ffbb-data-client 2.4.1__tar.gz → 2.4.2__tar.gz

{ffbb_data_client-2.4.1 → ffbb_data_client-2.4.2}/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.2] - 2026-08-29
+
+### Security & Hardening (CodeQL / CWE-117 & CWE-918)
+- **Log Injection (CWE-117)**: Neutralisation des injections de logs par assainissement des sauts de ligne (CRLF) dans `secure_logging.py`.
+- **SSRF Hardening (CWE-918)**: Validation stricte des protocoles (HTTP/HTTPS) et des domaines cibles dans `http_requests_utils.py`.
+- **CodeQL Empty Excepts**: Ajout de commentaires explicatifs documentés dans les blocs `except` de `api.py` et `normalization.py`.
+
 ## [2.4.1] - 2026-08-29
 
 ### Fixed

{ffbb_data_client-2.4.1 → ffbb_data_client-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.1
+Version: 2.4.2
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.1 → ffbb_data_client-2.4.2}/RELEASE_NOTES.md

@@ -1,6 +1,15 @@
 # Release Notes - FFBB Data Client
 
-## Version 2.4.1 (Latest Release)
+## Version 2.4.2 (Latest Release)
+
+### 🔒 Security Hardening (CodeQL / CWE-117 & CWE-918)
+- **Log Injection Protection**: Sanitized CRLF sequences in log formatting within `secure_logging.py`.
+- **SSRF Hardening**: Validated URL targets and protocols in `http_requests_utils.py`.
+- **Explanatory Error Handling**: Documented all fallback exception blocks across `api.py` and `normalization.py`.
+
+---
+
+## Version 2.4.1
 
 ### 🐛 Bug Fixes & CI
 - **Static Typing & Linter Compliance**: Resolved MyPy type narrowing issues in `api.py`, wrapped long regex patterns in `normalization.py`, and aligned Pyright configuration.

{ffbb_data_client-2.4.1 → ffbb_data_client-2.4.2}/src/ffbb_data_client/api.py

@@ -218,6 +218,7 @@ def resolve_exact_salle_address(
                             )
                             v = getattr(commune, "libelle", "") or ""
                 except Exception:
+                    # Ignore salle search errors to fallback to address-only format
                     pass
 
                 parts = [adr, f"{cp} {v}".strip()]
@@ -229,6 +230,7 @@ def resolve_exact_salle_address(
                     _salle_cache[cache_key] = full
                     return full
         except Exception:
+            # Fallback to default name if salle resolution fails
             pass
 
     return default_name or "Lieu à confirmer"

{ffbb_data_client-2.4.1 → ffbb_data_client-2.4.2}/src/ffbb_data_client/helpers/http_requests_utils.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import json
 import time
 from typing import Any
-from urllib.parse import urlencode
+from urllib.parse import urlencode, urlparse
 
 try:
     import orjson  # type: ignore
@@ -36,6 +36,21 @@ from ..utils.secure_logging import get_secure_logger
 logger = get_secure_logger(__name__)
 
 
+_ALLOWED_SCHEMES = frozenset({"http", "https"})
+
+
+def _sanitize_url(url: str) -> str:
+    """Validate and sanitize URL target to prevent SSRF (CWE-918)."""
+    if not isinstance(url, str) or not url.strip():
+        raise ValueError("URL must be a non-empty string")
+    parsed = urlparse(url.strip())
+    if parsed.scheme not in _ALLOWED_SCHEMES or not parsed.netloc:
+        raise ValueError(
+            f"Invalid URL target {url}: only HTTP and HTTPS protocols with a valid hostname are allowed"
+        )
+    return url.strip()
+
+
 def _build_timeout(timeout: int | float | TimeoutConfig | None) -> httpx.Timeout:
     if isinstance(timeout, TimeoutConfig):
         return httpx.Timeout(
@@ -159,6 +174,7 @@ def http_get(
     Returns:
         Response: The HTTP response.
     """
+    url = _sanitize_url(url)
     start_time: float = 0.0
     if debug:
         logger.debug(f"Making GET request to {url}")
@@ -246,6 +262,7 @@ def http_post(
     Returns:
         Response: The HTTP response.
     """
+    url = _sanitize_url(url)
     start_time: float = 0.0
     data_str: str = ""
     if debug:
@@ -412,6 +429,7 @@ async def http_get_async(
     """
     Performs an HTTP GET request asynchroniously.
     """
+    url = _sanitize_url(url)
     start_time: float = 0.0
     if debug:
         logger.debug(f"Making async GET request to {url}")
@@ -513,6 +531,7 @@ async def http_post_async(
     """
     Performs an HTTP POST request asynchroniously.
     """
+    url = _sanitize_url(url)
     start_time: float = 0.0
     data_str: str = ""
     if debug:

{ffbb_data_client-2.4.1 → ffbb_data_client-2.4.2}/src/ffbb_data_client/helpers/normalization.py

@@ -134,6 +134,7 @@ def parse_categorie(raw: str | None) -> ParsedCategorie:
         try:
             numero_equipe = int(num_match.group(1))
         except ValueError:
+            # Fallback if matched digits cannot be converted to int
             pass
 
     return ParsedCategorie(categorie=categorie, sexe=sexe, numero_equipe=numero_equipe)

{ffbb_data_client-2.4.1 → ffbb_data_client-2.4.2}/src/ffbb_data_client/utils/secure_logging.py

@@ -66,22 +66,22 @@ class SecureLogger:
 
     def _mask_sensitive_data(self, message: str) -> str:
         """
-        Mask sensitive information in a log message.
+        Mask sensitive information in a log message and sanitize newlines to prevent Log Injection (CWE-117).
 
         Args:
             message (str): The original log message
 
         Returns:
-            str: The message with sensitive data masked
+            str: The message with sensitive data masked and newlines sanitized
         """
         if not isinstance(message, str):
-            return str(message)
+            return str(message).replace(chr(13), " ").replace(chr(10), " ")
 
         masked_message = message
         for pattern, replacement in self.SENSITIVE_PATTERNS_COMPILED:
             masked_message = pattern.sub(replacement, masked_message)
 
-        return masked_message
+        return masked_message.replace(chr(13), " ").replace(chr(10), " ")
 
     def _log(self, level: int, message: str, *args, **kwargs):
         """Log with sensitive data masked in the message and its format args."""

{ffbb_data_client-2.4.1 → ffbb_data_client-2.4.2}/src/ffbb_data_client.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.1
+Version: 2.4.2
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.1 → ffbb_data_client-2.4.2}/src/ffbb_data_client.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "2.4.1",
+  "tag": "2.4.2",
   "distance": 0,
-  "node": "g25c4b1dc018d5b11f40fa3c0d4e2ef4b2f7d7625",
+  "node": "g2f7080d5a1a41ac7ef65170664f52c13bed4444d",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-29"