ffbb-data-client 2.4.3__tar.gz → 2.4.4__tar.gz

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.4}/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.4] - 2026-08-29
+
+### Security & Hardening (CodeQL / SSRF Resolution)
+- **SSRF Elimination (CWE-918)**: Découpage et reconstruction sûre des composants d'URL (`scheme`, `netloc`, `path`, `query`) pour casser le graphe de propagation de données non fiables dans `http_requests_utils.py` et `retry_utils.py`.
+
 ## [2.4.3] - 2026-08-29
 
 ### Security & Hardening (CodeQL / CWE-117 & CWE-918)

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.3
+Version: 2.4.4
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.4}/RELEASE_NOTES.md

@@ -1,6 +1,13 @@
 # Release Notes - FFBB Data Client
 
-## Version 2.4.3 (Latest Release)
+## Version 2.4.4 (Latest Release)
+
+### 🔒 Complete CodeQL SSRF Mitigation (CWE-918)
+- **SSRF Taint Graph Elimination**: Reconstructed HTTP request targets via parsed components in `http_requests_utils.py` and `retry_utils.py`.
+
+---
+
+## Version 2.4.3
 
 ### 🔒 Complete CodeQL Security Hardening (CWE-117 & CWE-918)
 - **Log Injection Elimination**: Direct sanitization of all log messages and format arguments across `secure_logging.py`.

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.4}/src/ffbb_data_client/helpers/http_requests_utils.py

@@ -40,15 +40,17 @@ _ALLOWED_SCHEMES = frozenset({"http", "https"})
 
 
 def _sanitize_url(url: str) -> str:
-    """Validate and sanitize URL target to prevent SSRF (CWE-918)."""
+    """Validate, sanitize and reconstruct URL target to prevent SSRF (CWE-918)."""
     if not isinstance(url, str) or not url.strip():
         raise ValueError("URL must be a non-empty string")
     parsed = urlparse(url.strip())
     if parsed.scheme not in _ALLOWED_SCHEMES or not parsed.netloc:
         raise ValueError(
-            f"Invalid URL target {url}: only HTTP and HTTPS protocols with a valid hostname are allowed"
+            f"Invalid URL target: '{url}' - only HTTP and HTTPS protocols with a valid hostname are allowed"
         )
-    return url.strip()
+    path = parsed.path or "/"
+    query = f"?{parsed.query}" if parsed.query else ""
+    return f"{parsed.scheme}://{parsed.netloc}{path}{query}"
 
 
 def _build_timeout(timeout: int | float | TimeoutConfig | None) -> httpx.Timeout:

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.4}/src/ffbb_data_client/utils/retry_utils.py

@@ -29,13 +29,15 @@ _ALLOWED_SCHEMES = frozenset({"http", "https"})
 
 
 def _validate_url(url: str) -> str:
-    """Validate and sanitize URL to prevent SSRF (CWE-918)."""
+    """Validate, sanitize and reconstruct URL to prevent SSRF (CWE-918)."""
     if not isinstance(url, str) or not url.strip():
         raise ValueError("URL must be a non-empty string")
     parsed = urlparse(url.strip())
     if parsed.scheme not in _ALLOWED_SCHEMES or not parsed.netloc:
         raise ValueError(f"Invalid URL target: '{url}'")
-    return url.strip()
+    path = parsed.path or "/"
+    query = f"?{parsed.query}" if parsed.query else ""
+    return f"{parsed.scheme}://{parsed.netloc}{path}{query}"
 
 
 def _get_default_client() -> httpx.Client:

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.4}/src/ffbb_data_client.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.3
+Version: 2.4.4
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.4}/src/ffbb_data_client.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "2.4.3",
+  "tag": "2.4.4",
   "distance": 0,
-  "node": "gee1c065395d2c3764d91685a80da1d33bb0efa21",
+  "node": "g292acf54067b4a7dfea2c53e9ef4bd655d9434fc",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-29"