Skip to content

scripting.md

Latest commit

 

History

History
134 lines (99 loc) · 4.38 KB

scripting.md

File metadata and controls

134 lines (99 loc) · 4.38 KB
Raw

Scripting reference

Each request can carry a pre-request script (runs before sending) and a post-response script (runs after receiving). Scripts are JavaScript and talk to SOAPEasy through a single object: soap.

Open the Scripts tab of a request to edit them. Type soap. for autocomplete; the Help & examples button (💡) has copy-paste snippets.

When scripts run

Pre-request runs before {{variables}} are resolved — so a variable you set there is immediately available in the request XML, endpoint, and headers.

Post-response runs after the response arrives, with read access to it. Variables you set persist (to the active environment, or to globals if none is active). In a test suite, scripts run per iteration with variables isolated per run.

The soap API

Variables

Method Description
soap.getVar(name) Read a variable ('' if missing).
soap.setVar(name, value) Create / overwrite a variable (persists).
soap.unsetVar(name) Remove a variable.
soap.hasVar(name) true if the variable exists.

Response (read-only)

Available in post-response scripts. In a pre-request script status is 0 and the body is empty.

Member Description
soap.status Response HTTP status code.
soap.responseBody Response body as text.
soap.elapsedMs Response time in ms.
soap.header(name) A response header by name ('' if absent).
soap.bodyContains(text) true if the body contains the text.
soap.xpath(expr) First XPath match against the response ('' if none).

Assertions and logging

Method Description
soap.assert(condition, message) Fail the run if condition is false.
soap.log(message) Write a line to the logs panel.

console.log / console.info / console.warn / console.error also work and route to the logs.

Value generators

Method Description
soap.uuid() Random UUID v4.
soap.now() Epoch milliseconds.
soap.isoNow() ISO-8601 timestamp (UTC).
soap.randomInt(min, max) Random integer in [min, max].

Examples

Generate a unique ID (pre-request)

soap.setVar('ticketId', 'TT-' + soap.uuid());
soap.setVar('timestamp', soap.isoNow());

Then use {{ticketId}} and {{timestamp}} in the request XML.

Extract a value from the response (post-response)

// local-name() ignores namespace prefixes — robust for SOAP responses
var id = soap.xpath("//*[local-name()='ticketId']");
soap.setVar('createdTicketId', id);
console.log('created ticket ' + id);

Assertions (post-response)

soap.assert(soap.status === 200, 'expected HTTP 200');
soap.assert(soap.bodyContains('<success>'), 'missing <success>');
soap.assert(soap.elapsedMs < 5000, 'response too slow');

Chain requests

Save a value from one response and reuse it in the next request:

// post-response of request A:
soap.setVar('createdTicketId', soap.xpath("//*[local-name()='id']"));
// then in request B's XML, use  {{createdTicketId}}

Random / dynamic values (pre-request)

soap.setVar('amount', soap.randomInt(100, 999));
soap.setVar('corrId', soap.uuid());
soap.setVar('epoch', '' + soap.now());

Security (the sandbox)

Scripts are treated as untrusted — a script could arrive in a collection imported from someone else. They run in a hardened sandbox:

  • No system access. Scripts cannot touch the filesystem, the network, run processes, or use reflection. The only bridge to the host is the soap object. Attempts to reach java.*, Packages, importClass, getClass, new java.io.File(...), etc. are blocked.
  • No runaway execution. Infinite loops (while(true){}) are aborted by an instruction limit; infinite recursion is stopped by a stack-depth cap; a wall-clock deadline is a final backstop.
  • XPath hardening. The XML parser used by soap.xpath rejects DTDs and external entities (no XXE).

If a script errors, the run reports it (in a suite it counts as a failure); the app is never affected.

Limitations

  • Language is JavaScript (ES6 via Mozilla Rhino). No fetch, no timers, no require/modules — scripts are short synchronous snippets.
  • The editor highlights JS and the soap.* API, but the parser is regex-based (great for snippets, not a full tokenizer).