From 118c23e7043c8cfc4e084b0ffca8eabb841163ec Mon Sep 17 00:00:00 2001 From: Correl Date: Sat, 3 Apr 2021 01:06:02 -0400 Subject: [PATCH] Do not validate test requests using absolute URLs The response validation in the fetch method of AsyncOpenAPITestCase is intended for requests made to the application under test only, and must not be executed on requests made to other services using absolute URLs. --- tests/test_testing.py | 3 +++ tornado_openapi3/testing.py | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/tests/test_testing.py b/tests/test_testing.py index 445ec70..cf0c6ce 100644 --- a/tests/test_testing.py +++ b/tests/test_testing.py @@ -106,6 +106,9 @@ class IncorrectResponseTests(BaseTestCase): self.fetch("/resource") self.assertEqual("400", context.exception.http_status) + def test_errors_not_raised_when_using_absolute_url(self) -> None: + self.fetch(self.get_url("/resource")) + class RaiseErrorTests(BaseTestCase): spec_dict = spec( diff --git a/tornado_openapi3/testing.py b/tornado_openapi3/testing.py index 54e9e3b..6609f3d 100644 --- a/tornado_openapi3/testing.py +++ b/tornado_openapi3/testing.py @@ -87,7 +87,13 @@ class AsyncOpenAPITestCase(tornado.testing.AsyncHTTPTestCase): fails, an :class:`openapi_core.exceptions.OpenAPIError` will be raised describing the failure. + If the path begins with http:// or https://, it will be treated as a + full URL and will be fetched as-is, and no validation will occur. + """ + if path.lower().startswith(("http://", "https://")): + return super().fetch(path, raise_error=raise_error, **kwargs) + response = super().fetch(path, raise_error=False, **kwargs) result = self.validator.validate(response) result.raise_for_errors()