DataExcept 0.4.1__tar.gz → 0.4.3__tar.gz

{dataexcept-0.4.1 → dataexcept-0.4.3}/CHANGELOG.md

@@ -7,6 +7,95 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- The release workflow's `verify-wheel` job installed a hand-written list of
+  test requirements, which went stale the moment `hypothesis` was added — the
+  suite could not even be collected against the built wheel. It now installs
+  the dev group from the lock, so the list cannot drift again. The job did its
+  job: it failed, and publishing was skipped.
+- `test_no_module_imports_tomllib_without_a_fallback` walked the whole tree, so
+  it picked up any virtualenv sitting in it. It now scans the project's own
+  source directories by name; site-packages is not ours to police.
+
+## [0.4.3] - 2026-08-25
+
+### Added
+
+- Property-based tests over the logging helpers and the CLI: generated context
+  values, including hostile ones, must never make `log_exception` raise; the
+  normalised context must be strict-JSON encodable; `log_and_raise` must
+  re-raise the *same* exception with its traceback intact; and the CLI must
+  raise nothing but `SystemExit` for any argument list.
+- **Property-based tests over the exception hierarchy**, using Hypothesis.
+  Generated text is fed to every class and four properties are asserted for
+  each: construction raises nothing but `TypeError`, a message built from real
+  input is non-empty, the exception survives a pickle round trip with its type,
+  message and cause intact, and a credential-bearing URL is never rendered.
+  Every constructor defect the reviews found — `MergeKeyError("id")` becoming
+  `['i', 'd']`, `is_number(True)`, and the one below — was in argument
+  handling and was found by inspection rather than by a test.
+
+### Fixed
+
+- **`log_exception` could raise, replacing the caller's error with its own.**
+  A context value whose `__repr__` raises propagated straight out of the
+  logging helper — so a helper called while handling a failure made the failure
+  worse. Nothing in context normalisation can raise now; a value that cannot be
+  described at all becomes `<unrepresentable TypeName>`.
+- **`NaN` and `Infinity` in a log context produced invalid JSON.**
+  `json.dumps` emits them bare, which a strict consumer downstream rejects.
+  They are stringified instead.
+- `ApiError`, `DatabaseConnectionError` and `WebhookError` raised
+  `AttributeError: 'object' object has no attribute 'decode'` when given a
+  non-string, because the redaction helpers passed whatever they were given to
+  `urlsplit`. That masked the caller's actual mistake with a message about
+  `.decode`. The helpers now return a non-string untouched.
+
+## [0.4.2] - 2026-08-25
+
+### Changed
+
+- `SECURITY.md` states two further boundaries rather than leaving them to be
+  discovered: state attached to an exception *after* it is constructed is not
+  swept, and a URL nested inside a value you pass is rendered redacted but the
+  object itself is not rewritten. Walking and rewriting arbitrary caller data
+  structures would be a surprising thing for an exception library to do, and
+  could not be complete anyway.
+
+### Fixed
+
+- **Sensitive query parameters are matched by token, not substring.** The
+  substring rule was wrong in both directions: it redacted `monkey`, `design`,
+  `assign`, `keyword` and `authors`, mangling ordinary debugging information,
+  while still missing `passphrase`. Parameter names are now split on
+  separators and camelCase and matched word by word, so `X-Amz-Signature`,
+  `accessToken` and `client_secret` are caught and `?monkey=bobo` is left
+  alone.
+
+### Security
+
+- **`jwt`, `bearer`, `hmac` and `sas` are recognised as secret parameter
+  names.** Checked the token set against the parameters actually used by AWS
+  SigV4, Azure SAS, Google Cloud and OAuth 2: the signature and credential
+  parameters were already covered, but those four were not. `code`, `state`,
+  `nonce` and `client_id` are deliberately still ignored — an OAuth code is a
+  secret, but the name is far more often a country code, an HTTP status or a
+  discount code, and redacting those would destroy more than it protects.
+- **Three ways a URL could still reach a message, all closed.** The redaction
+  boundary scrubbed the message and a handful of named fields, but 18 classes
+  interpolate some *other* attribute into `__str__` — a field, a column, a
+  resource — and a caller can put a URL in any of them. Every stored string is
+  now swept, so no class leaks a credential-bearing URL through its message,
+  its attributes or its `args`. A test fills every string argument of every
+  class with one and checks all three surfaces.
+- Two classes assigned their attributes *after* calling `super().__init__`, so
+  the sweep never saw them. Both now assign first, and a test fails if any
+  constructor does it again.
+- The URL pattern carried a `` anchor, so a URL directly following a word
+  character was never matched — including `feature_https://...`, the step name
+  `FeaturePreprocessingError` builds from its own argument.
+
 ## [0.4.1] - 2026-08-25
 
 ### Added
@@ -385,7 +474,9 @@ First public release.
 - Published to PyPI via OIDC trusted publishing; no long-lived API token is
   involved in a release.
 
-[Unreleased]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.4.1...HEAD
+[Unreleased]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.4.3...HEAD
+[0.4.3]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.4.2...v0.4.3
+[0.4.2]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.4.1...v0.4.2
 [0.4.1]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/DiogoRibeiro7/DataExcept/compare/v0.2.1...v0.3.0

{dataexcept-0.4.1 → dataexcept-0.4.3}/CITATION.cff

@@ -1,7 +1,7 @@
 cff-version: 1.2.0
 message: "If you use this software, please cite it using the following metadata."
 title: "DataExcept"
-version: "0.4.1"
+version: "0.4.3"
 authors:
   - family-names: "Ribeiro"
     given-names: "Diogo"

{dataexcept-0.4.1 → dataexcept-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: DataExcept
-Version: 0.4.1
+Version: 0.4.3
 Summary: A Python package providing structured, easily-extendable custom exception types.
 License-Expression: MIT
 License-File: LICENSE
@@ -225,7 +225,7 @@ BiasDetectionError
 
 # Check version
 $ dataexcept --version
-dataexcept 0.4.1
+dataexcept 0.4.3
 ```
 
 ## 🎯 Use Cases
@@ -375,7 +375,7 @@ If you use DataExcept in your research, please cite it:
   author = {Ribeiro, Diogo},
   title = {DataExcept: Structured Exception Handling for Data Science},
   url = {https://github.com/DiogoRibeiro7/DataExcept},
-  version = {0.4.1},
+  version = {0.4.3},
   year = {2026},
   publisher = {GitHub}
 }

{dataexcept-0.4.1 → dataexcept-0.4.3}/README.md

@@ -198,7 +198,7 @@ BiasDetectionError
 
 # Check version
 $ dataexcept --version
-dataexcept 0.4.1
+dataexcept 0.4.3
 ```
 
 ## 🎯 Use Cases
@@ -348,7 +348,7 @@ If you use DataExcept in your research, please cite it:
   author = {Ribeiro, Diogo},
   title = {DataExcept: Structured Exception Handling for Data Science},
   url = {https://github.com/DiogoRibeiro7/DataExcept},
-  version = {0.4.1},
+  version = {0.4.3},
   year = {2026},
   publisher = {GitHub}
 }

{dataexcept-0.4.1 → dataexcept-0.4.3}/dataexcept/base.py

@@ -138,22 +138,27 @@ class DataExceptError(Exception):
     _keep_url_path = True
 
     def __init__(self, *args: Any) -> None:
-        # One boundary for the whole hierarchy: whatever built the message --
-        # a constructor, a caller-supplied `message`, or the text of a wrapped
-        # exception quoting the original URL -- it is scrubbed here. Redacting
-        # only the structured argument leaves all three of those routes open.
+        # One boundary for the whole hierarchy. Whatever built the message -- a
+        # constructor, a caller-supplied `message`, or the text of a wrapped
+        # exception quoting the original URL -- it is scrubbed here, because
+        # redacting only the structured argument leaves all three routes open.
         keep_path = type(self)._keep_url_path
         if args and isinstance(args[0], str):
             args = (redact_urls_in_text(args[0], keep_path=keep_path),) + args[1:]
-        # Many classes also store the message on self.message and render *that*
-        # in __str__, so scrubbing args alone would leave the rendered form
-        # untouched. Subclasses set it before calling up, so it is here to fix.
-        stored = self.__dict__.get("message")
-        if isinstance(stored, str):
-            # Written straight into __dict__, symmetric with the read above:
-            # this rewrites state a subclass already stored, rather than the
-            # base declaring an attribute of its own.
-            self.__dict__["message"] = redact_urls_in_text(stored, keep_path=keep_path)
+
+        # Many classes store the message on self.message and render *that* in
+        # __str__, and 18 interpolate some other attribute -- a field, a
+        # column, a resource -- any of which a caller can fill with a URL. So
+        # every stored string is swept, not just the message.
+        #
+        # redact_urls_in_text rather than redact_if_url: a message has the URL
+        # embedded in prose, and redact_if_url only handles a value that is
+        # wholly a URL. It is a no-op on anything without "://" in it, so
+        # ordinary names and file paths are untouched.
+        for name, value in list(self.__dict__.items()):
+            if isinstance(value, str) and "://" in value:
+                self.__dict__[name] = redact_urls_in_text(value, keep_path=keep_path)
+
         super().__init__(*args)
         # Constructors that wrap another exception record it on an attribute.
         # Mirroring it into __cause__ is what makes a traceback print the

{dataexcept-0.4.1 → dataexcept-0.4.3}/dataexcept/datascience_exceptions/training.py

@@ -69,8 +69,10 @@ class ConvergenceError(ModelTrainingError):
                 f"Model '{model_type}' failed to converge after "
                 f"{iterations} iterations"
             )
-        super().__init__(model_type=model_type, epoch=None, message=message)
+        # Assigned before super(): DataExceptError.__init__ sweeps the stored
+        # strings for URLs, and anything set afterwards escapes that.
         self.iterations = iterations
+        super().__init__(model_type=model_type, epoch=None, message=message)
 
     def __str__(self) -> str:
         return f"[ConvergenceError] {self.message}"

{dataexcept-0.4.1 → dataexcept-0.4.3}/dataexcept/logging_helpers.py

@@ -12,6 +12,9 @@ from .redaction import redact_urls_in_text
 
 Context = Mapping[str, Any]
 
+#: Sentinel: the value could not be coerced into anything JSON will take.
+_UNCOERCIBLE = object()
+
 __all__ = [
     "Context",
     "log_and_raise",
@@ -20,15 +23,61 @@ __all__ = [
 ]
 
 
-def _normalize_context_value(value: Any) -> Any:
+def _is_json_safe(value: Any) -> bool:
+    """True if a strict JSON encoder will accept *value* as it stands.
+
+    ``allow_nan=False`` because ``json.dumps`` otherwise emits bare ``NaN`` and
+    ``Infinity``, which are not valid JSON and will be rejected downstream.
+    """
     try:
-        json.dumps(value)
-        return value
-    except TypeError:
+        json.dumps(value, allow_nan=False)
+    except (TypeError, ValueError):
+        return False
+    return True
+
+
+def _coerced(value: Any) -> Any:
+    """Round-trip *value* through JSON, stringifying whatever will not encode.
+
+    Returns ``_UNCOERCIBLE`` rather than raising: this runs while the caller is
+    already handling a failure.
+    """
+    try:
+        return json.loads(json.dumps(value, default=str, allow_nan=False))
+    except Exception:
+        return _UNCOERCIBLE
+
+
+def _described(value: Any) -> str:
+    """Describe *value* without letting it raise.
+
+    An object may define a ``__repr__`` that raises. Naming the type is the
+    most that can be said without invoking anything the object controls.
+    """
+    try:
+        return repr(value)
+    except Exception:
         try:
-            return json.loads(json.dumps(value, default=str))
-        except Exception:  # pragma: no cover - extremely defensive
-            return repr(value)
+            return f"<unrepresentable {type(value).__name__}>"
+        except Exception:  # pragma: no cover - a type with a hostile __name__
+            return "<unrepresentable>"
+
+
+def _normalize_context_value(value: Any) -> Any:
+    """Return *value* in a form a strict JSON log encoder will accept.
+
+    Nothing here may raise. This runs while the caller is already handling a
+    failure, and an exception escaping would replace their error with one about
+    logging it -- so even a hostile ``__repr__`` has to be survivable.
+    """
+    if _is_json_safe(value):
+        return value
+
+    coerced = _coerced(value)
+    if coerced is not _UNCOERCIBLE:
+        return coerced
+
+    return _described(value)
 
 
 def _build_extra(context: Context | None) -> dict[str, Any] | None:

{dataexcept-0.4.1 → dataexcept-0.4.3}/dataexcept/pipeline_exceptions.py

@@ -30,9 +30,11 @@ class FeaturePreprocessingError(PreprocessingError):
     """Raised when feature engineering fails."""
 
     def __init__(self, feature: str, reason: Optional[str] = None) -> None:
-        super().__init__(step_name=f"feature_{feature}", details=reason)
+        # Assigned before super(): DataExceptError.__init__ sweeps the stored
+        # strings for URLs, and anything set afterwards escapes that.
         self.feature = feature
         self.reason = reason
+        super().__init__(step_name=f"feature_{feature}", details=reason)
 
 
 class StorageError(PipelineError):

{dataexcept-0.4.1 → dataexcept-0.4.3}/dataexcept/redaction.py

@@ -42,33 +42,72 @@ PLACEHOLDER = "***"
 #: nothing. The structured field is redacted regardless of length.
 MIN_REMOVABLE_SECRET_LENGTH = 8
 
-#: Substrings that mark a query or fragment parameter as carrying a secret.
-#: Matched anywhere in the parameter name, case insensitively, so
-#: ``X-Amz-Signature``, ``auth_token`` and ``refresh_token`` are all covered.
-#: Over-matching here is harmless; under-matching leaks.
-SENSITIVE_PARAM_MARKERS = frozenset(
+#: Parameter-name tokens that mark a value as a secret. A name is split into
+#: tokens on separators and camelCase boundaries, and matched token by token.
+#:
+#: Substring matching was tried first and was wrong in both directions: it
+#: redacted "monkey", "design", "assign", "keyword" and "authors" -- mangling
+#: ordinary debugging information -- while still missing "passphrase". The
+#: point of keeping host, port and path is that the error stays actionable, and
+#: shredding a legitimate query parameter works against that.
+#:
+#: Deliberately absent: "code", "state", "nonce" and "client_id". An OAuth
+#: authorization code is a secret, but "code" is far more often a country
+#: code, an HTTP status or a discount code, and redacting those would destroy
+#: more debugging information than it protects. Checked against the parameter
+#: names used by AWS SigV4, Azure SAS, Google Cloud and OAuth 2.
+SENSITIVE_PARAM_TOKENS = frozenset(
     {
+        "apikey",
         "auth",
+        "authorization",
+        "bearer",
         "credential",
+        "credentials",
+        "hmac",
+        "jwt",
         "key",
+        "keys",
+        "passphrase",
         "passwd",
         "password",
         "pwd",
+        "sas",
         "secret",
+        "secrets",
         "session",
         "sig",
+        "signature",
         "token",
+        "tokens",
     }
 )
 
-#: Finds URLs inside free-form text, so a credential cannot slip through in a
-#: caller-supplied message or in the text of a wrapped exception.
-_URL_IN_TEXT = re.compile(r"\b[a-zA-Z][a-zA-Z0-9+.\-]*://[^\s'\"<>,;)\]}]+")
+#: Splits a parameter name into words: on separators, and between a lower-case
+#: or digit character and an upper-case one, so ``accessToken`` yields
+#: ``["access", "token"]``.
+_NAME_TOKENS = re.compile(r"[A-Za-z0-9]+")
+_CAMEL_BOUNDARY = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")
+
+
+def _tokens(name: str) -> list[str]:
+    words: list[str] = []
+    for chunk in _NAME_TOKENS.findall(name):
+        words.extend(part.lower() for part in _CAMEL_BOUNDARY.split(chunk) if part)
+    return words
 
 
 def _is_sensitive(name: str) -> bool:
-    lowered = name.lower()
-    return any(marker in lowered for marker in SENSITIVE_PARAM_MARKERS)
+    return any(token in SENSITIVE_PARAM_TOKENS for token in _tokens(name))
+
+
+#: Finds URLs inside free-form text, so a credential cannot slip through in a
+#: caller-supplied message or in the text of a wrapped exception.
+# No word-boundary anchor: a URL can directly follow a word character, as
+# in the step name "feature_https://..." that FeaturePreprocessingError
+# builds. The scheme character class excludes "_", so a match still starts
+# at the scheme rather than mid-word.
+_URL_IN_TEXT = re.compile(r"[a-zA-Z][a-zA-Z0-9+.\-]*://[^\s'\"<>,;)\]}]+")
 
 
 def fingerprint(value: str) -> str:
@@ -131,7 +170,10 @@ def redact_url(url: Optional[str], *, keep_path: bool = True) -> Optional[str]:
     incoming webhook URL is the common case -- Slack, Discord and others put
     the secret in the path, so preserving it would defeat the point.
     """
-    if not url:
+    if not url or not isinstance(url, str):
+        # Anything that is not a string is handed back untouched. urlsplit
+        # would raise AttributeError from inside urllib, masking whatever the
+        # caller's real mistake was with a message about `.decode`.
         return url
 
     try:

{dataexcept-0.4.1 → dataexcept-0.4.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "DataExcept"
-version = "0.4.1"
+version = "0.4.3"
 description = "A Python package providing structured, easily-extendable custom exception types."
 readme = "README.md"
 license = "MIT"
@@ -43,6 +43,7 @@ include = [
 black = "*"
 coverage = "*"
 flake8 = "*"
+hypothesis = "*"
 isort = "*"
 mypy = "*"
 pre-commit = "*"