qualys-cli 0.3.1__tar.gz → 0.3.2__tar.gz

{qualys_cli-0.3.1 → qualys_cli-0.3.2}/CHANGELOG.md

@@ -6,6 +6,47 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.3.2] — 2026-11-11
+
+### Fixed
+- `vm kb kev-qids` (and `vm host detection-stats --kev`) never completed:
+  200-CVE knowledge-base chunks exceeded the 60 s read timeout on every
+  retry. Default chunk is now 50 (`QUALYS_KEV_CVE_CHUNK` still overrides;
+  values < 1 are clamped). Full CISA catalog resolves in ~2 minutes.
+- `cs sensor get` help said "Sensor UUID", but the API only accepts the
+  short `sensorId` from `cs sensor list`; the `uuid` returns HTTP 404. Help
+  and docstring corrected (the argument and request are unchanged).
+- HTTP 403 now renders as **Permission Denied** with "ask a Qualys
+  administrator" guidance instead of "Authentication Failed — run
+  `qualys-cli configure`", which could not fix a missing role or module.
+  Exit code (3) and the agentic `"type": "auth_error"` tag are unchanged;
+  the new `PermissionDeniedError` subclasses `AuthError`.
+- The request spinner animated into pipes when the profile's output mode is
+  `interactive` (forced terminal rendering), burying error messages for
+  callers that capture stderr (e.g. the MCP server). It now only runs when
+  stderr is a real TTY.
+- 5xx responses with an empty body no longer produce an empty error message.
+
+### Security
+- XML injection (CWE-91): user-supplied values (names, comments, tag names,
+  filter values, IDs) were interpolated raw into WAS and Cloud Agent
+  `ServiceRequest` XML bodies, so a value like `x</name><evil/>` could add
+  elements to the request. All values are now escaped (`_x()`), and CDATA
+  sections split embedded `]]>` so they cannot be broken out of (`_cdata()`).
+- Query-string injection: `ca agent ... --module`, `ca scan launch-ods
+  --scan-type`, and `csam report download` report names are URL-encoded, so
+  a value containing `&` can no longer append extra API parameters.
+- `--dry-run` / `--explain` output redacted secrets in JSON bodies only; XML
+  and form-encoded string bodies are now redacted too (`<password>`,
+  `<clientSecret>`, `password=…`).
+- `commands/was.py` is now marked hand-edited so `generate_commands.py`
+  cannot regenerate it and silently drop the escaping.
+
+### Docs
+- `csam asset sn-export` documents a known issue: the route returns HTTP 404
+  on US2 for all three paths in Qualys's docs; likely requires the
+  ServiceNow/CMDB integration.
+
 ## [0.3.1] — 2026-11-04
 
 ### Fixed

{qualys_cli-0.3.1 → qualys_cli-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: qualys-cli
-Version: 0.3.1
+Version: 0.3.2
 Summary: Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management).
 Project-URL: Homepage, https://www.qualys.com
 Author-email: Qualys <support@qualys.com>

{qualys_cli-0.3.1 → qualys_cli-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qualys-cli"
-version = "0.3.1"
+version = "0.3.2"
 description = "Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management)."
 readme = { file = "README.md", content-type = "text/markdown" }
 license = { file = "LICENSE" }

qualys_cli-0.3.2/src/qualys_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.2"