qualys-cli 0.1.4__tar.gz → 0.1.6__tar.gz

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/CHANGELOG.md

@@ -6,6 +6,76 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.6] — 2026-07-17
+
+### Security
+- `qualys-cli serve`'s local HTTP server now runs on `ThreadingHTTPServer`
+  (was single-threaded — one slow client blocked every other caller), enforces
+  a request body-size cap with a safe `Content-Length` parse (413/400 instead
+  of an unhandled exception on a bad header), and sets a socket timeout so a
+  half-open connection can't hang a worker indefinitely.
+- The response body-size guard (`QUALYS_BODY_LIMIT_BYTES`) now actually bounds
+  memory use: responses are streamed and the read aborts as soon as the cap is
+  exceeded, instead of always fully buffering the body first and rejecting it
+  only after the fact.
+- `qualys-cli mcp`'s `tools/call` now rejects tool names that aren't in the
+  built catalog before shelling out, and bounds how much of a single stdin
+  line it will buffer (a pathological/misbehaving client could previously
+  make it buffer an unbounded amount of memory).
+- `--where field~regex` now rejects patterns with classic catastrophic-
+  backtracking shapes (nested quantifiers) before compiling — relevant
+  because saved queries (`qualys-cli query save/run`) can be authored by one
+  team member and run by another.
+- `--output-file` exports (`sub export`, `sub user-prefs export`, generic
+  `--output-file`, `batch --output-file`) are now written with `0600`
+  permissions instead of the process umask default, consistent with every
+  other sensitive artifact the CLI writes (config, audit log, cache, history).
+- Audit-log secret redaction now also catches secret-shaped field names beyond
+  the exact-match list (e.g. `db_password`, `adminSecret`, `x-custom-token`),
+  not just the ~29 literal key names it recognised before.
+
+### Fixed
+- `qualys-cli docs` no longer triggers the first-run credential-setup wizard
+  or scope-restriction checks — it never talks to the Qualys API and doesn't
+  need a profile.
+- Stale `--where` help text pointing at a removed `docs/usage.html` path now
+  points at `qualys-cli docs`.
+- `batch --parallel` now stops on first failure and respects
+  `--continue-on-error` the same way `--parallel 1` always did; previously
+  `--parallel` silently ran every command to completion regardless of the
+  flag.
+
+### Changed
+- JWT credential exchange (`/auth`) now retries transient network errors and
+  5xx responses with backoff (never 4xx — a bad password won't fix itself on
+  retry). Previously a single dropped packet during login failed the whole
+  command with no retry at all.
+- `paginate_json_parallel` refuses to dispatch more than
+  `QUALYS_MAX_PARALLEL_PAGES` (default 10,000) concurrent page fetches, so a
+  bad/inflated `totalCount` from upstream can't fan out an unbounded number of
+  requests.
+- The on-disk response cache (`cache.sqlite`) now evicts its oldest entries
+  once the row count passes `QUALYS_CACHE_MAX_ROWS` (default 2000) instead of
+  growing without bound on long-lived hosts.
+- Added a recursion depth cap to the internal Qualys pagination-URL walker as
+  a defensive measure against adversarial/malformed XML responses.
+
+## [0.1.5] — 2026-07-08
+
+### Changed
+- Package metadata: author is now `Qualys <support@qualys.com>`, with Balaji
+  Venkatesan and Andrew Nelson listed as maintainers.
+- Expanded and clarified PyPI keywords to match the modules the CLI ships
+  (policy compliance, cloud/container security, WAS, EASM, asset inventory).
+  Dropped the ambiguous `vm` keyword, which reads as "virtual machine" on PyPI.
+- The Qualys logo now heads the PyPI project description / README.
+
+### Fixed
+- `qualys_cli.__version__` was pinned at `0.1.0` and had drifted three releases
+  behind the real package version. It is now kept in step with the release.
+  (User-facing `--version` output was unaffected: it reads installed package
+  metadata via `importlib.metadata`, not this constant.)
+
 ## [0.1.4] — 2026-07-08
 
 ### Added
@@ -147,7 +217,9 @@ Initial public release.
 - Ruff lint clean (E, F, I, UP, B, C4, SIM rule sets).
 - Codegen pipeline (`scripts/`) is opt-in via the `codegen` extra.
 
-[Unreleased]: https://github.com/qualys/qualys-cli/compare/v0.1.2...HEAD
+[Unreleased]: https://github.com/qualys/qualys-cli/compare/v0.1.5...HEAD
+[0.1.5]: https://github.com/qualys/qualys-cli/compare/v0.1.4...v0.1.5
+[0.1.4]: https://github.com/qualys/qualys-cli/compare/v0.1.2...v0.1.4
 [0.1.2]: https://github.com/qualys/qualys-cli/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/qualys/qualys-cli/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/qualys/qualys-cli/releases/tag/v0.1.0

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/PKG-INFO

@@ -1,9 +1,10 @@
 Metadata-Version: 2.4
 Name: qualys-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management).
 Project-URL: Homepage, https://www.qualys.com
-Author: qualys-cli contributors
+Author-email: Qualys <support@qualys.com>
+Maintainer-email: Balaji Venkatesan <bvenkatesan@qualys.com>, Andrew Nelson <anelson@qualys.com>
 License: MIT License
         
         Copyright (c) 2026 Qualys Inc
@@ -26,7 +27,7 @@ License: MIT License
         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
         SOFTWARE.
 License-File: LICENSE
-Keywords: cli,cspm,patch-management,qualys,security,vm,vulnerability-management
+Keywords: asset-inventory,attack-surface-management,cli,cloud-security,container-security,cspm,devsecops,infosec,patch-management,policy-compliance,qualys,qualys-api,qualys-cloud-platform,security,vulnerability-management,web-application-scanning
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Information Technology
@@ -62,6 +63,12 @@ Requires-Dist: selectolax>=0.3; extra == 'codegen'
 Requires-Dist: trafilatura>=1.9; extra == 'codegen'
 Description-Content-Type: text/markdown
 
+<p align="center">
+  <a href="https://www.qualys.com/">
+    <img src="https://ik.imagekit.io/qualys/image/logo/qualys-vertical-sans-tagline-social.png?tr=w-360" width="360" alt="Qualys" />
+  </a>
+</p>
+
 # qualys-cli
 
 [![PyPI](https://img.shields.io/pypi/v/qualys-cli.svg)](https://pypi.org/project/qualys-cli/)

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/README.md

@@ -1,3 +1,9 @@
+<p align="center">
+  <a href="https://www.qualys.com/">
+    <img src="https://ik.imagekit.io/qualys/image/logo/qualys-vertical-sans-tagline-social.png?tr=w-360" width="360" alt="Qualys" />
+  </a>
+</p>
+
 # qualys-cli
 
 [![PyPI](https://img.shields.io/pypi/v/qualys-cli.svg)](https://pypi.org/project/qualys-cli/)

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/pyproject.toml

@@ -4,14 +4,35 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qualys-cli"
-version = "0.1.4"
+version = "0.1.6"
 description = "Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management)."
 readme = { file = "README.md", content-type = "text/markdown" }
 license = { file = "LICENSE" }
 requires-python = ">=3.11"
-keywords = ["qualys", "cli", "security", "vulnerability-management", "vm", "patch-management", "cspm"]
+keywords = [
+    "qualys",
+    "qualys-api",
+    "qualys-cloud-platform",
+    "cli",
+    "security",
+    "infosec",
+    "devsecops",
+    "vulnerability-management",
+    "patch-management",
+    "policy-compliance",
+    "cspm",
+    "cloud-security",
+    "container-security",
+    "web-application-scanning",
+    "attack-surface-management",
+    "asset-inventory",
+]
 authors = [
-    { name = "qualys-cli contributors" },
+    { name = "Qualys", email = "support@qualys.com" },
+]
+maintainers = [
+    { name = "Balaji Venkatesan", email = "bvenkatesan@qualys.com" },
+    { name = "Andrew Nelson", email = "anelson@qualys.com" },
 ]
 classifiers = [
     "Development Status :: 4 - Beta",

qualys_cli-0.1.6/src/qualys_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.6"

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/src/qualys_cli/audit.py

@@ -279,8 +279,27 @@ def _maybe_rotate() -> None:
 # Redaction helpers
 # ---------------------------------------------------------------------------
 
+# Defence in depth: an exact-match allowlist (``_SECRET_KEYS``) can never
+# enumerate every secret-shaped field name a future or third-party API might
+# use (``db_password``, ``newPassword``, ``adminSecret``, ``x-custom-token``,
+# …). These are unambiguous root words that we redact wherever they appear as
+# a substring of the (separator-stripped) key, even if the full key isn't in
+# the exact-match set above. Deliberately excludes short/ambiguous roots like
+# bare "auth" or "key" that would false-positive on unrelated field names
+# (e.g. "author", "keyword") — those stay covered by the exact-match set only.
+_SECRET_KEY_ROOTS = (
+    "password", "passwd", "token", "secret", "credential",
+    "passphrase", "cookie", "apikey", "privatekey", "signingkey",
+    "encryptionkey", "sshkey",
+)
+
+
 def _is_secret_key(name: str) -> bool:
-    return name.lower() in _SECRET_KEYS
+    lname = name.lower()
+    if lname in _SECRET_KEYS:
+        return True
+    compact = lname.replace("-", "").replace("_", "")
+    return any(root in compact for root in _SECRET_KEY_ROOTS)
 
 
 def _redact_value(_v: Any) -> str:

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/src/qualys_cli/auth.py

@@ -25,6 +25,7 @@ from __future__ import annotations
 
 import base64
 import json
+import random
 import threading
 import time
 
@@ -122,6 +123,64 @@ def exchange_no_cache(profile: Profile) -> str:
     return _exchange(profile, persist=False)
 
 
+_EXCHANGE_MAX_ATTEMPTS = 3
+_EXCHANGE_BACKOFF_BASE = 1.0
+_EXCHANGE_BACKOFF_CAP = 5.0
+
+
+def _exchange_with_retry(auth_base: str, profile: Profile) -> httpx.Response:
+    """POST /auth with a small retry budget for transient failures.
+
+    Unlike :class:`QualysClient.request`, this call happens outside any
+    client instance (it's the credential exchange that *bootstraps* the
+    client), so it previously had no retry/backoff at all — a single dropped
+    packet or transient 503 during login failed the whole command. Retries
+    only network errors and 5xx (never 4xx — a bad password won't fix itself
+    on retry) and only if there's budget left.
+    """
+    last_exc: Exception | None = None
+    for attempt in range(_EXCHANGE_MAX_ATTEMPTS):
+        try:
+            resp = httpx.post(
+                f"{auth_base}{_JWT_PATH}",
+                data={
+                    "username": profile.username,
+                    "password": profile.password,
+                    "token": "true",
+                },
+                headers={"X-Requested-With": "qualys-cli"},
+                timeout=30.0,
+            )
+        except httpx.RequestError as exc:
+            last_exc = exc
+            if attempt < _EXCHANGE_MAX_ATTEMPTS - 1:
+                time.sleep(_backoff(attempt))
+                continue
+            raise RuntimeError(f"JWT exchange failed (network error): {exc}") from exc
+
+        if resp.status_code >= 500 and attempt < _EXCHANGE_MAX_ATTEMPTS - 1:
+            time.sleep(_backoff(attempt))
+            continue
+
+        try:
+            resp.raise_for_status()
+        except httpx.HTTPStatusError as exc:
+            raise RuntimeError(
+                f"JWT exchange failed ({exc.response.status_code}): "
+                f"{exc.response.text[:200]}"
+            ) from exc
+        return resp
+
+    # Unreachable in practice — the loop always returns or raises — but keeps
+    # mypy happy and guards against a future refactor of the loop above.
+    raise RuntimeError(f"JWT exchange failed (network error): {last_exc}")
+
+
+def _backoff(attempt: int) -> float:
+    ceiling = min(_EXCHANGE_BACKOFF_CAP, _EXCHANGE_BACKOFF_BASE * (2 ** attempt))
+    return random.uniform(0, ceiling)
+
+
 def _exchange(profile: Profile, *, persist: bool = True) -> str:
     """Perform a credential exchange under a per-profile lock.
 
@@ -154,27 +213,7 @@ def _exchange(profile: Profile, *, persist: bool = True) -> str:
             "[dim]exchanging credentials with Qualys[/dim]",
             spinner="dots",
         ):
-            try:
-                resp = httpx.post(
-                    f"{auth_base}{_JWT_PATH}",
-                    data={
-                        "username": profile.username,
-                        "password": profile.password,
-                        "token": "true",
-                    },
-                    headers={"X-Requested-With": "qualys-cli"},
-                    timeout=30.0,
-                )
-                resp.raise_for_status()
-            except httpx.HTTPStatusError as exc:
-                raise RuntimeError(
-                    f"JWT exchange failed ({exc.response.status_code}): "
-                    f"{exc.response.text[:200]}"
-                ) from exc
-            except httpx.RequestError as exc:
-                raise RuntimeError(
-                    f"JWT exchange failed (network error): {exc}"
-                ) from exc
+            resp = _exchange_with_retry(auth_base, profile)
 
         token = resp.text.strip()
         if persist:

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/src/qualys_cli/cache.py

@@ -16,6 +16,9 @@ Design constraints:
   the file. ``QUALYS_CACHE_TTL`` caps fall-back age when the upstream returns
   no validators.
 - Cache misses degrade silently to a fresh request — never break a command.
+- Bounded size: ``put()`` evicts the oldest entries once the row count passes
+  ``QUALYS_CACHE_MAX_ROWS`` (default 2000) so long-lived hosts don't grow
+  ``cache.sqlite`` without limit.
 """
 
 from __future__ import annotations
@@ -31,6 +34,12 @@ from .config import CACHE_DIR
 _DEFAULT_PATH = CACHE_DIR / "cache.sqlite"
 _DEFAULT_TTL_SECONDS = 24 * 60 * 60  # 24 h fallback when no validators
 
+# Nothing ever expired entries before — a long-lived host hitting many
+# distinct catalog endpoints would grow cache.sqlite indefinitely. Cap the
+# row count and evict the oldest entries (by `ts`) once `put()` pushes past
+# it. Override via QUALYS_CACHE_MAX_ROWS.
+_DEFAULT_MAX_ROWS = 2000
+
 
 def _path() -> Path | None:
     raw = os.environ.get("QUALYS_CACHE", "").strip()
@@ -93,6 +102,13 @@ def get(key: str) -> tuple[bytes, str, str, int, int] | None:
         conn.close()
 
 
+def _max_rows() -> int:
+    raw = os.environ.get("QUALYS_CACHE_MAX_ROWS", "").strip()
+    if raw.isdigit() and int(raw) > 0:
+        return int(raw)
+    return _DEFAULT_MAX_ROWS
+
+
 def put(key: str, body: bytes, etag: str, modified: str, status: int) -> None:
     conn = _connect()
     if conn is None:
@@ -103,6 +119,16 @@ def put(key: str, body: bytes, etag: str, modified: str, status: int) -> None:
             "VALUES (?, ?, ?, ?, ?, ?)",
             (key, etag, modified, int(time.time()), body, int(status)),
         )
+        max_rows = _max_rows()
+        cur = conn.execute("SELECT COUNT(*) FROM cache")
+        total = cur.fetchone()[0]
+        if total > max_rows:
+            conn.execute(
+                "DELETE FROM cache WHERE key IN ("
+                "  SELECT key FROM cache ORDER BY ts ASC LIMIT ?"
+                ")",
+                (total - max_rows,),
+            )
     finally:
         conn.close()
 

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/src/qualys_cli/cli.py

@@ -207,7 +207,7 @@ _NO_AUTH_CMDS = {
     "configure", "profiles", "help", "mode",
     # Local-only utility commands that don't need credentials to be useful
     "stats", "verify-audit", "last", "replay", "completion", "cache",
-    "query", "batch", "watch",
+    "query", "batch", "watch", "docs",
 }
 
 
@@ -1015,7 +1015,7 @@ def _build_post_options() -> list[Any]:
         _click.Option(
             ["--where"], type=str, default=None, expose_value=False,
             callback=_cb("where"),
-            help="Filter rows (ops: =, !=, ~, >=, >, <=, <). See docs/usage.html.",
+            help="Filter rows (ops: =, !=, ~, >=, >, <=, <). See `qualys-cli docs`.",
         ),
         _click.Option(
             ["--columns"], type=str, default=None, expose_value=False,

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/src/qualys_cli/client.py

@@ -480,6 +480,40 @@ class QualysClient:
                 expand=False,
             ))
 
+    # ------------------------------------------------------------------
+    # Body-capped send
+    # ------------------------------------------------------------------
+
+    def _send(self, method: str, path: str, **kwargs: Any) -> httpx.Response:
+        """Send one HTTP attempt, enforcing ``body_limit`` without fully
+        buffering an oversized response first.
+
+        ``httpx.Client.request()`` always reads the entire body into memory
+        before returning. That made the previous body-size guard (checked via
+        ``len(resp.content)`` after the call) purely cosmetic: a 2 GB response
+        was already fully resident in memory by the time we could reject it.
+        When a cap is configured we instead stream the response and abort as
+        soon as the cumulative size exceeds the cap, so the guard actually
+        bounds memory use.
+        """
+        if self.body_limit <= 0:
+            return self._http.request(method, path, **kwargs)
+
+        req = self._http.build_request(method, path, **kwargs)
+        resp = self._http.send(req, stream=True)
+        buf = bytearray()
+        try:
+            for chunk in resp.iter_bytes():
+                buf.extend(chunk)
+                if len(buf) > self.body_limit:
+                    break
+        finally:
+            resp.close()
+        # Mirrors httpx.Response.read()'s own caching behaviour so downstream
+        # .content / .text / .json() keep working on the buffered bytes.
+        resp._content = bytes(buf)  # noqa: SLF001 — no public API for this
+        return resp
+
     # ------------------------------------------------------------------
     # Core request
     # ------------------------------------------------------------------
@@ -548,7 +582,7 @@ class QualysClient:
             while attempt < self.max_retries:
                 attempts_made = attempt + 1
                 try:
-                    resp = self._http.request(method, path, **kwargs)
+                    resp = self._send(method, path, **kwargs)
                 except httpx.RequestError as exc:
                     last_exc = exc
                     resp = None
@@ -840,9 +874,24 @@ class QualysClient:
 
         Use when total page count is known up-front (e.g. after one cheap GET
         that returns ``totalCount``). Output is in deterministic page order.
+
+        ``page_count`` is typically derived from a server-reported
+        ``totalCount`` / ``totalCount / page_size``. A misbehaving or
+        malicious upstream inflating that count would otherwise make this
+        method dispatch an unbounded number of concurrent GETs. Refuse to
+        proceed past a sane ceiling (override via
+        ``QUALYS_MAX_PARALLEL_PAGES`` for legitimately huge datasets).
         """
         import concurrent.futures as _f
 
+        max_pages = _env_int("QUALYS_MAX_PARALLEL_PAGES", 10_000, minimum=1)
+        if page_count > max_pages:
+            raise ValueError(
+                f"page_count={page_count} exceeds the safety ceiling of "
+                f"{max_pages} pages. If this is a legitimately large "
+                f"dataset, raise it via QUALYS_MAX_PARALLEL_PAGES."
+            )
+
         def _one(page: int) -> Any:
             p = dict(params or {})
             p[size_param] = page_size
@@ -1017,7 +1066,15 @@ def _extract_error(resp: httpx.Response) -> str:
         return resp.text[:300]
 
 
-def _qualys_next_url(data: dict[str, Any]) -> str:
+_MAX_NEXT_URL_DEPTH = 25
+
+
+def _qualys_next_url(data: dict[str, Any], *, _depth: int = 0) -> str:
+    # Defensive depth cap: `data` is a parsed XML response from the network
+    # (or a MITM without a trusted CA). An adversarially deep/cyclic
+    # structure should not be able to blow the Python call stack here.
+    if _depth > _MAX_NEXT_URL_DEPTH:
+        return ""
     for v in data.values():
         if isinstance(v, dict):
             resp = v.get("RESPONSE", v)
@@ -1026,7 +1083,7 @@ def _qualys_next_url(data: dict[str, Any]) -> str:
                 url = warning.get("URL", "")
                 if url:
                     return str(url)
-            deeper = _qualys_next_url(v)
+            deeper = _qualys_next_url(v, _depth=_depth + 1)
             if deeper:
                 return deeper
     return ""

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/src/qualys_cli/commands/sub.py

@@ -20,7 +20,7 @@ from pathlib import Path
 import typer
 
 from .. import client as _c
-from ..formatters import guard_output_file, output, output_success
+from ..formatters import _restrict_permissions, guard_output_file, output, output_success
 
 app = typer.Typer(
     name="sub",
@@ -76,7 +76,9 @@ def sub_export(
     if output_file:
         guard_output_file()
         resp = client.request("GET", _BASE, params={"action": "export"})
-        Path(output_file).write_bytes(resp.content)
+        out_path = Path(output_file)
+        out_path.write_bytes(resp.content)
+        _restrict_permissions(out_path)
         output_success(f"Subscription config exported to {output_file} ({len(resp.content):,} bytes)")
     else:
         data = client.get_xml(_BASE, params={"action": "export"})
@@ -136,7 +138,9 @@ def user_prefs_export(
         "GET", _PREFS,
         params={"action": "export", "user_id": user_id},
     )
-    Path(output_file).write_bytes(resp.content)
+    out_path = Path(output_file)
+    out_path.write_bytes(resp.content)
+    _restrict_permissions(out_path)
     output_success(f"User preferences exported to {output_file} ({len(resp.content):,} bytes)")
 
 

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/src/qualys_cli/extras.py

@@ -47,7 +47,7 @@ from . import config as _cfg
 from . import history as _history
 from . import metrics as _metrics
 from . import queries as _queries
-from .formatters import output, output_success
+from .formatters import _restrict_permissions, output, output_success
 
 _err = Console(stderr=True)
 
@@ -427,9 +427,22 @@ def batch(
             if not r["ok"] and not continue_on_error:
                 break
     else:
+        # Mirror the sequential path's fail-fast behaviour: without this,
+        # --parallel always ran every item to completion regardless of
+        # --continue-on-error, silently diverging from --parallel 1's
+        # documented stop-on-first-failure default. Already-running workers
+        # can't be interrupted, but not-yet-started ones are cancelled.
         with _f.ThreadPoolExecutor(max_workers=parallel) as ex:
-            for r in ex.map(run_one, items):
-                results.append(r)
+            futures = {ex.submit(run_one, it): idx for idx, it in enumerate(items)}
+            by_idx: dict[int, dict[str, Any]] = {}
+            for fut in _f.as_completed(futures):
+                r = fut.result()
+                by_idx[futures[fut]] = r
+                if not r["ok"] and not continue_on_error:
+                    for pending in futures:
+                        pending.cancel()
+                    break
+            results = [by_idx[i] for i in sorted(by_idx)]
 
     payload = {"profile": profile, "results": results}
     if output_file:
@@ -437,6 +450,7 @@ def batch(
         try:
             out_path.parent.mkdir(parents=True, exist_ok=True)
             out_path.write_text(_json.dumps(payload, indent=2, default=str))
+            _restrict_permissions(out_path)
         except OSError as exc:
             _err.print(f"[bold red]✗[/bold red] Could not write {output_file}: {exc}")
             raise typer.Exit(1) from exc

{qualys_cli-0.1.4 → qualys_cli-0.1.6}/src/qualys_cli/formatters.py

@@ -39,6 +39,7 @@ The jq expression accepts:
 
 from __future__ import annotations
 
+import contextlib
 import csv
 import io
 import json
@@ -458,6 +459,13 @@ def _apply_where(rows: list[dict[str, Any]], where: str | None) -> list[dict[str
     op = m.group(1)
     value = expr[m.end():].strip()
     if op == "~":
+        if not _is_safe_regex(value):
+            output_warn(
+                f"Rejected --where pattern {value!r} — looks like it could "
+                "cause catastrophic backtracking (nested quantifiers). "
+                "Simplify the pattern or pipe through real `jq`/`grep` instead."
+            )
+            return rows
         try:
             rx = re.compile(value, re.IGNORECASE)
         except re.error:
@@ -466,6 +474,24 @@ def _apply_where(rows: list[dict[str, Any]], where: str | None) -> list[dict[str
     return [r for r in rows if _compare(_row_get_ci(r, field), value, op)]
 
 
+# Saved queries (``qualys-cli query save/run``) can be authored by one team
+# member and executed by another, so a ``--where field~regex`` predicate is
+# not purely self-inflicted the way an ad-hoc CLI flag would be. re.compile
+# has no built-in timeout, so we reject a couple of the classic
+# catastrophic-backtracking shapes outright rather than let an evil/careless
+# regex hang the process indefinitely. This is a heuristic, not a proof —
+# it blocks the well-known nested-quantifier family, not every possible
+# pathological pattern.
+_MAX_WHERE_REGEX_LEN = 200
+_REDOS_NESTED_QUANTIFIER_RE = re.compile(r"\([^()]*[+*][^()]*\)[+*?]")
+
+
+def _is_safe_regex(pattern: str) -> bool:
+    if len(pattern) > _MAX_WHERE_REGEX_LEN:
+        return False
+    return not _REDOS_NESTED_QUANTIFIER_RE.search(pattern)
+
+
 def _apply_sort(rows: list[dict[str, Any]], sort: str | None) -> list[dict[str, Any]]:
     if not sort:
         return rows
@@ -894,3 +920,17 @@ def _dump_file(data: Any, path: str) -> None:
                 fh.write("\n")
     else:
         p.write_text(json.dumps(data, indent=2, default=str))
+    _restrict_permissions(p)
+
+
+def _restrict_permissions(p: Path) -> None:
+    """Tighten a freshly-written export file to owner-only (``0600``).
+
+    ``--output-file`` exports can contain vulnerability findings, subscription
+    config, or other sensitive Qualys data. Without this, the file lands at
+    the process umask (often world- or group-readable). Best-effort — chmod
+    is unsupported/unnecessary on some platforms (Windows), so failures are
+    swallowed rather than breaking the export.
+    """
+    with contextlib.suppress(OSError, NotImplementedError):
+        p.chmod(0o600)