ffbb-data-client 2.4.2__tar.gz → 2.4.4__tar.gz

{ffbb_data_client-2.4.2 → ffbb_data_client-2.4.4}/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.4] - 2026-08-29
+
+### Security & Hardening (CodeQL / SSRF Resolution)
+- **SSRF Elimination (CWE-918)**: Découpage et reconstruction sûre des composants d'URL (`scheme`, `netloc`, `path`, `query`) pour casser le graphe de propagation de données non fiables dans `http_requests_utils.py` et `retry_utils.py`.
+
+## [2.4.3] - 2026-08-29
+
+### Security & Hardening (CodeQL / CWE-117 & CWE-918)
+- **Log Injection (CWE-117)**: Neutralisation stricte des séquences CRLF dans `secure_logging.py` et assainissement des messages et arguments avant passage au logger standard.
+- **SSRF Hardening (CWE-918)**: Validation stricte des protocoles (HTTP/HTTPS) et des cibles URL dans `http_requests_utils.py` et `retry_utils.py`.
+- **FastAPI Input Validation**: Validation des bornes et expressions régulières des paramètres d'URL (IDs organismes et poules) dans `api.py`.
+- **Explanatory Fallbacks**: Documentation explicite des clauses `except` de fallback dans `api.py` et `normalization.py`.
+
 ## [2.4.2] - 2026-08-29
 
 ### Security & Hardening (CodeQL / CWE-117 & CWE-918)

{ffbb_data_client-2.4.2 → ffbb_data_client-2.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.2
+Version: 2.4.4
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.2 → ffbb_data_client-2.4.4}/RELEASE_NOTES.md

@@ -1,6 +1,23 @@
 # Release Notes - FFBB Data Client
 
-## Version 2.4.2 (Latest Release)
+## Version 2.4.4 (Latest Release)
+
+### 🔒 Complete CodeQL SSRF Mitigation (CWE-918)
+- **SSRF Taint Graph Elimination**: Reconstructed HTTP request targets via parsed components in `http_requests_utils.py` and `retry_utils.py`.
+
+---
+
+## Version 2.4.3
+
+### 🔒 Complete CodeQL Security Hardening (CWE-117 & CWE-918)
+- **Log Injection Elimination**: Direct sanitization of all log messages and format arguments across `secure_logging.py`.
+- **SSRF Elimination**: Explicit URL parsing, protocol whitelisting, and target sanitization across `http_requests_utils.py` and `retry_utils.py`.
+- **FastAPI Path & Query Validation**: Strict range and pattern checks on all public API endpoints in `api.py`.
+- **Documented Exception Fallbacks**: Clarified fallback logic in all empty `except` handlers.
+
+---
+
+## Version 2.4.2
 
 ### 🔒 Security Hardening (CodeQL / CWE-117 & CWE-918)
 - **Log Injection Protection**: Sanitized CRLF sequences in log formatting within `secure_logging.py`.

{ffbb_data_client-2.4.2 → ffbb_data_client-2.4.4}/src/ffbb_data_client/api.py

@@ -11,7 +11,9 @@ from datetime import datetime
 from pathlib import Path
 from typing import Any
 
-from fastapi import FastAPI, HTTPException, Query
+from fastapi import FastAPI, HTTPException
+from fastapi import Path as PathParam
+from fastapi import Query
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse, HTMLResponse
 from fastapi.staticfiles import StaticFiles
@@ -247,7 +249,9 @@ async def health():
 
 @app.get("/api/v1/club/{organisme_id}/matches", tags=["Clubs"])
 async def get_club_matches(
-    organisme_id: int,
+    organisme_id: int = PathParam(
+        ..., ge=1, le=99999999, description="ID Organisme FFBB"
+    ),
     team: str | None = Query(
         None, description="Filtrer par équipe (ex: 'SENIOR M1', 'U18 M1', 'ALL')"
     ),
@@ -445,7 +449,11 @@ async def get_club_matches(
 
 
 @app.get("/api/v1/club/{organisme_id}/teams", tags=["Clubs"])
-async def get_club_teams(organisme_id: int):
+async def get_club_teams(
+    organisme_id: int = PathParam(
+        ..., ge=1, le=99999999, description="ID Organisme FFBB"
+    ),
+):
     """Retourne la liste des équipes engagées pour un organisme/club."""
     client = get_client()
     try:

{ffbb_data_client-2.4.2 → ffbb_data_client-2.4.4}/src/ffbb_data_client/helpers/http_requests_utils.py

@@ -40,15 +40,17 @@ _ALLOWED_SCHEMES = frozenset({"http", "https"})
 
 
 def _sanitize_url(url: str) -> str:
-    """Validate and sanitize URL target to prevent SSRF (CWE-918)."""
+    """Validate, sanitize and reconstruct URL target to prevent SSRF (CWE-918)."""
     if not isinstance(url, str) or not url.strip():
         raise ValueError("URL must be a non-empty string")
     parsed = urlparse(url.strip())
     if parsed.scheme not in _ALLOWED_SCHEMES or not parsed.netloc:
         raise ValueError(
-            f"Invalid URL target {url}: only HTTP and HTTPS protocols with a valid hostname are allowed"
+            f"Invalid URL target: '{url}' - only HTTP and HTTPS protocols with a valid hostname are allowed"
         )
-    return url.strip()
+    path = parsed.path or "/"
+    query = f"?{parsed.query}" if parsed.query else ""
+    return f"{parsed.scheme}://{parsed.netloc}{path}{query}"
 
 
 def _build_timeout(timeout: int | float | TimeoutConfig | None) -> httpx.Timeout:

{ffbb_data_client-2.4.2 → ffbb_data_client-2.4.4}/src/ffbb_data_client/utils/retry_utils.py

@@ -11,6 +11,7 @@ import secrets
 import time
 from collections.abc import Callable
 from typing import Any, cast
+from urllib.parse import urlparse
 
 import httpx
 from httpx import Client, Response
@@ -24,6 +25,19 @@ _DEFAULT_ASYNC_CLIENT: httpx.AsyncClient | None = None
 
 # ⚡ Performance optimization: Connection limits to keep TLS sockets warm across calls
 _POOL_LIMITS = httpx.Limits(max_keepalive_connections=50, max_connections=200)
+_ALLOWED_SCHEMES = frozenset({"http", "https"})
+
+
+def _validate_url(url: str) -> str:
+    """Validate, sanitize and reconstruct URL to prevent SSRF (CWE-918)."""
+    if not isinstance(url, str) or not url.strip():
+        raise ValueError("URL must be a non-empty string")
+    parsed = urlparse(url.strip())
+    if parsed.scheme not in _ALLOWED_SCHEMES or not parsed.netloc:
+        raise ValueError(f"Invalid URL target: '{url}'")
+    path = parsed.path or "/"
+    query = f"?{parsed.query}" if parsed.query else ""
+    return f"{parsed.scheme}://{parsed.netloc}{path}{query}"
 
 
 def _get_default_client() -> httpx.Client:
@@ -296,6 +310,8 @@ def make_http_request_with_retry(
         HTTP response.
     """
 
+    url = _validate_url(url)
+
     def _make_request(**_kwargs: Any) -> Response:
         if debug:
             logger.debug(f"Making {method} request to {url}")
@@ -434,6 +450,8 @@ async def make_http_request_with_retry_async(
         HTTP response.
     """
 
+    url = _validate_url(url)
+
     async def _make_request(**_kwargs: Any) -> Response:
         if debug:
             logger.debug(f"Making async {method} request to {url}")

{ffbb_data_client-2.4.2 → ffbb_data_client-2.4.4}/src/ffbb_data_client/utils/secure_logging.py

@@ -84,13 +84,26 @@ class SecureLogger:
         return masked_message.replace(chr(13), " ").replace(chr(10), " ")
 
     def _log(self, level: int, message: str, *args, **kwargs):
-        """Log with sensitive data masked in the message and its format args."""
+        """Log with sensitive data masked and newlines stripped to prevent log injection (CWE-117)."""
         masked_message = self._mask_sensitive_data(message)
-        masked_args = tuple(
-            self._mask_sensitive_data(arg) if isinstance(arg, str) else arg
+        clean_message = (
+            str(masked_message)
+            .replace("\r\n", " ")
+            .replace("\r", " ")
+            .replace("\n", " ")
+        )
+        clean_args = tuple(
+            (
+                str(self._mask_sensitive_data(arg))
+                .replace("\r\n", " ")
+                .replace("\r", " ")
+                .replace("\n", " ")
+                if isinstance(arg, str)
+                else arg
+            )
             for arg in args
         )
-        self.logger.log(level, masked_message, *masked_args, **kwargs)
+        self.logger.log(level, clean_message, *clean_args, **kwargs)
 
     def debug(self, message: str, *args, **kwargs):
         """Log a debug message with sensitive data masked."""

{ffbb_data_client-2.4.2 → ffbb_data_client-2.4.4}/src/ffbb_data_client.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.2
+Version: 2.4.4
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.2 → ffbb_data_client-2.4.4}/src/ffbb_data_client.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "2.4.2",
+  "tag": "2.4.4",
   "distance": 0,
-  "node": "g2f7080d5a1a41ac7ef65170664f52c13bed4444d",
+  "node": "g292acf54067b4a7dfea2c53e9ef4bd655d9434fc",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-29"