qualys-cli 0.1.5__tar.gz → 0.1.7__tar.gz

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/CHANGELOG.md

@@ -6,6 +6,72 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.7] — 2026-07-17
+
+### Fixed
+- `--dry-run` / `--explain` now renders JSON **array** request bodies instead
+  of dropping them to `null`. Commands that send a bare JSON array — e.g.
+  `etm report bulk-delete`, which `DELETE`s `/reports` with a raw
+  `["id", …]` body — previously showed `"body": null` in the explain output.
+  Because that JSON is the documented contract parsed by the `mcp`, `serve`,
+  and `batch` consumers, the actual payload was invisible to them and to
+  anyone auditing a request before sending it. Array bodies are now shown
+  (and secret-redacted) in both the human panel and the machine-readable JSON.
+
+## [0.1.6] — 2026-07-17
+
+### Security
+- `qualys-cli serve`'s local HTTP server now runs on `ThreadingHTTPServer`
+  (was single-threaded — one slow client blocked every other caller), enforces
+  a request body-size cap with a safe `Content-Length` parse (413/400 instead
+  of an unhandled exception on a bad header), and sets a socket timeout so a
+  half-open connection can't hang a worker indefinitely.
+- The response body-size guard (`QUALYS_BODY_LIMIT_BYTES`) now actually bounds
+  memory use: responses are streamed and the read aborts as soon as the cap is
+  exceeded, instead of always fully buffering the body first and rejecting it
+  only after the fact.
+- `qualys-cli mcp`'s `tools/call` now rejects tool names that aren't in the
+  built catalog before shelling out, and bounds how much of a single stdin
+  line it will buffer (a pathological/misbehaving client could previously
+  make it buffer an unbounded amount of memory).
+- `--where field~regex` now rejects patterns with classic catastrophic-
+  backtracking shapes (nested quantifiers) before compiling — relevant
+  because saved queries (`qualys-cli query save/run`) can be authored by one
+  team member and run by another.
+- `--output-file` exports (`sub export`, `sub user-prefs export`, generic
+  `--output-file`, `batch --output-file`) are now written with `0600`
+  permissions instead of the process umask default, consistent with every
+  other sensitive artifact the CLI writes (config, audit log, cache, history).
+- Audit-log secret redaction now also catches secret-shaped field names beyond
+  the exact-match list (e.g. `db_password`, `adminSecret`, `x-custom-token`),
+  not just the ~29 literal key names it recognised before.
+
+### Fixed
+- `qualys-cli docs` no longer triggers the first-run credential-setup wizard
+  or scope-restriction checks — it never talks to the Qualys API and doesn't
+  need a profile.
+- Stale `--where` help text pointing at a removed `docs/usage.html` path now
+  points at `qualys-cli docs`.
+- `batch --parallel` now stops on first failure and respects
+  `--continue-on-error` the same way `--parallel 1` always did; previously
+  `--parallel` silently ran every command to completion regardless of the
+  flag.
+
+### Changed
+- JWT credential exchange (`/auth`) now retries transient network errors and
+  5xx responses with backoff (never 4xx — a bad password won't fix itself on
+  retry). Previously a single dropped packet during login failed the whole
+  command with no retry at all.
+- `paginate_json_parallel` refuses to dispatch more than
+  `QUALYS_MAX_PARALLEL_PAGES` (default 10,000) concurrent page fetches, so a
+  bad/inflated `totalCount` from upstream can't fan out an unbounded number of
+  requests.
+- The on-disk response cache (`cache.sqlite`) now evicts its oldest entries
+  once the row count passes `QUALYS_CACHE_MAX_ROWS` (default 2000) instead of
+  growing without bound on long-lived hosts.
+- Added a recursion depth cap to the internal Qualys pagination-URL walker as
+  a defensive measure against adversarial/malformed XML responses.
+
 ## [0.1.5] — 2026-07-08
 
 ### Changed
@@ -163,7 +229,8 @@ Initial public release.
 - Ruff lint clean (E, F, I, UP, B, C4, SIM rule sets).
 - Codegen pipeline (`scripts/`) is opt-in via the `codegen` extra.
 
-[Unreleased]: https://github.com/qualys/qualys-cli/compare/v0.1.5...HEAD
+[Unreleased]: https://github.com/qualys/qualys-cli/compare/v0.1.6...HEAD
+[0.1.6]: https://github.com/qualys/qualys-cli/compare/v0.1.5...v0.1.6
 [0.1.5]: https://github.com/qualys/qualys-cli/compare/v0.1.4...v0.1.5
 [0.1.4]: https://github.com/qualys/qualys-cli/compare/v0.1.2...v0.1.4
 [0.1.2]: https://github.com/qualys/qualys-cli/compare/v0.1.1...v0.1.2

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qualys-cli
-Version: 0.1.5
+Version: 0.1.7
 Summary: Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management).
 Project-URL: Homepage, https://www.qualys.com
 Author-email: Qualys <support@qualys.com>

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qualys-cli"
-version = "0.1.5"
+version = "0.1.7"
 description = "Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management)."
 readme = { file = "README.md", content-type = "text/markdown" }
 license = { file = "LICENSE" }

qualys_cli-0.1.7/src/qualys_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.7"

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/src/qualys_cli/_docs/usage.html

@@ -612,7 +612,7 @@ body.filtering.no-match section.module{display:none}
 <aside class="sidebar" aria-label="Documentation navigation">
   <div class="side-header">
     <img src="https://ik.imagekit.io/qualys/image/logo/qualys.svg" alt="Qualys">
-    <span class="ver">v0.1.3</span>
+    <span class="ver">v0.1.7</span>
   </div>
   <div class="side-search">
     <input type="search" id="filter" placeholder="Search commands…"
@@ -696,7 +696,7 @@ body.filtering.no-match section.module{display:none}
     <div class="hero-stats">
       <div class="hero-stat"><span class="n">28</span><span class="l">Modules</span></div>
       <div class="hero-stat"><span class="n">228</span><span class="l">Commands</span></div>
-      <div class="hero-stat"><span class="n">v0.1.3</span><span class="l">Version</span></div>
+      <div class="hero-stat"><span class="n">v0.1.7</span><span class="l">Version</span></div>
       <div class="hero-stat"><span class="n">3.12+</span><span class="l">Python</span></div>
       <div class="hero-stat"><span class="n">MIT</span><span class="l">License</span></div>
     </div>

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/src/qualys_cli/audit.py

@@ -279,8 +279,27 @@ def _maybe_rotate() -> None:
 # Redaction helpers
 # ---------------------------------------------------------------------------
 
+# Defence in depth: an exact-match allowlist (``_SECRET_KEYS``) can never
+# enumerate every secret-shaped field name a future or third-party API might
+# use (``db_password``, ``newPassword``, ``adminSecret``, ``x-custom-token``,
+# …). These are unambiguous root words that we redact wherever they appear as
+# a substring of the (separator-stripped) key, even if the full key isn't in
+# the exact-match set above. Deliberately excludes short/ambiguous roots like
+# bare "auth" or "key" that would false-positive on unrelated field names
+# (e.g. "author", "keyword") — those stay covered by the exact-match set only.
+_SECRET_KEY_ROOTS = (
+    "password", "passwd", "token", "secret", "credential",
+    "passphrase", "cookie", "apikey", "privatekey", "signingkey",
+    "encryptionkey", "sshkey",
+)
+
+
 def _is_secret_key(name: str) -> bool:
-    return name.lower() in _SECRET_KEYS
+    lname = name.lower()
+    if lname in _SECRET_KEYS:
+        return True
+    compact = lname.replace("-", "").replace("_", "")
+    return any(root in compact for root in _SECRET_KEY_ROOTS)
 
 
 def _redact_value(_v: Any) -> str:

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/src/qualys_cli/auth.py

@@ -25,6 +25,7 @@ from __future__ import annotations
 
 import base64
 import json
+import random
 import threading
 import time
 
@@ -122,6 +123,64 @@ def exchange_no_cache(profile: Profile) -> str:
     return _exchange(profile, persist=False)
 
 
+_EXCHANGE_MAX_ATTEMPTS = 3
+_EXCHANGE_BACKOFF_BASE = 1.0
+_EXCHANGE_BACKOFF_CAP = 5.0
+
+
+def _exchange_with_retry(auth_base: str, profile: Profile) -> httpx.Response:
+    """POST /auth with a small retry budget for transient failures.
+
+    Unlike :class:`QualysClient.request`, this call happens outside any
+    client instance (it's the credential exchange that *bootstraps* the
+    client), so it previously had no retry/backoff at all — a single dropped
+    packet or transient 503 during login failed the whole command. Retries
+    only network errors and 5xx (never 4xx — a bad password won't fix itself
+    on retry) and only if there's budget left.
+    """
+    last_exc: Exception | None = None
+    for attempt in range(_EXCHANGE_MAX_ATTEMPTS):
+        try:
+            resp = httpx.post(
+                f"{auth_base}{_JWT_PATH}",
+                data={
+                    "username": profile.username,
+                    "password": profile.password,
+                    "token": "true",
+                },
+                headers={"X-Requested-With": "qualys-cli"},
+                timeout=30.0,
+            )
+        except httpx.RequestError as exc:
+            last_exc = exc
+            if attempt < _EXCHANGE_MAX_ATTEMPTS - 1:
+                time.sleep(_backoff(attempt))
+                continue
+            raise RuntimeError(f"JWT exchange failed (network error): {exc}") from exc
+
+        if resp.status_code >= 500 and attempt < _EXCHANGE_MAX_ATTEMPTS - 1:
+            time.sleep(_backoff(attempt))
+            continue
+
+        try:
+            resp.raise_for_status()
+        except httpx.HTTPStatusError as exc:
+            raise RuntimeError(
+                f"JWT exchange failed ({exc.response.status_code}): "
+                f"{exc.response.text[:200]}"
+            ) from exc
+        return resp
+
+    # Unreachable in practice — the loop always returns or raises — but keeps
+    # mypy happy and guards against a future refactor of the loop above.
+    raise RuntimeError(f"JWT exchange failed (network error): {last_exc}")
+
+
+def _backoff(attempt: int) -> float:
+    ceiling = min(_EXCHANGE_BACKOFF_CAP, _EXCHANGE_BACKOFF_BASE * (2 ** attempt))
+    return random.uniform(0, ceiling)
+
+
 def _exchange(profile: Profile, *, persist: bool = True) -> str:
     """Perform a credential exchange under a per-profile lock.
 
@@ -154,27 +213,7 @@ def _exchange(profile: Profile, *, persist: bool = True) -> str:
             "[dim]exchanging credentials with Qualys[/dim]",
             spinner="dots",
         ):
-            try:
-                resp = httpx.post(
-                    f"{auth_base}{_JWT_PATH}",
-                    data={
-                        "username": profile.username,
-                        "password": profile.password,
-                        "token": "true",
-                    },
-                    headers={"X-Requested-With": "qualys-cli"},
-                    timeout=30.0,
-                )
-                resp.raise_for_status()
-            except httpx.HTTPStatusError as exc:
-                raise RuntimeError(
-                    f"JWT exchange failed ({exc.response.status_code}): "
-                    f"{exc.response.text[:200]}"
-                ) from exc
-            except httpx.RequestError as exc:
-                raise RuntimeError(
-                    f"JWT exchange failed (network error): {exc}"
-                ) from exc
+            resp = _exchange_with_retry(auth_base, profile)
 
         token = resp.text.strip()
         if persist:

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/src/qualys_cli/cache.py

@@ -16,6 +16,9 @@ Design constraints:
   the file. ``QUALYS_CACHE_TTL`` caps fall-back age when the upstream returns
   no validators.
 - Cache misses degrade silently to a fresh request — never break a command.
+- Bounded size: ``put()`` evicts the oldest entries once the row count passes
+  ``QUALYS_CACHE_MAX_ROWS`` (default 2000) so long-lived hosts don't grow
+  ``cache.sqlite`` without limit.
 """
 
 from __future__ import annotations
@@ -31,6 +34,12 @@ from .config import CACHE_DIR
 _DEFAULT_PATH = CACHE_DIR / "cache.sqlite"
 _DEFAULT_TTL_SECONDS = 24 * 60 * 60  # 24 h fallback when no validators
 
+# Nothing ever expired entries before — a long-lived host hitting many
+# distinct catalog endpoints would grow cache.sqlite indefinitely. Cap the
+# row count and evict the oldest entries (by `ts`) once `put()` pushes past
+# it. Override via QUALYS_CACHE_MAX_ROWS.
+_DEFAULT_MAX_ROWS = 2000
+
 
 def _path() -> Path | None:
     raw = os.environ.get("QUALYS_CACHE", "").strip()
@@ -93,6 +102,13 @@ def get(key: str) -> tuple[bytes, str, str, int, int] | None:
         conn.close()
 
 
+def _max_rows() -> int:
+    raw = os.environ.get("QUALYS_CACHE_MAX_ROWS", "").strip()
+    if raw.isdigit() and int(raw) > 0:
+        return int(raw)
+    return _DEFAULT_MAX_ROWS
+
+
 def put(key: str, body: bytes, etag: str, modified: str, status: int) -> None:
     conn = _connect()
     if conn is None:
@@ -103,6 +119,16 @@ def put(key: str, body: bytes, etag: str, modified: str, status: int) -> None:
             "VALUES (?, ?, ?, ?, ?, ?)",
             (key, etag, modified, int(time.time()), body, int(status)),
         )
+        max_rows = _max_rows()
+        cur = conn.execute("SELECT COUNT(*) FROM cache")
+        total = cur.fetchone()[0]
+        if total > max_rows:
+            conn.execute(
+                "DELETE FROM cache WHERE key IN ("
+                "  SELECT key FROM cache ORDER BY ts ASC LIMIT ?"
+                ")",
+                (total - max_rows,),
+            )
     finally:
         conn.close()
 

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/src/qualys_cli/cli.py

@@ -207,7 +207,7 @@ _NO_AUTH_CMDS = {
     "configure", "profiles", "help", "mode",
     # Local-only utility commands that don't need credentials to be useful
     "stats", "verify-audit", "last", "replay", "completion", "cache",
-    "query", "batch", "watch",
+    "query", "batch", "watch", "docs",
 }
 
 
@@ -1015,7 +1015,7 @@ def _build_post_options() -> list[Any]:
         _click.Option(
             ["--where"], type=str, default=None, expose_value=False,
             callback=_cb("where"),
-            help="Filter rows (ops: =, !=, ~, >=, >, <=, <). See docs/usage.html.",
+            help="Filter rows (ops: =, !=, ~, >=, >, <=, <). See `qualys-cli docs`.",
         ),
         _click.Option(
             ["--columns"], type=str, default=None, expose_value=False,

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/src/qualys_cli/client.py

@@ -408,11 +408,12 @@ class QualysClient:
             url      fully-qualified request URL (profile + path)
             auth     "basic" or "jwt"
             params   query string as a JSON object (redacted)
-            body     request body normalised to a JSON object whenever
-                     possible. If the original body was a JSON string we
-                     parse it back so callers see structure, not a string.
-                     If the body is non-JSON (XML, form-encoded), it is
-                     surfaced as a string preview. ``null`` if no body.
+            body     request body normalised to a JSON value (object or
+                     array) whenever possible. If the original body was a
+                     JSON string we parse it back so callers see structure,
+                     not a string. If the body is non-JSON (XML,
+                     form-encoded), it is surfaced as a string preview.
+                     ``null`` if no body.
             headers  request headers (Authorization redacted)
 
         This contract is the public surface that MCP / serve / batch
@@ -432,7 +433,7 @@ class QualysClient:
 
         # Redact secrets in the rendered body / params
         params = _audit.redact_mapping(dict(kwargs.get("params") or {}))
-        if isinstance(body, dict):
+        if isinstance(body, (dict, list)):
             body = _audit.redact_mapping(body)
         elif isinstance(body, str):
             # Try to round-trip a string body back into a dict — ``post_xml``
@@ -457,7 +458,7 @@ class QualysClient:
         lines.append(f"[dim]auth:[/dim] {self.auth_type}")
         if params:
             lines.append(f"[dim]params:[/dim] {_json.dumps(params, default=str)}")
-        if isinstance(body, dict):
+        if isinstance(body, (dict, list)):
             lines.append(f"[dim]body:[/dim] {_json.dumps(body, default=str, indent=2)}")
         elif isinstance(body, str):
             preview = body if len(body) < 400 else body[:400] + "…"
@@ -468,7 +469,7 @@ class QualysClient:
         if not _console.is_terminal:
             payload = {
                 "method": method, "url": url, "auth": self.auth_type,
-                "params": params, "body": body if isinstance(body, (dict, str)) else None,
+                "params": params, "body": body if isinstance(body, (dict, list, str)) else None,
                 "headers": hdrs,
             }
             print(_json.dumps(payload, default=str))
@@ -480,6 +481,40 @@ class QualysClient:
                 expand=False,
             ))
 
+    # ------------------------------------------------------------------
+    # Body-capped send
+    # ------------------------------------------------------------------
+
+    def _send(self, method: str, path: str, **kwargs: Any) -> httpx.Response:
+        """Send one HTTP attempt, enforcing ``body_limit`` without fully
+        buffering an oversized response first.
+
+        ``httpx.Client.request()`` always reads the entire body into memory
+        before returning. That made the previous body-size guard (checked via
+        ``len(resp.content)`` after the call) purely cosmetic: a 2 GB response
+        was already fully resident in memory by the time we could reject it.
+        When a cap is configured we instead stream the response and abort as
+        soon as the cumulative size exceeds the cap, so the guard actually
+        bounds memory use.
+        """
+        if self.body_limit <= 0:
+            return self._http.request(method, path, **kwargs)
+
+        req = self._http.build_request(method, path, **kwargs)
+        resp = self._http.send(req, stream=True)
+        buf = bytearray()
+        try:
+            for chunk in resp.iter_bytes():
+                buf.extend(chunk)
+                if len(buf) > self.body_limit:
+                    break
+        finally:
+            resp.close()
+        # Mirrors httpx.Response.read()'s own caching behaviour so downstream
+        # .content / .text / .json() keep working on the buffered bytes.
+        resp._content = bytes(buf)  # noqa: SLF001 — no public API for this
+        return resp
+
     # ------------------------------------------------------------------
     # Core request
     # ------------------------------------------------------------------
@@ -548,7 +583,7 @@ class QualysClient:
             while attempt < self.max_retries:
                 attempts_made = attempt + 1
                 try:
-                    resp = self._http.request(method, path, **kwargs)
+                    resp = self._send(method, path, **kwargs)
                 except httpx.RequestError as exc:
                     last_exc = exc
                     resp = None
@@ -840,9 +875,24 @@ class QualysClient:
 
         Use when total page count is known up-front (e.g. after one cheap GET
         that returns ``totalCount``). Output is in deterministic page order.
+
+        ``page_count`` is typically derived from a server-reported
+        ``totalCount`` / ``totalCount / page_size``. A misbehaving or
+        malicious upstream inflating that count would otherwise make this
+        method dispatch an unbounded number of concurrent GETs. Refuse to
+        proceed past a sane ceiling (override via
+        ``QUALYS_MAX_PARALLEL_PAGES`` for legitimately huge datasets).
         """
         import concurrent.futures as _f
 
+        max_pages = _env_int("QUALYS_MAX_PARALLEL_PAGES", 10_000, minimum=1)
+        if page_count > max_pages:
+            raise ValueError(
+                f"page_count={page_count} exceeds the safety ceiling of "
+                f"{max_pages} pages. If this is a legitimately large "
+                f"dataset, raise it via QUALYS_MAX_PARALLEL_PAGES."
+            )
+
         def _one(page: int) -> Any:
             p = dict(params or {})
             p[size_param] = page_size
@@ -1017,7 +1067,15 @@ def _extract_error(resp: httpx.Response) -> str:
         return resp.text[:300]
 
 
-def _qualys_next_url(data: dict[str, Any]) -> str:
+_MAX_NEXT_URL_DEPTH = 25
+
+
+def _qualys_next_url(data: dict[str, Any], *, _depth: int = 0) -> str:
+    # Defensive depth cap: `data` is a parsed XML response from the network
+    # (or a MITM without a trusted CA). An adversarially deep/cyclic
+    # structure should not be able to blow the Python call stack here.
+    if _depth > _MAX_NEXT_URL_DEPTH:
+        return ""
     for v in data.values():
         if isinstance(v, dict):
             resp = v.get("RESPONSE", v)
@@ -1026,7 +1084,7 @@ def _qualys_next_url(data: dict[str, Any]) -> str:
                 url = warning.get("URL", "")
                 if url:
                     return str(url)
-            deeper = _qualys_next_url(v)
+            deeper = _qualys_next_url(v, _depth=_depth + 1)
             if deeper:
                 return deeper
     return ""

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/src/qualys_cli/commands/sub.py

@@ -20,7 +20,7 @@ from pathlib import Path
 import typer
 
 from .. import client as _c
-from ..formatters import guard_output_file, output, output_success
+from ..formatters import _restrict_permissions, guard_output_file, output, output_success
 
 app = typer.Typer(
     name="sub",
@@ -76,7 +76,9 @@ def sub_export(
     if output_file:
         guard_output_file()
         resp = client.request("GET", _BASE, params={"action": "export"})
-        Path(output_file).write_bytes(resp.content)
+        out_path = Path(output_file)
+        out_path.write_bytes(resp.content)
+        _restrict_permissions(out_path)
         output_success(f"Subscription config exported to {output_file} ({len(resp.content):,} bytes)")
     else:
         data = client.get_xml(_BASE, params={"action": "export"})
@@ -136,7 +138,9 @@ def user_prefs_export(
         "GET", _PREFS,
         params={"action": "export", "user_id": user_id},
     )
-    Path(output_file).write_bytes(resp.content)
+    out_path = Path(output_file)
+    out_path.write_bytes(resp.content)
+    _restrict_permissions(out_path)
     output_success(f"User preferences exported to {output_file} ({len(resp.content):,} bytes)")
 
 

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/src/qualys_cli/extras.py

@@ -47,7 +47,7 @@ from . import config as _cfg
 from . import history as _history
 from . import metrics as _metrics
 from . import queries as _queries
-from .formatters import output, output_success
+from .formatters import _restrict_permissions, output, output_success
 
 _err = Console(stderr=True)
 
@@ -427,9 +427,22 @@ def batch(
             if not r["ok"] and not continue_on_error:
                 break
     else:
+        # Mirror the sequential path's fail-fast behaviour: without this,
+        # --parallel always ran every item to completion regardless of
+        # --continue-on-error, silently diverging from --parallel 1's
+        # documented stop-on-first-failure default. Already-running workers
+        # can't be interrupted, but not-yet-started ones are cancelled.
         with _f.ThreadPoolExecutor(max_workers=parallel) as ex:
-            for r in ex.map(run_one, items):
-                results.append(r)
+            futures = {ex.submit(run_one, it): idx for idx, it in enumerate(items)}
+            by_idx: dict[int, dict[str, Any]] = {}
+            for fut in _f.as_completed(futures):
+                r = fut.result()
+                by_idx[futures[fut]] = r
+                if not r["ok"] and not continue_on_error:
+                    for pending in futures:
+                        pending.cancel()
+                    break
+            results = [by_idx[i] for i in sorted(by_idx)]
 
     payload = {"profile": profile, "results": results}
     if output_file:
@@ -437,6 +450,7 @@ def batch(
         try:
             out_path.parent.mkdir(parents=True, exist_ok=True)
             out_path.write_text(_json.dumps(payload, indent=2, default=str))
+            _restrict_permissions(out_path)
         except OSError as exc:
             _err.print(f"[bold red]✗[/bold red] Could not write {output_file}: {exc}")
             raise typer.Exit(1) from exc

{qualys_cli-0.1.5 → qualys_cli-0.1.7}/src/qualys_cli/formatters.py

@@ -39,6 +39,7 @@ The jq expression accepts:
 
 from __future__ import annotations
 
+import contextlib
 import csv
 import io
 import json
@@ -458,6 +459,13 @@ def _apply_where(rows: list[dict[str, Any]], where: str | None) -> list[dict[str
     op = m.group(1)
     value = expr[m.end():].strip()
     if op == "~":
+        if not _is_safe_regex(value):
+            output_warn(
+                f"Rejected --where pattern {value!r} — looks like it could "
+                "cause catastrophic backtracking (nested quantifiers). "
+                "Simplify the pattern or pipe through real `jq`/`grep` instead."
+            )
+            return rows
         try:
             rx = re.compile(value, re.IGNORECASE)
         except re.error:
@@ -466,6 +474,24 @@ def _apply_where(rows: list[dict[str, Any]], where: str | None) -> list[dict[str
     return [r for r in rows if _compare(_row_get_ci(r, field), value, op)]
 
 
+# Saved queries (``qualys-cli query save/run``) can be authored by one team
+# member and executed by another, so a ``--where field~regex`` predicate is
+# not purely self-inflicted the way an ad-hoc CLI flag would be. re.compile
+# has no built-in timeout, so we reject a couple of the classic
+# catastrophic-backtracking shapes outright rather than let an evil/careless
+# regex hang the process indefinitely. This is a heuristic, not a proof —
+# it blocks the well-known nested-quantifier family, not every possible
+# pathological pattern.
+_MAX_WHERE_REGEX_LEN = 200
+_REDOS_NESTED_QUANTIFIER_RE = re.compile(r"\([^()]*[+*][^()]*\)[+*?]")
+
+
+def _is_safe_regex(pattern: str) -> bool:
+    if len(pattern) > _MAX_WHERE_REGEX_LEN:
+        return False
+    return not _REDOS_NESTED_QUANTIFIER_RE.search(pattern)
+
+
 def _apply_sort(rows: list[dict[str, Any]], sort: str | None) -> list[dict[str, Any]]:
     if not sort:
         return rows
@@ -894,3 +920,17 @@ def _dump_file(data: Any, path: str) -> None:
                 fh.write("\n")
     else:
         p.write_text(json.dumps(data, indent=2, default=str))
+    _restrict_permissions(p)
+
+
+def _restrict_permissions(p: Path) -> None:
+    """Tighten a freshly-written export file to owner-only (``0600``).
+
+    ``--output-file`` exports can contain vulnerability findings, subscription
+    config, or other sensitive Qualys data. Without this, the file lands at
+    the process umask (often world- or group-readable). Best-effort — chmod
+    is unsupported/unnecessary on some platforms (Windows), so failures are
+    swallowed rather than breaking the export.
+    """
+    with contextlib.suppress(OSError, NotImplementedError):
+        p.chmod(0o600)