ffbb-data-client 2.4.0__tar.gz → 2.4.2__tar.gz

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.2] - 2026-08-29
+
+### Security & Hardening (CodeQL / CWE-117 & CWE-918)
+- **Log Injection (CWE-117)**: Neutralisation des injections de logs par assainissement des sauts de ligne (CRLF) dans `secure_logging.py`.
+- **SSRF Hardening (CWE-918)**: Validation stricte des protocoles (HTTP/HTTPS) et des domaines cibles dans `http_requests_utils.py`.
+- **CodeQL Empty Excepts**: Ajout de commentaires explicatifs documentés dans les blocs `except` de `api.py` et `normalization.py`.
+
+## [2.4.1] - 2026-08-29
+
+### Fixed
+- **CI / Linters & Typage**: Correction des erreurs de typage MyPy/Pyright dans `api.py`, découpage des lignes d'expressions régulières dans `normalization.py` et configuration des extras de typage.
+
 ## [2.4.0] - 2026-08-29
 
 ### Added

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.0
+Version: 2.4.2
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/RELEASE_NOTES.md

@@ -1,6 +1,22 @@
 # Release Notes - FFBB Data Client
 
-## Version 2.4.0 (Latest Release)
+## Version 2.4.2 (Latest Release)
+
+### 🔒 Security Hardening (CodeQL / CWE-117 & CWE-918)
+- **Log Injection Protection**: Sanitized CRLF sequences in log formatting within `secure_logging.py`.
+- **SSRF Hardening**: Validated URL targets and protocols in `http_requests_utils.py`.
+- **Explanatory Error Handling**: Documented all fallback exception blocks across `api.py` and `normalization.py`.
+
+---
+
+## Version 2.4.1
+
+### 🐛 Bug Fixes & CI
+- **Static Typing & Linter Compliance**: Resolved MyPy type narrowing issues in `api.py`, wrapped long regex patterns in `normalization.py`, and aligned Pyright configuration.
+
+---
+
+## Version 2.4.0
 
 ### 🚀 New Features & API
 - **Embedded FastAPI Server**: Standalone or embeddable FastAPI application providing CORS-enabled REST endpoints for clubs, competitions, and match calendars with auto-generated Swagger UI.

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/pyproject.toml

@@ -26,6 +26,7 @@ ignore_missing_imports = true
 [tool.pyright]
 pythonVersion = "3.14"
 typeCheckingMode = "standard"
+reportMissingImports = false
 
 [tool.pylint.messages_control]
 # Disable warnings for API field names that match Python built-ins

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/src/ffbb_data_client/api.py

@@ -6,11 +6,10 @@ and hosts the official documentation website at /.
 
 from __future__ import annotations
 
-import os
 import re
-from pathlib import Path
-from typing import Any, Optional
 from datetime import datetime
+from pathlib import Path
+from typing import Any
 
 from fastapi import FastAPI, HTTPException, Query
 from fastapi.middleware.cors import CORSMiddleware
@@ -43,7 +42,7 @@ app.add_middleware(
 )
 
 # Global Client Singleton
-_client: Optional[FFBBDataClient] = None
+_client: FFBBDataClient | None = None
 
 
 def get_client() -> FFBBDataClient:
@@ -123,7 +122,7 @@ def clean_opponent_name(opp_raw: str) -> str:
 
 # Cache dictionaries
 _org_cache: dict[int, Any] = {}
-_logo_cache: dict[str, Optional[str]] = {}
+_logo_cache: dict[str, str | None] = {}
 _salle_cache: dict[str, str] = {}
 
 
@@ -145,7 +144,9 @@ def get_cached_organisme(client, org_id: Any):
         return None
 
 
-def resolve_exact_salle_address(client, salle_id: Any, org_id: Any, default_name: str = "") -> str:
+def resolve_exact_salle_address(
+    client, salle_id: Any, org_id: Any, default_name: str = ""
+) -> str:
     """Résout l'adresse complète officielle de la salle (Nom - Rue, CP Ville)."""
     sid = str(salle_id) if salle_id else ""
     org_key = str(org_id) if org_id else ""
@@ -157,15 +158,28 @@ def resolve_exact_salle_address(client, salle_id: Any, org_id: Any, default_name
     org = get_cached_organisme(client, org_id) if org_id else None
 
     # 1. Vérifier si la salle principale de l'organisme hôte correspond
-    if org and getattr(org, 'salle', None):
+    if org and getattr(org, "salle", None):
         o_salle = org.salle
-        o_sid = str(getattr(o_salle, 'id', ''))
+        o_sid = str(getattr(o_salle, "id", ""))
         if o_sid == sid or not sid:
-            nom = getattr(o_salle, 'libelle', '') or getattr(o_salle, 'nom', '') or default_name
-            adr = getattr(o_salle, 'adresse', '') or ""
-            commune = getattr(o_salle, 'commune', None)
-            cp = getattr(commune, 'codePostal', '') or getattr(commune, 'code_postal', '') if commune else ""
-            v = getattr(commune, 'libelle', '') or getattr(o_salle, 'ville', '') if commune else ""
+            nom = (
+                getattr(o_salle, "libelle", "")
+                or getattr(o_salle, "nom", "")
+                or default_name
+            )
+            adr = getattr(o_salle, "adresse", "") or ""
+            commune = getattr(o_salle, "commune", None)
+            cp = (
+                getattr(commune, "codePostal", "")
+                or getattr(commune, "code_postal", "")
+                if commune
+                else ""
+            )
+            v = (
+                getattr(commune, "libelle", "") or getattr(o_salle, "ville", "")
+                if commune
+                else ""
+            )
             parts = [adr, f"{cp} {v}".strip()]
             full_addr = ", ".join([p for p in parts if p])
             full = f"{nom} - {full_addr}" if nom and full_addr else (nom or full_addr)
@@ -178,33 +192,45 @@ def resolve_exact_salle_address(client, salle_id: Any, org_id: Any, default_name
         try:
             salle = client.get_salle(sid)
             if salle:
-                nom = getattr(salle, 'libelle', '') or getattr(salle, 'nom', '') or default_name
-                adr = getattr(salle, 'adresse', '') or ""
+                nom = (
+                    getattr(salle, "libelle", "")
+                    or getattr(salle, "nom", "")
+                    or default_name
+                )
+                adr = getattr(salle, "adresse", "") or ""
                 cp, v = "", ""
                 try:
                     res = client.search_salles(nom)
-                    if res and getattr(res, 'hits', None):
+                    if res and getattr(res, "hits", None):
                         matched_hit = None
                         for hit in res.hits:
-                            if str(getattr(hit, 'id', '')) == sid:
+                            if str(getattr(hit, "id", "")) == sid:
                                 matched_hit = hit
                                 break
                         if not matched_hit:
                             matched_hit = res.hits[0]
-                        commune = getattr(matched_hit, 'commune', None)
+                        commune = getattr(matched_hit, "commune", None)
                         if commune:
-                            cp = getattr(commune, 'code_postal', '') or getattr(commune, 'codePostal', '') or ""
-                            v = getattr(commune, 'libelle', '') or ""
+                            cp = (
+                                getattr(commune, "code_postal", "")
+                                or getattr(commune, "codePostal", "")
+                                or ""
+                            )
+                            v = getattr(commune, "libelle", "") or ""
                 except Exception:
+                    # Ignore salle search errors to fallback to address-only format
                     pass
 
                 parts = [adr, f"{cp} {v}".strip()]
                 full_addr = ", ".join([p for p in parts if p])
-                full = f"{nom} - {full_addr}" if nom and full_addr else (nom or full_addr)
+                full = (
+                    f"{nom} - {full_addr}" if nom and full_addr else (nom or full_addr)
+                )
                 if full:
                     _salle_cache[cache_key] = full
                     return full
         except Exception:
+            # Fallback to default name if salle resolution fails
             pass
 
     return default_name or "Lieu à confirmer"
@@ -222,7 +248,9 @@ async def health():
 @app.get("/api/v1/club/{organisme_id}/matches", tags=["Clubs"])
 async def get_club_matches(
     organisme_id: int,
-    team: Optional[str] = Query(None, description="Filtrer par équipe (ex: 'SENIOR M1', 'U18 M1', 'ALL')"),
+    team: str | None = Query(
+        None, description="Filtrer par équipe (ex: 'SENIOR M1', 'U18 M1', 'ALL')"
+    ),
 ):
     """
     Récupère l'ensemble des rencontres officielles FFBB d'un club,
@@ -233,12 +261,14 @@ async def get_club_matches(
     try:
         org = client.get_organisme(organisme_id)
         if not org:
-            raise HTTPException(status_code=404, detail=f"Club {organisme_id} introuvable.")
+            raise HTTPException(
+                status_code=404, detail=f"Club {organisme_id} introuvable."
+            )
     except Exception as e:
         raise HTTPException(status_code=500, detail=f"Erreur FFBB: {e}")
 
     club_name = getattr(org, "nom", "") or "Club"
-    club_logo_url: Optional[str] = None
+    club_logo_url: str | None = None
     if getattr(org, "logo", None):
         logo_id = getattr(org.logo, "id", None) or org.logo
         if logo_id:
@@ -251,7 +281,9 @@ async def get_club_matches(
     for eng in engagements:
         poule_obj = getattr(eng, "idPoule", None)
         comp_obj = getattr(eng, "idCompetition", None)
-        poule_id = getattr(poule_obj, "id", None) or (str(poule_obj) if poule_obj else None)
+        poule_id = getattr(poule_obj, "id", None) or (
+            str(poule_obj) if poule_obj else None
+        )
         comp_nom = getattr(comp_obj, "nom", "") or ""
 
         if not poule_id:
@@ -273,8 +305,12 @@ async def get_club_matches(
             id_org1 = str(getattr(m, "idOrganismeEquipe1", "") or "")
             id_org2 = str(getattr(m, "idOrganismeEquipe2", "") or "")
 
-            is_club1 = id_org1 == str(organisme_id) or club_name.upper() in nom_eq1.upper()
-            is_club2 = id_org2 == str(organisme_id) or club_name.upper() in nom_eq2.upper()
+            is_club1 = (
+                id_org1 == str(organisme_id) or club_name.upper() in nom_eq1.upper()
+            )
+            is_club2 = (
+                id_org2 == str(organisme_id) or club_name.upper() in nom_eq2.upper()
+            )
 
             if not is_club1 and not is_club2:
                 continue
@@ -311,13 +347,13 @@ async def get_club_matches(
 
         nom_eq1 = getattr(m, "nomEquipe1", "") or ""
         nom_eq2 = getattr(m, "nomEquipe2", "") or ""
-        id_org1 = getattr(m, "idOrganismeEquipe1", None)
-        id_org2 = getattr(m, "idOrganismeEquipe2", None)
+        id_org1_raw = getattr(m, "idOrganismeEquipe1", None)
+        id_org2_raw = getattr(m, "idOrganismeEquipe2", None)
         m_id = str(getattr(m, "id", ""))
 
         local_team_raw = nom_eq1 if is_home else nom_eq2
         opp_team_raw = nom_eq2 if is_home else nom_eq1
-        opp_org_id = id_org2 if is_home else id_org1
+        opp_org_id = id_org2_raw if is_home else id_org1_raw
 
         scba_team = normalize_team_name(local_team_raw, comp_nom)
         opponent = clean_opponent_name(opp_team_raw)
@@ -351,7 +387,10 @@ async def get_club_matches(
                 location = "Maison des Sports, Place des Bughes, 63000 Clermont-Ferrand"
             else:
                 location = resolve_exact_salle_address(
-                    client, salle_id=salle_id, org_id=organisme_id, default_name="Domicile"
+                    client,
+                    salle_id=salle_id,
+                    org_id=organisme_id,
+                    default_name="Domicile",
                 )
         else:
             location = resolve_exact_salle_address(
@@ -362,7 +401,7 @@ async def get_club_matches(
             )
 
         # Opponent Logo
-        opponent_logo: Optional[str] = None
+        opponent_logo: str | None = None
         if opp_org_id:
             s_opp_org = str(opp_org_id)
             if s_opp_org in _logo_cache:
@@ -421,12 +460,16 @@ async def get_club_teams(organisme_id: int):
     for eng in engagements:
         comp = getattr(eng, "idCompetition", None)
         poule = getattr(eng, "idPoule", None)
-        teams.append({
-            "engagement_id": str(getattr(eng, "id", "")),
-            "team_number": getattr(eng, "numeroEquipe", "") or "1",
-            "competition": getattr(comp, "nom", "") if comp else "",
-            "poule_id": str(getattr(poule, "id", "")) if poule else str(poule or ""),
-        })
+        teams.append(
+            {
+                "engagement_id": str(getattr(eng, "id", "")),
+                "team_number": getattr(eng, "numeroEquipe", "") or "1",
+                "competition": getattr(comp, "nom", "") if comp else "",
+                "poule_id": (
+                    str(getattr(poule, "id", "")) if poule else str(poule or "")
+                ),
+            }
+        )
 
     return {
         "organisme_id": organisme_id,
@@ -486,7 +529,9 @@ if _WEBSITE_DIR.exists():
     async def serve_index():
         index_file = _WEBSITE_DIR / "index.html"
         if index_file.exists():
-            return HTMLResponse(content=index_file.read_text(encoding="utf-8"), status_code=200)
+            return HTMLResponse(
+                content=index_file.read_text(encoding="utf-8"), status_code=200
+            )
         return {"service": "ffbb-data-client-api", "docs": "/docs"}
 
     @app.get("/robots.txt", include_in_schema=False)

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/src/ffbb_data_client/helpers/http_requests_utils.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import json
 import time
 from typing import Any
-from urllib.parse import urlencode
+from urllib.parse import urlencode, urlparse
 
 try:
     import orjson  # type: ignore
@@ -36,6 +36,21 @@ from ..utils.secure_logging import get_secure_logger
 logger = get_secure_logger(__name__)
 
 
+_ALLOWED_SCHEMES = frozenset({"http", "https"})
+
+
+def _sanitize_url(url: str) -> str:
+    """Validate and sanitize URL target to prevent SSRF (CWE-918)."""
+    if not isinstance(url, str) or not url.strip():
+        raise ValueError("URL must be a non-empty string")
+    parsed = urlparse(url.strip())
+    if parsed.scheme not in _ALLOWED_SCHEMES or not parsed.netloc:
+        raise ValueError(
+            f"Invalid URL target {url}: only HTTP and HTTPS protocols with a valid hostname are allowed"
+        )
+    return url.strip()
+
+
 def _build_timeout(timeout: int | float | TimeoutConfig | None) -> httpx.Timeout:
     if isinstance(timeout, TimeoutConfig):
         return httpx.Timeout(
@@ -159,6 +174,7 @@ def http_get(
     Returns:
         Response: The HTTP response.
     """
+    url = _sanitize_url(url)
     start_time: float = 0.0
     if debug:
         logger.debug(f"Making GET request to {url}")
@@ -246,6 +262,7 @@ def http_post(
     Returns:
         Response: The HTTP response.
     """
+    url = _sanitize_url(url)
     start_time: float = 0.0
     data_str: str = ""
     if debug:
@@ -412,6 +429,7 @@ async def http_get_async(
     """
     Performs an HTTP GET request asynchroniously.
     """
+    url = _sanitize_url(url)
     start_time: float = 0.0
     if debug:
         logger.debug(f"Making async GET request to {url}")
@@ -513,6 +531,7 @@ async def http_post_async(
     """
     Performs an HTTP POST request asynchroniously.
     """
+    url = _sanitize_url(url)
     start_time: float = 0.0
     data_str: str = ""
     if debug:

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/src/ffbb_data_client/helpers/normalization.py

@@ -1,6 +1,7 @@
 """
 Text normalization and category parsing utilities for French basketball data.
 """
+
 from __future__ import annotations
 
 import re
@@ -33,15 +34,25 @@ _VETERAN_PATTERN = re.compile(
     re.IGNORECASE,
 )
 _SENIOR_PATTERN = re.compile(
-    r"\b(SENIORS?|SEN|SE|SEM\d?|SEF\d?|SM\d?|SF\d?|[RDN][MF]\d?|PN[MF]\d?|PR[MF]\d?|[RDN]\d[MF]|PRE[\s-]?NAT(IONALE?)?|PRÉ[\s-]?NAT(IONALE?)?|PRE[\s-]?REG(IONALE?)?|PRÉ[\s-]?RÉG(IONALE?)?|REGION(AL|ALE|ALES|AUX)?|RÉGION(AL|ALE|ALES|AUX)?|DEPARTEMENT(AL|ALE|ALES|AUX)?|DÉPARTEMENT(AL|ALE|ALES|AUX)?|NATION(AL|ALE|ALES|AUX)?|ELITE|ÉLITE)\b",
+    r"\b("
+    r"SENIORS?|SEN|SE|SEM\d?|SEF\d?|SM\d?|SF\d?|[RDN][MF]\d?|PN[MF]\d?|PR[MF]\d?|[RDN]\d[MF]|"
+    r"PRE[\s-]?NAT(IONALE?)?|PRÉ[\s-]?NAT(IONALE?)?|PRE[\s-]?REG(IONALE?)?|PRÉ[\s-]?RÉG(IONALE?)?|"
+    r"REGION(AL|ALE|ALES|AUX)?|RÉGION(AL|ALE|ALES|AUX)?|"
+    r"DEPARTEMENT(AL|ALE|ALES|AUX)?|DÉPARTEMENT(AL|ALE|ALES|AUX)?|"
+    r"NATION(AL|ALE|ALES|AUX)?|ELITE|ÉLITE"
+    r")\b",
     re.IGNORECASE,
 )
 _M_PATTERN = re.compile(
-    r"\bM\b|U\d{1,2}M|\b[RDN]M\d?\b|\bPNM\d?\b|\bPRM\d?\b|\bR\dM\b|\bD\dM\b|\bN\dM\b|\bSEM\d?\b|\bSM\d?\b|\bM\d\b|\b(MASC|MASCULIN|MASCULINS|MASCULINE|HOMMES?|GARS|GARCONS?|GARÇONS?|MESSIEURS|CADETS?|BENJAMINS?|POUSSINS?)\b",
+    r"\bM\b|U\d{1,2}M|\b[RDN]M\d?\b|\bPNM\d?\b|\bPRM\d?\b|\bR\dM\b|\bD\dM\b|\bN\dM\b|"
+    r"\bSEM\d?\b|\bSM\d?\b|\bM\d\b|"
+    r"\b(MASC|MASCULIN|MASCULINS|MASCULINE|HOMMES?|GARS|GARCONS?|GARÇONS?|MESSIEURS|CADETS?|BENJAMINS?|POUSSINS?)\b",
     re.IGNORECASE,
 )
 _F_PATTERN = re.compile(
-    r"\bF\b|U\d{1,2}F|\b[RDN]F\d?\b|\bPNF\d?\b|\bPRF\d?\b|\bR\dF\b|\bD\dF\b|\bN\dF\b|\bSEF\d?\b|\bSF\d?\b|\bF\d\b|\b(FÉM|FEM|FEMININ|FÉMININ|FEMININE|FÉMININE|FEMININES|FÉMININES|FILLES?|FEMMES?|DAMES?|CADETTES?|BENJAMINES?|POUSSINES?)\b",
+    r"\bF\b|U\d{1,2}F|\b[RDN]F\d?\b|\bPNF\d?\b|\bPRF\d?\b|\bR\dF\b|\bD\dF\b|\bN\dF\b|"
+    r"\bSEF\d?\b|\bSF\d?\b|\bF\d\b|"
+    r"\b(FÉM|FEM|FEMININ|FÉMININ|FEMININE|FÉMININE|FEMININES|FÉMININES|FILLES?|FEMMES?|DAMES?|CADETTES?|BENJAMINES?|POUSSINES?)\b",
     re.IGNORECASE,
 )
 _NUM_PATTERN = re.compile(r"(\d+)")
@@ -123,6 +134,7 @@ def parse_categorie(raw: str | None) -> ParsedCategorie:
         try:
             numero_equipe = int(num_match.group(1))
         except ValueError:
+            # Fallback if matched digits cannot be converted to int
             pass
 
     return ParsedCategorie(categorie=categorie, sexe=sexe, numero_equipe=numero_equipe)

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/src/ffbb_data_client/utils/secure_logging.py

@@ -66,22 +66,22 @@ class SecureLogger:
 
     def _mask_sensitive_data(self, message: str) -> str:
         """
-        Mask sensitive information in a log message.
+        Mask sensitive information in a log message and sanitize newlines to prevent Log Injection (CWE-117).
 
         Args:
             message (str): The original log message
 
         Returns:
-            str: The message with sensitive data masked
+            str: The message with sensitive data masked and newlines sanitized
         """
         if not isinstance(message, str):
-            return str(message)
+            return str(message).replace(chr(13), " ").replace(chr(10), " ")
 
         masked_message = message
         for pattern, replacement in self.SENSITIVE_PATTERNS_COMPILED:
             masked_message = pattern.sub(replacement, masked_message)
 
-        return masked_message
+        return masked_message.replace(chr(13), " ").replace(chr(10), " ")
 
     def _log(self, level: int, message: str, *args, **kwargs):
         """Log with sensitive data masked in the message and its format args."""

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/src/ffbb_data_client.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.0
+Version: 2.4.2
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/src/ffbb_data_client.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "2.4.0",
+  "tag": "2.4.2",
   "distance": 0,
-  "node": "g51d3aa3553eed8cafcb6047f071bfbfecaee69a1",
+  "node": "g2f7080d5a1a41ac7ef65170664f52c13bed4444d",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-29"

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/tests/unit/helpers/test_normalization.py

@@ -1,4 +1,5 @@
 """Unit tests for normalization helper."""
+
 from ffbb_data_client.helpers.normalization import (
     normalize_apostrophes,
     normalize_query,

{ffbb_data_client-2.4.0 → ffbb_data_client-2.4.2}/tox.ini

@@ -130,6 +130,7 @@ basepython = python3.14
 description = Run static type checks with mypy and pyright
 extras =
     typing
+    server
 deps =
     mypy>=1.19.0
     pyright>=1.1.407