<commit_before>﻿using jab.Attributes;
using NSwag;
using Xunit;
using System.Linq;

namespace jab
{
    public class TestExample
    {
        [Theory, ParameterisedClassData(typeof(ApiOperations), "samples/example.json")]
        public void DeleteMethodsShouldNotTakeFormEncodedData(
            SwaggerService service,
            string path, 
            SwaggerOperationMethod method, 
            SwaggerOperation operation)
        {
            if (method == SwaggerOperationMethod.Delete)
            {
                Assert.Null(operation.ActualConsumes);
            } else
            {
                Assert.True(true);
            }
        }
    }
}<commit_msg>Add a check for api keys in query parameters.<commit_after>﻿using jab.Attributes;
using NSwag;
using Xunit;
using System.Linq;

namespace jab
{
    public partial class TestExample
    {
        const string testDefinition = "samples/example.json";

        [Theory, ParameterisedClassData(typeof(ApiOperations), testDefinition)]
        public void DeleteMethodsShouldNotTakeFormEncodedData(
            SwaggerService service,
            string path, 
            SwaggerOperationMethod method, 
            SwaggerOperation operation)
        {
            if (method == SwaggerOperationMethod.Delete)
            {
                Assert.Null(operation.ActualConsumes);
            } else
            {
                Assert.True(true);
            }
        }

        /// <summary>
        /// You should not ask for api keys in query parameters. 
        /// https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Authentication_and_session_management
        /// </summary>
        /// <param name="service"></param>
        /// <param name="path"></param>
        /// <param name="method"></param>
        /// <param name="operation"></param>
        [Theory, ParameterisedClassData(typeof(ApiOperations), testDefinition)]
        public void NoApiKeysInParameters(
            SwaggerService service,
            string path,
            SwaggerOperationMethod method,
            SwaggerOperation operation)
        {
            if (operation.ActualParameters.Count > 0)
            {
                Assert.False(
                    operation.Parameters.Count(
                        c => ((c.Name.ToLower() == "apikey") || (c.Name.ToLower() == "api_key")) 
                            && c.Kind == SwaggerParameterKind.Query) > 0);
            }
            else
            {
                Assert.True(true);
            }
        }
    }
}
{'fraction_non_alphanumeric': 0.09634290208415258, 'fraction_numerical': 0.0007864726700747149, 'mean_word_length': 1.692063492063492, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 16, 'https://': 1, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7520281', 'n_tokens_mistral': 644, 'n_tokens_neox': 628, 'n_words': 129}