crackerjack 0.34.0__py3-none-any.whl → 0.34.2__py3-none-any.whl

crackerjack/services/secure_subprocess.py

@@ -318,20 +318,47 @@ class SecureSubprocessExecutor:
                 )
                 continue
 
-            if self._has_dangerous_patterns(arg, i, issues):
+            if self._has_dangerous_patterns(arg, i, issues, command):
                 continue
 
             validated_command.append(arg)
 
         return validated_command, issues
 
-    def _has_dangerous_patterns(self, arg: str, index: int, issues: list[str]) -> bool:
+    def _has_dangerous_patterns(
+        self, arg: str, index: int, issues: list[str], command: list[str]
+    ) -> bool:
         # First check if this is an allowed git pattern
         for git_pattern in self.allowed_git_patterns:
             if re.match(git_pattern, arg):
                 return False  # It's an allowed git pattern, don't flag as dangerous
 
-        # Check for dangerous patterns
+        # Special handling for git commit messages
+        if self._is_git_commit_message(index, command):
+            # For git commit messages, only check for truly dangerous patterns
+            # Parentheses are common in commit messages and should be allowed
+            safe_commit_patterns = [
+                r"[;&|`$]",  # Still dangerous in commit messages
+                r"\.\./",  # Path traversal
+                r"\$\{.*\}",  # Variable expansion
+                r"`.*`",  # Command substitution
+                r"\$\(.*\)",  # Command substitution (but allow simple parentheses)
+                r">\s*/",  # Redirection to paths
+                r"<\s*/",  # Redirection from paths
+            ]
+
+            for pattern in safe_commit_patterns:
+                if re.search(pattern, arg):
+                    # Allow simple parentheses that don't look like command substitution
+                    if pattern == r"\$\(.*\)" and not re.search(r"\$\(", arg):
+                        continue
+                    issues.append(
+                        f"Dangerous pattern '{pattern}' in argument {index}: {arg[:50]}"
+                    )
+                    return True
+            return False
+
+        # Check for dangerous patterns in other contexts
         for pattern in self.dangerous_patterns:
             if re.search(pattern, arg):
                 issues.append(
@@ -340,6 +367,18 @@ class SecureSubprocessExecutor:
                 return True
         return False
 
+    def _is_git_commit_message(self, index: int, command: list[str]) -> bool:
+        """Check if the current argument is likely a git commit message."""
+        # Check if we have a git commit command structure: git commit -m <message>
+        if (
+            len(command) >= 3
+            and command[0] == "git"
+            and command[1] == "commit"
+            and command[2] == "-m"
+        ):
+            return index == 3
+        return False
+
     def _validate_executable_permissions(
         self, validated_command: list[str], issues: list[str]
     ) -> None:

crackerjack/services/security_logger.py

@@ -122,20 +122,26 @@ class SecurityLogger:
         self._setup_security_logger()
 
     def _setup_security_logger(self) -> None:
-        self.logger.setLevel(logging.DEBUG)
+        debug_enabled = os.environ.get("CRACKERJACK_DEBUG", "0") == "1"
+
+        # Set appropriate logger level based on debug mode
+        if debug_enabled:
+            self.logger.setLevel(logging.DEBUG)
+        else:
+            # Suppress all security logs during normal operation
+            self.logger.setLevel(logging.CRITICAL + 10)
 
         if not self.logger.handlers:
             console_handler = logging.StreamHandler()
 
-            debug_enabled = os.environ.get("CRACKERJACK_DEBUG", "0") == "1"
             if debug_enabled:
-                console_handler.setLevel(logging.WARNING)
+                console_handler.setLevel(logging.DEBUG)
             else:
                 # Suppress all security logs during normal operation
                 console_handler.setLevel(logging.CRITICAL + 10)
 
             formatter = logging.Formatter(
-                "%(asctime)s - SECURITY - %(levelname)s-%(message)s"
+                "%(asctime)s - SECURITY - %(levelname)s - %(message)s"
             )
             console_handler.setFormatter(formatter)
             self.logger.addHandler(console_handler)

{crackerjack-0.34.0.dist-info → crackerjack-0.34.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crackerjack
-Version: 0.34.0
+Version: 0.34.2
 Summary: Crackerjack Python project management tool
 Project-URL: documentation, https://github.com/lesleslie/crackerjack
 Project-URL: homepage, https://github.com/lesleslie/crackerjack

{crackerjack-0.34.0.dist-info → crackerjack-0.34.2.dist-info}/RECORD

@@ -199,9 +199,9 @@ crackerjack/services/regex_patterns.py,sha256=iis9gSzXZtnX14lODGfSUsf7bcCRTw7rdS
 crackerjack/services/regex_utils.py,sha256=e7AD59_L-T5-oOxzqsGgrLd94uxRE9aKnwasZkohwI8,14966
 crackerjack/services/secure_path_utils.py,sha256=aHsLwxDch42DidPYtTL_ko40g2rhbXDLnRhcx2LlGk8,16688
 crackerjack/services/secure_status_formatter.py,sha256=yhwNtzvvQVcuHsNOTNZMzlqIMQT9zx-lzAtq9LuSDuk,14121
-crackerjack/services/secure_subprocess.py,sha256=iGXdIUjYZ_ocxwo8OJSmOFJvdmOFXSvluNNgJvU3hFQ,18114
+crackerjack/services/secure_subprocess.py,sha256=upuiBL0sYIElC8DWQ622-A6572zBaSBoMPVnNM8AeaQ,19838
 crackerjack/services/security.py,sha256=plgIz-B8oYN_mpF4NYrqHnT7TRcsp4jr0-YlV9WgD5o,7298
-crackerjack/services/security_logger.py,sha256=_hQUQZekiafpIKyULgVxrQHrwPpTKv89jNf-XWqaAhg,16780
+crackerjack/services/security_logger.py,sha256=AAjd9VKVmCo158UifyEKd79VgtWKeuaIVyXYL8qvqT8,17001
 crackerjack/services/server_manager.py,sha256=IQ0oUFEEMZTxI8csecIJzkCSMESE5KIkYqPxa56tvUw,11399
 crackerjack/services/smart_scheduling.py,sha256=VSaL7DpKR6aa0sC_TUrYP9ZgC9CB7tE3TTNzEqB-GpE,4352
 crackerjack/services/status_authentication.py,sha256=2OJ1MoWlBuvUUXOX02N_zdWKzQfXz4jhEZpsmIJfQ00,16453
@@ -222,8 +222,8 @@ crackerjack/slash_commands/status.md,sha256=U3qqppVLtIIm2lEiMYaKagaHYLI9UplL7OH1
 crackerjack/tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 crackerjack/tools/validate_input_validator_patterns.py,sha256=NN7smYlXWrHLQXTb-81gRam2vjW-cJav92f1klPA0qA,8234
 crackerjack/tools/validate_regex_patterns.py,sha256=9ejFb7Tw1js_oydzuEeeeXvrU5ipHUEX9ATBfkLCCE8,5811
-crackerjack-0.34.0.dist-info/METADATA,sha256=8y1wbYXB1T7_irlTiOilQbI_XQWPKc2aj8Aq7QVhRN4,37942
-crackerjack-0.34.0.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-crackerjack-0.34.0.dist-info/entry_points.txt,sha256=AJKNft0WXm9xoGUJ3Trl-iXHOWxRAYbagQiza3AILr4,57
-crackerjack-0.34.0.dist-info/licenses/LICENSE,sha256=fDt371P6_6sCu7RyqiZH_AhT1LdN3sN1zjBtqEhDYCk,1531
-crackerjack-0.34.0.dist-info/RECORD,,
+crackerjack-0.34.2.dist-info/METADATA,sha256=lHdu1Cejg0Jvt5xvQfc1oyFpQ7zX2fpNZnFjmGOoLro,37942
+crackerjack-0.34.2.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+crackerjack-0.34.2.dist-info/entry_points.txt,sha256=AJKNft0WXm9xoGUJ3Trl-iXHOWxRAYbagQiza3AILr4,57
+crackerjack-0.34.2.dist-info/licenses/LICENSE,sha256=fDt371P6_6sCu7RyqiZH_AhT1LdN3sN1zjBtqEhDYCk,1531
+crackerjack-0.34.2.dist-info/RECORD,,