Skip to content

feat: security regression test example (OWASP API Top 10); fix strict schema mode #763

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Gdewilde wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: security regression test example (OWASP API Top 10); fix strict schema mode #763

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
## [Unreleased]

- feat: Security regression test example mapped to the OWASP API Top 10 (`examples/testsuite-security-tests`)
- fix: Strict schema validation (`additionalProperties: false`) no longer closes free-form objects, maps and `allOf` members, which made valid responses fail

## v1.35.2 - (2026-10-14)

- fix: ensure compiled output (#748)
Expand Down
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ With Portman, you can:
- [x] Inject Postman with Pre-request & Tests scripts on a collection or operation level - [learn more](./examples/testsuite-pre-request-scripts/readme.md)
- [x] Modify Postman requests - learn more [here](./examples/testsuite-overwrites/readme.md) and [here](./examples/testsuite-assign-overwrite/readme.md)
- [x] Fuzz Postman requests - [learn more](./examples/testsuite-fuzzing-tests/readme.md)
- [x] Security regression tests mapped to the OWASP API Top 10 - [learn more](./examples/testsuite-security-tests/readme.md)
- [x] Upload the Postman collection to your Postman app - [learn more](#configure-automatic-upload-to-postman-app)
- [x] Test the Postman collection with Newman - [learn more](#run-newman-with-newman-options)
- [x] Split the configuration into multiple files using $ref
Expand Down Expand Up @@ -391,7 +392,7 @@ The contract tests are grouped in an array of `contractTests`.
- **contentType (Boolean)** : Adds the test if the response header is matching the expected content-type defined in the OpenAPI spec.
- **jsonBody (Boolean)** : Adds the test if the response body is matching the expected content-type defined in the OpenAPI spec.
- **schemaValidation (Boolean)** : Adds the test if the response body is matching the JSON schema defined in the OpenAPI spec. The JSON schema is inserted inline in the Postman test.
- **additionalProperties (Boolean)** : Extend the expected JSON schema used for the `schemaValidation` by setting all the `additionalProperties`.
- **additionalProperties (Boolean)** : Extend the expected JSON schema used for the `schemaValidation` by setting all the `additionalProperties`. With `false`, every object schema that declares `properties` is closed, so undeclared response fields fail the check. Free-form objects, maps (`additionalProperties` set to a schema) and `allOf` members stay open.
- **headersPresent (Boolean)** : Adds the test to verify if the Postman response header has the required header names present, like defined in the OpenAPI spec.

For more details, review the [contract-tests example](https://github.com/apideck-libraries/portman/tree/main/examples/testsuite-contract-tests) and the [testsuite-contract-content-types example](https://github.com/apideck-libraries/portman/tree/main/examples/testsuite-contract-content-types) for some more details about targeting request body & response content-types.
Expand Down
Loading
Loading