Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
swagger-police
Advanced tools
Automatically validates the APIs against the published swagger specification
swagger-police is a command line tool for validating backend APIs against the published swagger specification. It can be plugged into a continuous integration system to ensure that the backend APIs confirms to the behaviour mentioned in the published swagger specification.
This library is very similar (and inspired) from abao (https://github.com/cybertk/abao) which does similar validations for a RAML spec
Please Note: The library is still in beta and is WIP !
npm install -g swagger-police
$ swagger-police
Usage: swagger-police <swagger URL/path> [options]
Options:
-h, --help output usage information
--server [server] The API endpoint
--hook-files [hookFiles] Specify pattern to match hook files
--testcase-names [testcaseNames] Print all the testcase names (does not execute the tests)
The tool supports the following test hooks to enable setup/tear-down tasks or customising
the individual tests. Hooks are simple JavaScript files which have access to a global hooks
object with methods to add the specific hooks.
BeforeAll
and AfterAll
These will be executed once before the tests start and after all the tests have been executed. Note that only one of each type can be specified, there cannot be more than one beforeAll/afterAll hooks. However, testcase specific hooks can be specified, see below.
hooks.beforeAll((testcases, done) => {
done();
});
hooks.afterAll((testcases, done) => {
done();
});
testcases - An array of testcase
objects to be executed. This is generated from the swagger specs. Any customisations made to the objects in the beforeAll
hook will be reflected in the tests.
done - The callback function
BeforeEach
and AfterEach
These will be executed before and after every test. Note that only one of each type can be specified, there cannot be more than one beforeEach/afterEach hooks. However, testcase specific hooks can be specified, see below.
hooks.beforeEach((testcases, done) => {
done();
});
hooks.afterEach((testcases, done) => {
done();
});
testcases - An array of testcase
objects to be executed. This is generated from the swagger specs. Any customisations made to the objects in the beforeAll
hook will be reflected in the tests.
done - The callback function
before
and after
testcase specific hooks can be specified which will only be executed before and after the
specific testcase. The testcases are identified using a generated name. Run the tool with the --testcase-names
option to print out all the testcase names.
The hooks can be specified using the following method
hooks.add('GET /pet/{petId} -> 200', {
before: (testcase, done) => {
done();
},
after: (testcase, done) => {
done();
}
});
** 1st Argument** - The testcase name. Please note that this is case sensitive. ** 2nd argument** - An object with before and after functions which takes in testcase (The testcase object representing the specific test) and a callback. Any modifications made to the testcase object will reflect in the test.
If more than one such hook is specified for a specific test, the test will be executed once for every hook specified. Custom test name can be added to identify each pass. See below
hooks.add('GET /pet/{petId} -> 200 # Pass 1', {
before: (testCase, done) => {
done();
},
after: (testCase, done) => {
done();
}
});
hooks.add('GET /pet/{petId} -> 200 # Pass 2', {
before: (testCase, done) => {
done();
},
after: (testCase, done) => {
done();
}
});
FAQs
Automatically validates the APIs against the published swagger specification
The npm package swagger-police receives a total of 2 weekly downloads. As such, swagger-police popularity was classified as not popular.
We found that swagger-police demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.