | CODE |
| LOW⚡ | test/specs/openapi/negative/test_value_violators.py | 35 | assert not validator.is_valid(violate_email("user@example.com")) | CODE |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 172 | operation = _parse('query { book(id: "placeholder") { id } }') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 177 | assert "placeholder" not in printed | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 179 | assert "placeholder" in printed | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 192 | operation = _parse(f'query {{ lookup({arg_name}: "placeholder") }}') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 205 | operation = _parse('query { lookup(id: "placeholder") }') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 207 | assert "placeholder" in graphql.print_ast(operation) | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 218 | operation = _parse('query { lookup(filter: "placeholder") }') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 220 | assert "placeholder" in graphql.print_ast(operation) | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 232 | operation = _parse('query { lookup(authorId: "placeholder") }') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 234 | assert "placeholder" in graphql.print_ast(operation) | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 248 | operation = _parse('query { author(id: "placeholder") { id } }') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 252 | assert "placeholder" in printed | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 338 | operation = _parse('query { bookByTitle(title: "placeholder") { id } }') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 341 | assert "placeholder" in graphql.print_ast(operation) | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 354 | operation = _parse('query { books(filter: {title: "placeholder"}) { id } }') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 356 | assert "placeholder" in graphql.print_ast(operation) | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 378 | operation = _parse(f'query {{ lookup(ref: {{{input_field}: "placeholder"}}) }}') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 428 | operation = _parse('query { authorPosts(ref: {id: "placeholder"}) }') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 430 | assert "placeholder" in graphql.print_ast(operation) | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 443 | operation = _parse('query { book(id: "placeholder") { id ...BookFields } } fragment BookFields on Book { title }') | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 462 | 'query { __typename book(id: "placeholder", extra: "keep") ' | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 463 | 'books(filter: {id: "placeholder", unknown: "keep"}) { id } }' | STRING |
| LOW⚡ | test/specs/graphql/test_resource_pool.py | 572 | operation = _parse('query { author { books(bookId: "placeholder") } }') | STRING |
| LOW | test/specs/graphql/test_resource_pool.py | 411 | operation = _parse('mutation { updateBook(input: {ref: {id: "placeholder"}, title: "t"}) { id } }') | STRING |
| LOW | test/cli/test_extra_data_sources.py | 485 | user = {"id": user_id, "email": data.get("email", "user@example.com")} | CODE |
| LOW | test/apps/catalog/openapi/stateful.py | 35 | return {0: {"id": 0, "name": "John Doe", "last_modified": "2021-01-01T00:00:00Z"}} | CODE |
| LOW | docs/explanations/examples.md | 14 | example: "John Doe" | CODE |
| LOW | docs/explanations/examples.md | 28 | name: "John Doe" | CODE |
| LOW | docs/explanations/examples.md | 57 | - name: "John Doe" | CODE |
| LOW | docs/guides/fuzz-dictionary.md | 65 | values = ["test@example.com", "admin@example.com"] | CODE |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/pytest/test_class_checks.py | 0 | schema.config.reports.update(junit_path=r"{report_path}") lazy_schema = schemathesis.pytest.from_fixture("simple_schema" | STRING |
| HIGH | test/pytest/test_lazy.py | 0 | schema.config.reports.update(junit_path=r"{report_path}") lazy_schema = schemathesis.pytest.from_fixture("simple_schema" | STRING |
| HIGH | test/pytest/test_reporting.py | 0 | schema.config.reports.update(junit_path=r"{report_path}") lazy_schema = schemathesis.pytest.from_fixture("simple_schema" | STRING |
| HIGH | test/specs/graphql/test_resource_pool.py | 0 | type book { id: id! } type query { book(id: id!): book } type mutation { addbook(title: string!): book! deletebook(id: i | STRING |
| HIGH | test/specs/graphql/stateful/test_state_machine.py | 0 | type book { id: id! } type query { book(id: id!): book } type mutation { addbook(title: string!): book! deletebook(id: i | STRING |
| HIGH | test/specs/graphql/stateful/test_discovery.py | 0 | type book { id: id! } type query { book(id: id!): book } type mutation { addbook(title: string!): book! deletebook(id: i | STRING |
| HIGH | test/specs/graphql/stateful/test_transitions.py | 0 | type book { id: id! } type query { book(id: id!): book } type mutation { addbook(title: string!): book! deletebook(id: i | STRING |
| HIGH | test/specs/graphql/stateful/test_bundles.py | 0 | type book { id: id! } type query { book(id: id!): book } type mutation { addbook(title: string!): book! deletebook(id: i | STRING |
| HIGH | test/specs/graphql/stateful/test_bundles.py | 0 | type book { id: id! } type query { book(id: id!): book } type mutation { _: boolean } | STRING |
| HIGH | test/specs/graphql/stateful/test_state_machine.py | 0 | type book { id: id! } type query { book(id: id!): book } type mutation { _: boolean } | STRING |
| HIGH | test/specs/graphql/stateful/test_transitions.py | 0 | type book { id: id! } type query { book(id: id!): book } type mutation { _: boolean } | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | changelog.py | 47 | # Check if the new version already exists. | COMMENT |
| LOW | test/config/test_doc_examples.py | 123 | # Check if current uses additionalProperties (e.g., auth.openapi.<scheme>) | COMMENT |
| LOW | test/cli/test_commands.py | 1478 | # Check if field exists (could be in files or form) | STRING |
| LOW | test/cli/test_checks.py | 1397 | # Check if 'ids' parameter is present in the URL | COMMENT |
| LOW | scripts/is_interesting.sh | 15 | # Check if needle is present in output | COMMENT |
| LOW | src/schemathesis/core/jsonschema/patterns.py | 419 | # Check if there are still untranslated Unicode property escapes | STRING |
| LOW | src/schemathesis/pytest/lazy.py | 210 | # Check if test function is a method and inject self from request.instance | COMMENT |
| LOW | src/schemathesis/config/_generation.py | 80 | # Check if all parameters match their default values | COMMENT |
| LOW | src/schemathesis/specs/openapi/warnings.py | 220 | # Check if scheme exists in the schema definition, and suggest a candidate if it does not | COMMENT |
| LOW⚡ | src/schemathesis/specs/openapi/checks.py | 1199 | # Check if the case contains only additional properties in query, headers, or cookies. | COMMENT |
| LOW | src/schemathesis/specs/openapi/checks.py | 1486 | # Check if all parameters come from links | COMMENT |
| LOW | src/schemathesis/specs/openapi/checks.py | 1564 | # Check if invalid auth will give an error | COMMENT |
| LOW | src/schemathesis/specs/openapi/stateful/links.py | 165 | # Check if parameter exists in source operation | COMMENT |
| LOW | src/schemathesis/specs/openapi/stateful/inference.py | 185 | # Check if it's an absolute URL | COMMENT |
| LOW | …mathesis/specs/openapi/stateful/dependencies/models.py | 550 | # Check if this field is a FK field | COMMENT |
| LOW | …mathesis/specs/openapi/stateful/dependencies/models.py | 644 | # Check if next part is an array index | COMMENT |
| LOW | …thesis/specs/openapi/stateful/dependencies/__init__.py | 296 | # Check if duplicate / subsets exists | COMMENT |
| LOW | …thesis/specs/openapi/stateful/dependencies/__init__.py | 432 | # Check if all inferred fields exist in existing with same values | COMMENT |
| LOW | …mathesis/specs/openapi/stateful/dependencies/inputs.py | 291 | # Check if candidate ends with OR starts with the inferred resource name | COMMENT |
| LOW | …mathesis/specs/openapi/stateful/dependencies/inputs.py | 297 | # Check if parameter can be matched to a field | COMMENT |
| LOW | …athesis/specs/openapi/stateful/dependencies/schemas.py | 398 | # Check if array field name matches common patterns | COMMENT |
| LOW | …athesis/specs/openapi/stateful/dependencies/schemas.py | 420 | # Check if field name matches resource-specific pattern | COMMENT |
| LOW | …athesis/specs/openapi/stateful/dependencies/schemas.py | 490 | # Check if any other property looks like pagination metadata | COMMENT |
| LOW | …hesis/specs/openapi/stateful/dependencies/resources.py | 401 | # Check if this branch defines the target property | COMMENT |
| LOW | …hesis/specs/openapi/stateful/dependencies/resources.py | 508 | # Check if it's an array | COMMENT |
| LOW | …mathesis/specs/openapi/stateful/dependencies/layers.py | 115 | # Check if all operations were processed (no cycles) | COMMENT |
| LOW | src/schemathesis/specs/openapi/adapter/security.py | 132 | # Check if a security parameter was intentionally removed during negative testing | COMMENT |
| LOW | src/schemathesis/specs/openapi/adapter/security.py | 149 | # Check if all schemes in this requirement can be satisfied (AND semantics) | COMMENT |
| LOW | src/schemathesis/specs/graphql/validation.py | 132 | # Check if this is a client error (query validation failed) | COMMENT |
| LOW | src/schemathesis/resources/repository.py | 283 | # Check if we need to evict an old context | COMMENT |
| LOW | src/schemathesis/cli/commands/run/warnings.py | 373 | # Check if this warning should cause test failure | COMMENT |
| LOW | src/schemathesis/engine/core.py | 101 | # Check if feature is supported by the schema | COMMENT |
| LOW | src/schemathesis/engine/statistic.py | 188 | # Check if this is a new unique failure | COMMENT |
| LOW⚡ | src/schemathesis/generation/hypothesis/builder.py | 185 | # Check if user provided custom strategies via @schema.given() | COMMENT |
| LOW⚡ | src/schemathesis/generation/hypothesis/builder.py | 189 | # Check if there are actually examples to add | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | test/pytest/test_parametrization.py | 819 | # Create a custom database in a temporary directory | COMMENT |
| MEDIUM | test/pytest/test_parametrization.py | 784 | # Create a custom database in a temporary directory | COMMENT |
| MEDIUM | test/pytest/test_lazy.py | 1083 | # Create a custom database in a temporary directory | COMMENT |
| MEDIUM | test/pytest/test_lazy.py | 1119 | # Create a custom database in a temporary directory | COMMENT |
| MEDIUM | test/config/test_discovery.py | 26 | # Create a config file in the parent directory | STRING |
| MEDIUM | test/config/test_discovery.py | 49 | # Create a structure where a .git folder exists in the parent directory. | STRING |
| MEDIUM | test/specs/openapi/test_negative.py | 362 | # Creating a validator validates the schema | COMMENT |
| MEDIUM | test/specs/openapi/test_checks.py | 2680 | # Create a successful response (200 OK) | COMMENT |
| MEDIUM⚡ | test/specs/openapi/test_schema_loading.py | 109 | # Creating a second in-memory resolver must not corrupt the first one's lookups. | COMMENT |
| MEDIUM | test/cli/test_junitxml.py | 65 | # Create a mapping from testcase name to element | COMMENT |
| MEDIUM⚡ | src/schemathesis/specs/openapi/checks.py | 1200 | # This function is used to determine if negation is solely in the form of extra properties, | COMMENT |
| MEDIUM | src/schemathesis/resources/repository.py | 259 | # Create a stable key for the context | COMMENT |
| MEDIUM | src/schemathesis/cli/ext/fs.py | 47 | # Creating the parent directories fails this way when part of the path is a file; the OS wording differs. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/conftest.py | 503 | CODE | |
| LOW | test/utils.py | 202 | CODE | |
| LOW | test/specs/openapi/test_checks.py | 115 | CODE | |
| LOW | test/specs/openapi/stateful/conftest.py | 33 | CODE | |
| LOW | test/specs/openapi/auth_flow/test_detection.py | 34 | CODE | |
| LOW | src/schemathesis/schemas.py | 157 | CODE | |
| LOW | src/schemathesis/schemas.py | 207 | CODE | |
| LOW | src/schemathesis/schemas.py | 460 | CODE | |
| LOW | src/schemathesis/schemas.py | 1042 | CODE | |
| LOW | src/schemathesis/filters.py | 219 | CODE | |
| LOW | src/schemathesis/filters.py | 250 | CODE | |
| LOW | src/schemathesis/filters.py | 281 | CODE | |
| LOW | src/schemathesis/filters.py | 351 | CODE | |
| LOW | src/schemathesis/core/spec.py | 121 | CODE | |
| LOW | src/schemathesis/pytest/lazy.py | 90 | CODE | |
| LOW | src/schemathesis/pytest/lazy.py | 122 | CODE | |
| LOW | src/schemathesis/config/_report.py | 79 | CODE | |
| LOW | src/schemathesis/config/_report.py | 120 | CODE | |
| LOW | src/schemathesis/config/_generation.py | 45 | CODE | |
| LOW | src/schemathesis/config/_generation.py | 139 | CODE | |
| LOW | src/schemathesis/config/__init__.py | 111 | CODE | |
| LOW | src/schemathesis/config/_checks.py | 175 | CODE | |
| LOW | src/schemathesis/config/_operations.py | 289 | CODE | |
| LOW | src/schemathesis/config/_projects.py | 123 | CODE | |
| LOW | src/schemathesis/config/_projects.py | 255 | CODE | |
| LOW | src/schemathesis/specs/openapi/_hypothesis.py | 131 | CODE | |
| LOW | src/schemathesis/specs/openapi/converter.py | 21 | CODE | |
| LOW | src/schemathesis/specs/openapi/converter.py | 36 | CODE | |
| LOW | src/schemathesis/specs/openapi/converter.py | 50 | CODE | |
| LOW | src/schemathesis/specs/openapi/converter.py | 79 | CODE | |
| LOW | src/schemathesis/specs/openapi/schemas.py | 788 | CODE | |
| LOW | src/schemathesis/specs/graphql/schemas.py | 533 | CODE | |
| LOW | src/schemathesis/specs/graphql/schemas.py | 399 | CODE | |
| LOW | src/schemathesis/cli/summary.py | 57 | CODE | |
| LOW | src/schemathesis/cli/commands/fuzz/__init__.py | 161 | CODE | |
| LOW | src/schemathesis/cli/commands/run/__init__.py | 185 | CODE | |
| LOW | src/schemathesis/generation/case.py | 143 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/guides/auth.md | 77 | --header "X-API-Key: your-api-key" | CODE |
| HIGH | docs/guides/auth.md | 115 | export API_KEY="your-api-key" | CODE |
| HIGH | docs/guides/auth.md | 223 | {"name": "admin", "fixedHeaders": [{"name": "X-Api-Key", "value": "your-api-key"}]} | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/guides/extending-cli.md | 12 | ### Step 1: Create an option group | COMMENT |
| LOW | docs/guides/extending-cli.md | 26 | ### Step 2: Add options to the group | COMMENT |
| LOW | docs/guides/extending-cli.md | 43 | ### Step 3: Create the event handler | COMMENT |
| LOW | docs/guides/extending-cli.md | 104 | ### Step 4: Load the extension and run | COMMENT |
| LOW | docs/guides/hypothesis-strategies.md | 188 | # Step 1: always create a user | COMMENT |
| LOW | docs/guides/hypothesis-strategies.md | 193 | # Step 2: optional steps | COMMENT |
| LOW | docs/guides/hypothesis-strategies.md | 204 | # Step 3: always clean up | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/specs/openapi/test_patterns.py | 241 | (r"^abc(\d{3})+$", 6, 12, r"^abc(\d{3}){1,3}$"), | COMMENT |
| LOW | src/schemathesis/core/jsonschema/patterns.py | 1121 | if (adj_min is not None and adj_min < 0) or (adj_max is not None and adj_max < 0): | COMMENT |
| LOW | src/schemathesis/core/error_feedback/parsers/jackson.py | 21 | if TYPE_CHECKING: | COMMENT |
| LOW | src/schemathesis/specs/openapi/stateful/__init__.py | 241 | # - POST operations that create resources | COMMENT |
| LOW | …mathesis/specs/openapi/stateful/dependencies/models.py | 801 | # Set when the resource value comes from a request path parameter rather | COMMENT |
| LOW | src/schemathesis/specs/openapi/adapter/parameters.py | 101 | # Probability of using negative strategy when captured values are available. | COMMENT |
| LOW | src/schemathesis/specs/openapi/expressions/lexer.py | 121 | # Expression: `ID_{$request.body#/foo}}` | COMMENT |
| LOW | src/schemathesis/generation/meta.py | 221 | dictionary_draws: tuple[DictionaryDraw, ...] = () | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/schemathesis/core/deserialization.py | 85 | Register a deserializer for custom response media types. Converts API responses with custom content types (MessageP | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/schemathesis/generation/jsonschema/strategy.py | 185 | # Bundle scaffolding the user never wrote. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/data/petstore_v2.yaml | 3 | description: "This is a sample server Petstore server. You can find out more about Swagger at [http://swagger.io] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …mathesis/specs/openapi/stateful/dependencies/naming.py | 532 | # just add 's' (car -> cars) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/cli/test_checks.py | 1660 | def my_method(): | CODE |