rocketflag 0.2.0__tar.gz → 0.2.1__tar.gz

{rocketflag-0.2.0/src/rocketflag.egg-info → rocketflag-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rocketflag
-Version: 0.2.0
+Version: 0.2.1
 Summary: Python SDK of the RocketFlag Service
 Author: RocketFlag Developers
 License: MIT

{rocketflag-0.2.0 → rocketflag-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rocketflag"
-version = "0.2.0"
+version = "0.2.1"
 description = "Python SDK of the RocketFlag Service"
 readme = "README.md"
 license = { text = "MIT" }

{rocketflag-0.2.0 → rocketflag-0.2.1}/src/rocketflag/__init__.py

@@ -27,4 +27,4 @@ __all__ = [
     "create_client",
 ]
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{rocketflag-0.2.0 → rocketflag-0.2.1}/src/rocketflag/client.py

@@ -24,6 +24,8 @@ from .errors import APIError, InvalidResponseError, NetworkError
 DEFAULT_API_URL = "https://api.rocketflag.app"
 DEFAULT_VERSION = "v1"
 DEFAULT_MAX_CACHE_ENTRIES = 10_000
+DEFAULT_TIMEOUT_SECONDS = 10.0
+MAX_RESPONSE_BYTES = 1_048_576
 _ENV_NAME = re.compile(r"[A-Za-z0-9_-]+")
 
 ContextValue = Union[str, int, float, bool]
@@ -83,17 +85,24 @@ class Client:
         *,
         ttl_seconds: Optional[float] = None,
         max_entries: int = DEFAULT_MAX_CACHE_ENTRIES,
+        timeout_seconds: float = DEFAULT_TIMEOUT_SECONDS,
         opener: Optional[urllib.request.OpenerDirector] = None,
     ) -> None:
         if isinstance(max_entries, bool) or not isinstance(max_entries, int) or max_entries < 1:
             raise ValueError("max_entries must be a positive integer")
-        self.version = version
-        self.api_url = api_url.rstrip("/")
+        cleaned_url = api_url.rstrip("/")
+        parsed_url = urllib.parse.urlparse(cleaned_url)
+        if parsed_url.scheme not in ("http", "https") or not parsed_url.netloc:
+            raise ValueError("api_url must use http:// or https://")
+        self.version = version.strip("/")
+        self.api_url = cleaned_url
         self._default_ttl_ms = 0.0 if ttl_seconds is None else float(ttl_seconds) * 1000.0
         self._max_entries = max_entries
+        self._timeout_seconds = float(timeout_seconds)
         # Least recently used first; a hit moves its entry to the end.
         self._cache: OrderedDict[str, tuple[Flag, float]] = OrderedDict()
         self._cache_lock = threading.Lock()
+        self._uses_default_opener = opener is None
         self._opener = opener or urllib.request.build_opener()
 
     def get_flag(
@@ -107,6 +116,8 @@ class Client:
             raise ValueError("flagId is required")
         if not isinstance(flag_id, str):
             raise TypeError("flagId must be a string")
+        if flag_id in (".", "..") or "/" in flag_id or "\\" in flag_id:
+            raise ValueError("flagId must not contain path separators or relative segments")
 
         context: UserContext = user_context or {}
         if not isinstance(context, Mapping):
@@ -132,12 +143,22 @@ class Client:
 
         request = urllib.request.Request(url, method="GET")
         try:
-            with self._opener.open(request) as response:
+            open_ctx = (
+                self._opener.open(request, timeout=self._timeout_seconds)
+                if self._uses_default_opener
+                else self._opener.open(request)
+            )
+            with open_ctx as response:
                 status = getattr(response, "status", None) or response.getcode()
                 if status != 200:
                     status_text = getattr(response, "reason", "") or ""
                     raise APIError(f"API request failed with status {status}", status, status_text)
-                raw = response.read()
+                try:
+                    raw = response.read(MAX_RESPONSE_BYTES + 1)
+                except TypeError:
+                    raw = response.read()
+                if len(raw) > MAX_RESPONSE_BYTES:
+                    raise InvalidResponseError("Response body exceeds maximum size")
         except APIError:
             raise
         except urllib.error.HTTPError as exc:

{rocketflag-0.2.0 → rocketflag-0.2.1/src/rocketflag.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rocketflag
-Version: 0.2.0
+Version: 0.2.1
 Summary: Python SDK of the RocketFlag Service
 Author: RocketFlag Developers
 License: MIT

{rocketflag-0.2.0 → rocketflag-0.2.1}/tests/test_client.py

@@ -264,3 +264,19 @@ def test_network_error():
     client = create_client(api_url="http://127.0.0.1:1")
     with pytest.raises(NetworkError):
         client.get_flag("abc123")
+
+
+@pytest.mark.parametrize("bad_id", [".", "..", "../admin", "a/b", "a\\b"])
+def test_rejects_traversal_and_slash_flag_ids(bad_id):
+    opener = StubOpener()
+    client = Client(opener=opener)
+    with pytest.raises(ValueError, match="flagId must not contain path separators or relative segments"):
+        client.get_flag(bad_id)
+    assert opener.urls == []
+
+
+@pytest.mark.parametrize("bad_url", ["file:///etc/passwd", "ftp://example.com", "javascript:alert(1)"])
+def test_rejects_non_http_api_urls(bad_url):
+    with pytest.raises(ValueError, match="api_url must use http:// or https://"):
+        Client(api_url=bad_url)
+