
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
pytest-play plugin driving the famous Python requests library for making HTTP calls
.. image:: https://img.shields.io/pypi/v/play_requests.svg :target: https://pypi.python.org/pypi/play_requests
.. image:: https://travis-ci.org/davidemoro/play_requests.svg?branch=develop :target: https://travis-ci.org/davidemoro/play_requests
.. image:: https://readthedocs.org/projects/play-requests/badge/?version=latest :target: https://play-requests.readthedocs.io/en/latest/?badge=latest :alt: Documentation Status
.. image:: https://codecov.io/gh/davidemoro/play_requests/branch/develop/graph/badge.svg :target: https://codecov.io/gh/davidemoro/play_requests
pytest-play plugin driving the famous Python requests_ library for making HTTP
calls.
More info and examples on:
pytest-play
in action with a working example if you want to start hackingThis pytest-play_ command provider let you drive a Python requests_ HTTP library using a YAML configuration file containing a set of pytest-play_ commands.
you can see a pytest-play_ script powered by a command provided by the play_requests_ plugin:
::
- provider: play_requests
type: GET
assertion: "'pytest-play' in response.json()"
url: https://www.google.it/complete/search
parameters:
headers:
Host: www.google.it
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko/20100101
Firefox/57.0
Accept: "*/*"
Accept-Language: en-US,en;q=0.5
Referer: https://www.google.it/
Connection: keep-alive
params:
- - client
- psy-ab
- - hl
- it
- - gs_rn
- '64'
- - gs_ri
- psy-ab
- - gs_mss
- pytest-
- - cp
- '11'
- - gs_id
- '172'
- - q
- pytest-play
- - xhr
- t
timeout: 2.5
The above example:
play_requests_ supports all the HTTP verbs supported by the requests_ library:
You'll find other play_requests_ command examples in the following sections.
Manages cookies and prepare them for you so you don't have to create
cookie headers by yourself using the auth=('username', 'password')
::
- provider: play_requests
type: GET
url: http://something/authenticated
parameters:
auth:
- username
- password
Post a csv file::
- provider: play_requests
type: POST
url: http://something/1
parameters:
files:
filecsv:
- report.csv
- some,data
Post a csv file with custom headers::
- provider: play_requests
type: POST
url: http://something/1
parameters:
files:
filecsv:
- report.csv
- some,data
- application/csv
- Expires: '0'
Post a file providing the path::
- provider: play_requests
type: POST
url: http://something/1
parameters:
files:
filecsv:
- file.csv
- path:$base_path/file.csv
assuming that you have a $base_path
variable.
You can save a response elaboration to a pytest-play_ variable and reuse in the following commands::
- provider: play_requests
type: POST
url: http://something/1
variable: myvar
variable_expression: response.json()
assertion: variables['myvar']['status'] == 'ok'
parameters:
json:
foo: bar
timeout: 2.5
It the endpoint returns a non JSON response, use response.text
instead.
If all your requests have a common payload it might be annoying but thanks to play_requests_ you can avoid repetitions.
You can set variables in many ways programatically using the pytest-play_
execute command or execute commands. You can also update variables using
the play_python_ exec
command::
- provider: python
type: store_variable
name: bearer
expression: "'BEARER'"
- provider: python
type: store_variable
name: play_requests
expression: "{'parameters': {'headers': {'Authorization': '$bearer'}}}"
- provider: play_requests
type: GET
url: "$base_url"
and all the following HTTP calls will be performed with the authorization bearer provided in the default payload.
Merging rules:
Authorization
+ Host
)Authorization
header provided by the command will win and it will override just for the current
call the default conflicting header value::
- provider: play_requests
type: POST
url: http://something/1
variable: myvar
variable_expression: response.json()
assertion: response.status_code == 200
parameters:
json:
foo: bar
of if you want you can use the expression response.raise_for_status()
instead of
checking the exact match of status code.
The raise_for_status
call will raise an HTTPError
if the HTTP
request
returned an unsuccessful status code.
If you want to send some POST data or send a JSON payload without automatic JSON encoding::
- provider: play_requests
type: POST
url: http://something/1
parameters:
data: '{"foo" : "bar" }'
By default requests_ will perform location redirection for all verbs except HEAD:
You can disable or enable redirects playing with the allow_redirects
option::
- provider: play_requests
type: POST
url: http://something/1
variable: myvar
variable_expression: response.json()
assertion: response.status_code == 200
parameters:
allow_redirects: false
json:
foo: bar
pytest-play
tweets happens here:
@davidemoro
_This package was created with Cookiecutter_ and the cookiecutter-play-plugin_ (based on audreyr/cookiecutter-pypackage
_ project template).
.. _Cookiecutter: https://github.com/audreyr/cookiecutter
.. _audreyr/cookiecutter-pypackage
: https://github.com/audreyr/cookiecutter-pypackage
.. _cookiecutter-play-plugin
: https://github.com/davidemoro/cookiecutter-play-plugin
.. _pytest-play: https://github.com/davidemoro/pytest-play
.. _cookiecutter-qa: https://github.com/davidemoro/cookiecutter-qa
.. _requests: http://docs.python-requests.org/en/master/user/quickstart
.. _play_requests: https://play_requests.readthedocs.io/en/latest
.. _play_python: https://play_python.readthedocs.io/en/latest
.. _@davidemoro
: https://twitter.com/davidemoro
auth=('username', 'password')
remove condition option (already implemented by pytest-play's skip_condition
)
documentation improvements
Refactor internal methods
Remove merge commands with default payload (already
implemented in pytest-play
>= 1.1.0)
FAQs
pytest-play plugin driving the famous Python requests library for making HTTP calls
We found that play-requests demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.