Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Have you ever needed to understand a new project and started reading the tests only to find that you have no idea what the tests are doing? Good test documentation is critical during test definition and when reviewing tests written in the past or by someone else. This linter checks that the test function docstring includes a description of the test setup, execution and checks.
python -m venv venv
source ./venv/bin/activate
pip install flake8 flake8-test-docs
flake8 test_source.py
On the following code:
# test_source.py
def test_foo():
value = foo()
assert value == "bar"
This will produce warnings such as:
flake8 test_source.py
test_source.py:2:1: TDO001 Docstring not defined on test function, more information: https://github.com/jdkandersson/flake8-test-docs#fix-tdo001
This can be resolved by changing the code to:
# test_source.py
def test_foo():
"""
arrange: given foo that returns bar
act: when foo is called
assert: then bar is returned
"""
value = foo()
assert value == "bar"
The plugin adds the following configurations to flake8
:
--test-docs-patter
: The pattern the test documentation should follow,
e.g., given/when/then
. Defaults to arrange/act/assert
.--test-docs-filename-pattern
: The filename pattern for test files. Defaults
to test_.*\.py
.--test-docs-function-pattern
: The function pattern for test functions.
Defaults to test_.*
.A few rules have been defined to allow for selective suppression:
TDO001
: checks that test functions have a docstring.TDO002
: checks that test function docstrings follow the documentation
pattern.This linting rule is triggered by a test function in a test file without a docstring. For example:
# test_source.py
def test_foo():
result = foo()
assert result == "bar"
This example can be fixed by:
# test_source.py
def test_foo():
"""
arrange: given foo that returns bar
act: when foo is called
assert: then bar is returned
"""
result = foo()
assert result == "bar"
This linting rule is triggered by a test function in a test file with a docstring that doesn't follow the documentation pattern. For example:
# test_source.py
def test_foo():
"""Test foo."""
result = foo()
assert result == "bar"
This example can be fixed by:
# test_source.py
def test_foo():
"""
arrange: given foo that returns bar
act: when foo is called
assert: then bar is returned
"""
result = foo()
assert result == "bar"
The message of the linting rule should give you the specific problem with the documentation. In general, the pattern is:
arrange:
(or whatever was set using
--test-docs-patter
) followed by at least some words describing the test
setupact:
describing the test
execution and assert:
describing the checksBelow are some valid examples. Starting with a vanilla example:
# test_source.py
def test_foo():
"""
arrange: given foo that returns bar
act: when foo is called
assert: then bar is returned
"""
result = foo()
assert result == "bar"
Here is an example where the test function is in a nested scope:
# test_source.py
class TestSuite:
def test_foo():
"""
arrange: given foo that returns bar
act: when foo is called
assert: then bar is returned
"""
result = foo()
assert result == "bar"
Here is an example where each of the descriptions go over multiple lines:
# test_source.py
def test_foo():
"""
arrange: given foo
that returns bar
act: when foo
is called
assert: then bar
is returned
"""
result = foo()
assert result == "bar"
FAQs
A linter that checks test docstrings for the arrange/act/assert structure
We found that flake8-test-docs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.