sddflow 3.4.2__tar.gz → 3.4.3__tar.gz

{sddflow-3.4.2 → sddflow-3.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sddflow
-Version: 3.4.2
+Version: 3.4.3
 Summary: Spec-Driven Development CLI for AI coding agents — SDLC workflows with Jira/Confluence sync, multi-host PR automation, and live progress dashboards
 Project-URL: Homepage, https://github.com/sunil1983us/sddflow
 Project-URL: Repository, https://github.com/sunil1983us/sddflow

{sddflow-3.4.2 → sddflow-3.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sddflow"
-version = "3.4.2"
+version = "3.4.3"
 description = "Spec-Driven Development CLI for AI coding agents — SDLC workflows with Jira/Confluence sync, multi-host PR automation, and live progress dashboards"
 readme = "README.md"
 requires-python = ">=3.10"

sddflow-3.4.3/sdd/__init__.py

@@ -0,0 +1 @@
+__version__ = "3.4.3"

{sddflow-3.4.2 → sddflow-3.4.3}/sdd/commands/upgrade.py

@@ -8,8 +8,8 @@ from typing import TypedDict
 import click
 from rich.console import Console
 
-from sdd.utils.manifest import MANIFEST_PATH, SDD_VERSION, patch_manifest, read_manifest
 from sdd.utils.managed_files import apply_managed_files
+from sdd.utils.manifest import MANIFEST_PATH, SDD_VERSION, patch_manifest, read_manifest
 from sdd.utils.scaffold import (
     ALL_PACKS,
     TYPE_TO_PACK,
@@ -7456,6 +7456,51 @@ MIGRATIONS: list[Migration] = [
             "own Data Center servers",
         ],
     },
+    {
+        "from": "3.4.2",
+        "to": "3.4.3",
+        "description": "Security hardening: sdd/utils/git_host.py's host "
+        "detection no longer trusts a substring match, closing a "
+        "CodeQL-flagged host-spoofing gap",
+        "notes": [
+            "parse_remote() decided which git host (github/bitbucket/"
+            "gitlab/azure) a repo's origin remote belongs to via plain "
+            "`\"github.com\" in host`-style substring checks -- CodeQL's "
+            "py/incomplete-url-substring-sanitization flagged all 5 "
+            "occurrences (github.com, bitbucket.org, gitlab, dev.azure."
+            "com, visualstudio.com): a host like notgithub.com or "
+            "github.com.evil.example contains the substring \"github."
+            "com\" without being github.com or a subdomain of it",
+            "Added _host_is(host, domain) -- exact match or subdomain "
+            "via str.endswith(f'.{domain}') -- for the four hosts that "
+            "pin to one real domain (github.com, bitbucket.org, dev."
+            "azure.com, visualstudio.com). gitlab's check stays "
+            "deliberately broader (self-hosted instances live at "
+            "arbitrary hostnames, e.g. gitlab.mycompany.internal) but "
+            "moved from an anywhere-substring check to _host_has_label"
+            "(), requiring \"gitlab\" to be a full dot/hyphen-separated "
+            "label -- closes notgitlab.io/gitlabish.io false-accepts "
+            "while still detecting gitlab.corp.io/code-gitlab.corp.io",
+            "Practical exploitability was narrow -- host comes from "
+            "the local git remote URL (`git remote get-url origin`), "
+            "which only decides which provider CLI (gh/glab/az) `sdd "
+            "pr create` shells out to, not a network-facing trust "
+            "boundary -- but the fix is free and the old behavior was "
+            "genuinely wrong regardless of exploitability",
+            "This Node CLI ships from the same pack sources -- this "
+            "migration entry exists so both CLIs report the same "
+            "sdd_version chain (the Node CLI has no PR-creation git-host "
+            "detection of its own -- scaffolding-only by design -- so "
+            "nothing here actually applies to it beyond the version "
+            "stamp)",
+            "Verified: cli-python pytest 1120/1120 (1108 unchanged + 12 "
+            "new -- 8 substring-bypass-rejection cases across all 4 "
+            "pinned hosts, 2 gitlab label-bypass-rejection cases, and 2 "
+            "confirming genuine self-hosted GitLab detection still "
+            "works); ruff check/format clean; mypy clean; bandit 0 "
+            "issues",
+        ],
+    },
 ]
 
 

{sddflow-3.4.2 → sddflow-3.4.3}/sdd/packs/sdd-backend-service/.specify/manifest.yml

@@ -44,6 +44,6 @@ testing_style: "paired"
 # If using sdd-universal instead, set project_type: "backend-service" in its manifest.yml
 # project_type: "backend-service"
 
-sdd_version: "3.4.2"   # set by sdd init; used by sdd upgrade
+sdd_version: "3.4.3"   # set by sdd init; used by sdd upgrade
 pack: "sdd-backend-service"  # static per pack -- disambiguates project_type-based pack inference (see sdd doctor / _resolve_pack); sdd init also stamps this on --pack, unchanged otherwise
 ai_tool: ""             # set by sdd init: claude-code | copilot | cursor | windsurf | other

{sddflow-3.4.2 → sddflow-3.4.3}/sdd/packs/sdd-frontend-spa/.specify/manifest.yml

@@ -33,6 +33,6 @@ testing_style: "paired"
 # If using sdd-universal instead, set project_type: "frontend-spa" in its manifest.yml
 # project_type: "frontend-spa"
 
-sdd_version: "3.4.2"   # set by sdd init; used by sdd upgrade
+sdd_version: "3.4.3"   # set by sdd init; used by sdd upgrade
 pack: "sdd-frontend-spa"  # static per pack -- disambiguates project_type-based pack inference (see sdd doctor / _resolve_pack); sdd init also stamps this on --pack, unchanged otherwise
 ai_tool: ""             # set by sdd init: claude-code | copilot | cursor | windsurf | other

{sddflow-3.4.2 → sddflow-3.4.3}/sdd/packs/sdd-fullstack/.specify/manifest.yml

@@ -33,6 +33,6 @@ testing_style: "paired"
 # If using sdd-universal instead, set project_type: "fullstack" in its manifest.yml
 # project_type: "fullstack"
 
-sdd_version: "3.4.2"   # set by sdd init; used by sdd upgrade
+sdd_version: "3.4.3"   # set by sdd init; used by sdd upgrade
 pack: "sdd-fullstack"  # static per pack -- disambiguates project_type-based pack inference (see sdd doctor / _resolve_pack); sdd init also stamps this on --pack, unchanged otherwise
 ai_tool: ""             # set by sdd init: claude-code | copilot | cursor | windsurf | other

{sddflow-3.4.2 → sddflow-3.4.3}/sdd/packs/sdd-mobile/.specify/manifest.yml

@@ -33,6 +33,6 @@ testing_style: "paired"
 # If using sdd-universal instead, set project_type: "mobile" in its manifest.yml
 # project_type: "mobile"
 
-sdd_version: "3.4.2"   # set by sdd init; used by sdd upgrade
+sdd_version: "3.4.3"   # set by sdd init; used by sdd upgrade
 pack: "sdd-mobile"  # static per pack -- disambiguates project_type-based pack inference (see sdd doctor / _resolve_pack); sdd init also stamps this on --pack, unchanged otherwise
 ai_tool: ""             # set by sdd init: claude-code | copilot | cursor | windsurf | other

{sddflow-3.4.2 → sddflow-3.4.3}/sdd/packs/sdd-universal/.specify/manifest.yml

@@ -39,6 +39,6 @@ plan_mode: "unified"
 #   bdd:    Given/When/Then specs drive tests, written before implementation
 testing_style: "paired"
 
-sdd_version: "3.4.2"   # set by sdd init; used by sdd upgrade
+sdd_version: "3.4.3"   # set by sdd init; used by sdd upgrade
 pack: "sdd-universal"  # static per pack -- disambiguates project_type-based pack inference (see sdd doctor / _resolve_pack); sdd init also stamps this on --pack, unchanged otherwise
 ai_tool: ""             # set by sdd init: claude-code | copilot | cursor | windsurf | other

{sddflow-3.4.2 → sddflow-3.4.3}/sdd/utils/git_host.py

@@ -87,6 +87,28 @@ def _split_host_path(url: str) -> tuple[str, str] | None:
     return m.group("host").lower(), m.group("path").strip("/")
 
 
+def _host_is(host: str, domain: str) -> bool:
+    """True if `host` is exactly `domain` or a subdomain of it.
+
+    A plain `domain in host` substring check is bypassable: "notgithub.com"
+    and "github.com.evil.example" both contain the substring "github.com"
+    without being github.com or a subdomain of it (CodeQL:
+    py/incomplete-url-substring-sanitization). Anchoring on the label
+    boundary the way `str.endswith` does here closes that."""
+    return host == domain or host.endswith(f".{domain}")
+
+
+def _host_has_label(host: str, label: str) -> bool:
+    """True if `label` is one of `host`'s dot/hyphen-separated components
+    exactly -- e.g. "gitlab" matches "gitlab.corp.io" and
+    "code-gitlab.corp.io" but not "notgitlab.io" or "gitlabish.io". Same
+    substring-bypass class as _host_is, but for the self-hosted GitLab
+    heuristic below, which -- unlike github.com/bitbucket.org/
+    dev.azure.com/visualstudio.com -- can't be pinned to one exact
+    domain, since self-hosted instances live at arbitrary hostnames."""
+    return label in re.split(r"[.-]", host)
+
+
 def parse_remote(url: str) -> RemoteInfo:
     """Parse a git remote URL into (host, owner, repo[, project]).
 
@@ -99,17 +121,17 @@ def parse_remote(url: str) -> RemoteInfo:
     host, path = split
     parts = [p for p in path.split("/") if p]
 
-    if "github.com" in host:
+    if _host_is(host, "github.com"):
         if len(parts) >= 2:
             return RemoteInfo(host="github", owner=parts[0], repo=parts[1])
         return RemoteInfo(host="github", owner="", repo=parts[-1] if parts else "")
 
-    if "bitbucket.org" in host:
+    if _host_is(host, "bitbucket.org"):
         if len(parts) >= 2:
             return RemoteInfo(host="bitbucket", owner=parts[0], repo=parts[1])
         return RemoteInfo(host="bitbucket", owner="", repo=parts[-1] if parts else "")
 
-    if "gitlab" in host:
+    if _host_has_label(host, "gitlab"):
         # GitLab supports nested subgroups: group/subgroup/.../repo — owner is
         # everything before the last segment (still enough to build the URL-
         # encoded project path GitLab's API expects: "group%2Fsubgroup%2Frepo").
@@ -117,12 +139,12 @@ def parse_remote(url: str) -> RemoteInfo:
             return RemoteInfo(host="gitlab", owner="/".join(parts[:-1]), repo=parts[-1])
         return RemoteInfo(host="gitlab", owner="", repo=parts[-1] if parts else "")
 
-    if "dev.azure.com" in host or "visualstudio.com" in host:
+    if _host_is(host, "dev.azure.com") or _host_is(host, "visualstudio.com"):
         # https forms:  dev.azure.com/{org}/{project}/_git/{repo}
         #               {org}.visualstudio.com/{project}/_git/{repo}
         # ssh form:     ssh.dev.azure.com:v3/{org}/{project}/{repo}
         clean = [p for p in parts if p != "_git" and p != "v3"]
-        if "visualstudio.com" in host:
+        if _host_is(host, "visualstudio.com"):
             org = host.split(".visualstudio.com")[0]
             if len(clean) >= 2:
                 return RemoteInfo(

sddflow-3.4.2/sdd/__init__.py

@@ -1 +0,0 @@
-__version__ = "3.4.2"