DataExcept 0.4.1__tar.gz → 0.4.2__tar.gz

{dataexcept-0.4.1 → dataexcept-0.4.2}/CHANGELOG.md

@@ -7,6 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.2] - 2026-08-25
+
+### Changed
+
+- `SECURITY.md` states two further boundaries rather than leaving them to be
+  discovered: state attached to an exception *after* it is constructed is not
+  swept, and a URL nested inside a value you pass is rendered redacted but the
+  object itself is not rewritten. Walking and rewriting arbitrary caller data
+  structures would be a surprising thing for an exception library to do, and
+  could not be complete anyway.
+
+### Fixed
+
+- **Sensitive query parameters are matched by token, not substring.** The
+  substring rule was wrong in both directions: it redacted `monkey`, `design`,
+  `assign`, `keyword` and `authors`, mangling ordinary debugging information,
+  while still missing `passphrase`. Parameter names are now split on
+  separators and camelCase and matched word by word, so `X-Amz-Signature`,
+  `accessToken` and `client_secret` are caught and `?monkey=bobo` is left
+  alone.
+
+### Security
+
+- **`jwt`, `bearer`, `hmac` and `sas` are recognised as secret parameter
+  names.** Checked the token set against the parameters actually used by AWS
+  SigV4, Azure SAS, Google Cloud and OAuth 2: the signature and credential
+  parameters were already covered, but those four were not. `code`, `state`,
+  `nonce` and `client_id` are deliberately still ignored — an OAuth code is a
+  secret, but the name is far more often a country code, an HTTP status or a
+  discount code, and redacting those would destroy more than it protects.
+- **Three ways a URL could still reach a message, all closed.** The redaction
+  boundary scrubbed the message and a handful of named fields, but 18 classes
+  interpolate some *other* attribute into `__str__` — a field, a column, a
+  resource — and a caller can put a URL in any of them. Every stored string is
+  now swept, so no class leaks a credential-bearing URL through its message,
+  its attributes or its `args`. A test fills every string argument of every
+  class with one and checks all three surfaces.
+- Two classes assigned their attributes *after* calling `super().__init__`, so
+  the sweep never saw them. Both now assign first, and a test fails if any
+  constructor does it again.
+- The URL pattern carried a `` anchor, so a URL directly following a word
+  character was never matched — including `feature_https://...`, the step name
+  `FeaturePreprocessingError` builds from its own argument.
+
 ## [0.4.1] - 2026-08-25
 
 ### Added
@@ -385,7 +429,8 @@ First public release.
 - Published to PyPI via OIDC trusted publishing; no long-lived API token is
   involved in a release.
 
-[Unreleased]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.4.1...HEAD
+[Unreleased]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.4.2...HEAD
+[0.4.2]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.4.1...v0.4.2
 [0.4.1]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.2.1...v0.3.0

{dataexcept-0.4.1 → dataexcept-0.4.2}/CITATION.cff

@@ -1,7 +1,7 @@
 cff-version: 1.2.0
 message: "If you use this software, please cite it using the following metadata."
 title: "DataExcept"
-version: "0.4.1"
+version: "0.4.2"
 authors:
   - family-names: "Ribeiro"
     given-names: "Diogo"

{dataexcept-0.4.1 → dataexcept-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: DataExcept
-Version: 0.4.1
+Version: 0.4.2
 Summary: A Python package providing structured, easily-extendable custom exception types.
 License-Expression: MIT
 License-File: LICENSE
@@ -225,7 +225,7 @@ BiasDetectionError
 
 # Check version
 $ dataexcept --version
-dataexcept 0.4.1
+dataexcept 0.4.2
 ```
 
 ## 🎯 Use Cases
@@ -375,7 +375,7 @@ If you use DataExcept in your research, please cite it:
   author = {Ribeiro, Diogo},
   title = {DataExcept: Structured Exception Handling for Data Science},
   url = {https://github.com/DiogoRibeiro7/DataExcept},
-  version = {0.4.1},
+  version = {0.4.2},
   year = {2026},
   publisher = {GitHub}
 }

{dataexcept-0.4.1 → dataexcept-0.4.2}/README.md

@@ -198,7 +198,7 @@ BiasDetectionError
 
 # Check version
 $ dataexcept --version
-dataexcept 0.4.1
+dataexcept 0.4.2
 ```
 
 ## 🎯 Use Cases
@@ -348,7 +348,7 @@ If you use DataExcept in your research, please cite it:
   author = {Ribeiro, Diogo},
   title = {DataExcept: Structured Exception Handling for Data Science},
   url = {https://github.com/DiogoRibeiro7/DataExcept},
-  version = {0.4.1},
+  version = {0.4.2},
   year = {2026},
   publisher = {GitHub}
 }

{dataexcept-0.4.1 → dataexcept-0.4.2}/dataexcept/base.py

@@ -138,22 +138,27 @@ class DataExceptError(Exception):
     _keep_url_path = True
 
     def __init__(self, *args: Any) -> None:
-        # One boundary for the whole hierarchy: whatever built the message --
-        # a constructor, a caller-supplied `message`, or the text of a wrapped
-        # exception quoting the original URL -- it is scrubbed here. Redacting
-        # only the structured argument leaves all three of those routes open.
+        # One boundary for the whole hierarchy. Whatever built the message -- a
+        # constructor, a caller-supplied `message`, or the text of a wrapped
+        # exception quoting the original URL -- it is scrubbed here, because
+        # redacting only the structured argument leaves all three routes open.
         keep_path = type(self)._keep_url_path
         if args and isinstance(args[0], str):
             args = (redact_urls_in_text(args[0], keep_path=keep_path),) + args[1:]
-        # Many classes also store the message on self.message and render *that*
-        # in __str__, so scrubbing args alone would leave the rendered form
-        # untouched. Subclasses set it before calling up, so it is here to fix.
-        stored = self.__dict__.get("message")
-        if isinstance(stored, str):
-            # Written straight into __dict__, symmetric with the read above:
-            # this rewrites state a subclass already stored, rather than the
-            # base declaring an attribute of its own.
-            self.__dict__["message"] = redact_urls_in_text(stored, keep_path=keep_path)
+
+        # Many classes store the message on self.message and render *that* in
+        # __str__, and 18 interpolate some other attribute -- a field, a
+        # column, a resource -- any of which a caller can fill with a URL. So
+        # every stored string is swept, not just the message.
+        #
+        # redact_urls_in_text rather than redact_if_url: a message has the URL
+        # embedded in prose, and redact_if_url only handles a value that is
+        # wholly a URL. It is a no-op on anything without "://" in it, so
+        # ordinary names and file paths are untouched.
+        for name, value in list(self.__dict__.items()):
+            if isinstance(value, str) and "://" in value:
+                self.__dict__[name] = redact_urls_in_text(value, keep_path=keep_path)
+
         super().__init__(*args)
         # Constructors that wrap another exception record it on an attribute.
         # Mirroring it into __cause__ is what makes a traceback print the

{dataexcept-0.4.1 → dataexcept-0.4.2}/dataexcept/datascience_exceptions/training.py

@@ -69,8 +69,10 @@ class ConvergenceError(ModelTrainingError):
                 f"Model '{model_type}' failed to converge after "
                 f"{iterations} iterations"
             )
-        super().__init__(model_type=model_type, epoch=None, message=message)
+        # Assigned before super(): DataExceptError.__init__ sweeps the stored
+        # strings for URLs, and anything set afterwards escapes that.
         self.iterations = iterations
+        super().__init__(model_type=model_type, epoch=None, message=message)
 
     def __str__(self) -> str:
         return f"[ConvergenceError] {self.message}"

{dataexcept-0.4.1 → dataexcept-0.4.2}/dataexcept/pipeline_exceptions.py

@@ -30,9 +30,11 @@ class FeaturePreprocessingError(PreprocessingError):
     """Raised when feature engineering fails."""
 
     def __init__(self, feature: str, reason: Optional[str] = None) -> None:
-        super().__init__(step_name=f"feature_{feature}", details=reason)
+        # Assigned before super(): DataExceptError.__init__ sweeps the stored
+        # strings for URLs, and anything set afterwards escapes that.
         self.feature = feature
         self.reason = reason
+        super().__init__(step_name=f"feature_{feature}", details=reason)
 
 
 class StorageError(PipelineError):

{dataexcept-0.4.1 → dataexcept-0.4.2}/dataexcept/redaction.py

@@ -42,33 +42,72 @@ PLACEHOLDER = "***"
 #: nothing. The structured field is redacted regardless of length.
 MIN_REMOVABLE_SECRET_LENGTH = 8
 
-#: Substrings that mark a query or fragment parameter as carrying a secret.
-#: Matched anywhere in the parameter name, case insensitively, so
-#: ``X-Amz-Signature``, ``auth_token`` and ``refresh_token`` are all covered.
-#: Over-matching here is harmless; under-matching leaks.
-SENSITIVE_PARAM_MARKERS = frozenset(
+#: Parameter-name tokens that mark a value as a secret. A name is split into
+#: tokens on separators and camelCase boundaries, and matched token by token.
+#:
+#: Substring matching was tried first and was wrong in both directions: it
+#: redacted "monkey", "design", "assign", "keyword" and "authors" -- mangling
+#: ordinary debugging information -- while still missing "passphrase". The
+#: point of keeping host, port and path is that the error stays actionable, and
+#: shredding a legitimate query parameter works against that.
+#:
+#: Deliberately absent: "code", "state", "nonce" and "client_id". An OAuth
+#: authorization code is a secret, but "code" is far more often a country
+#: code, an HTTP status or a discount code, and redacting those would destroy
+#: more debugging information than it protects. Checked against the parameter
+#: names used by AWS SigV4, Azure SAS, Google Cloud and OAuth 2.
+SENSITIVE_PARAM_TOKENS = frozenset(
     {
+        "apikey",
         "auth",
+        "authorization",
+        "bearer",
         "credential",
+        "credentials",
+        "hmac",
+        "jwt",
         "key",
+        "keys",
+        "passphrase",
         "passwd",
         "password",
         "pwd",
+        "sas",
         "secret",
+        "secrets",
         "session",
         "sig",
+        "signature",
         "token",
+        "tokens",
     }
 )
 
-#: Finds URLs inside free-form text, so a credential cannot slip through in a
-#: caller-supplied message or in the text of a wrapped exception.
-_URL_IN_TEXT = re.compile(r"\b[a-zA-Z][a-zA-Z0-9+.\-]*://[^\s'\"<>,;)\]}]+")
+#: Splits a parameter name into words: on separators, and between a lower-case
+#: or digit character and an upper-case one, so ``accessToken`` yields
+#: ``["access", "token"]``.
+_NAME_TOKENS = re.compile(r"[A-Za-z0-9]+")
+_CAMEL_BOUNDARY = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")
+
+
+def _tokens(name: str) -> list[str]:
+    words: list[str] = []
+    for chunk in _NAME_TOKENS.findall(name):
+        words.extend(part.lower() for part in _CAMEL_BOUNDARY.split(chunk) if part)
+    return words
 
 
 def _is_sensitive(name: str) -> bool:
-    lowered = name.lower()
-    return any(marker in lowered for marker in SENSITIVE_PARAM_MARKERS)
+    return any(token in SENSITIVE_PARAM_TOKENS for token in _tokens(name))
+
+
+#: Finds URLs inside free-form text, so a credential cannot slip through in a
+#: caller-supplied message or in the text of a wrapped exception.
+# No word-boundary anchor: a URL can directly follow a word character, as
+# in the step name "feature_https://..." that FeaturePreprocessingError
+# builds. The scheme character class excludes "_", so a match still starts
+# at the scheme rather than mid-word.
+_URL_IN_TEXT = re.compile(r"[a-zA-Z][a-zA-Z0-9+.\-]*://[^\s'\"<>,;)\]}]+")
 
 
 def fingerprint(value: str) -> str:

{dataexcept-0.4.1 → dataexcept-0.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "DataExcept"
-version = "0.4.1"
+version = "0.4.2"
 description = "A Python package providing structured, easily-extendable custom exception types."
 readme = "README.md"
 license = "MIT"