Release 1.3.1 Security Bug Fixes (#194)

* fix(sec-vul): Updated the example file of oauth-client to skip the token details, http file log will capture the redacted url instead of logging full URLs

* updated pyproject to exclude md files on reformat

* updated pytfe version

Author: isivaselvan

.gitignore

@@ -138,3 +138,6 @@ protos.bin
 # Local RSA keys
 .local/*
 
+# Bob files
+.bob/
+_context/

examples/oauth_client.py

@@ -241,7 +241,7 @@ def main():
                 print(" OAuth Token details:")
                 for i, token in enumerate(read_oauth_client.oauth_tokens[:2], 1):
                     if isinstance(token, dict):
-                        print(f"{i}. Token ID: {token.get('id', 'N/A')}")
+                        print(f"{i}. Token details: [REDACTED]")
 
         except Exception as e:
             print(f"Error reading OAuth client with options: {e}")

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pytfe"
-version = "1.3.0"
+version = "1.3.1"
 description = "Official Python SDK for HashiCorp Terraform Cloud / Terraform Enterprise (TFE) API v2"
 readme = "README.md"
 license = { text = "MPL-2.0" }
@@ -48,6 +48,7 @@ packages = ["src/pytfe"]
 target-version = "py310"
 line-length = 88
 exclude = [
+    ".bob",
     ".bzr",
     ".direnv",
     ".eggs",
@@ -90,6 +91,7 @@ quote-style = "double"
 indent-style = "space"
 skip-magic-trailing-comma = false
 line-ending = "auto"
+exclude = ["*.md"]
 
 [tool.ruff.lint.isort]
 known-first-party = ["pytfe"]

src/pytfe/_http.py

@@ -104,7 +104,7 @@ def request(
                 transport_logger.debug(
                     "transport exception on %s %s (attempt %d): %s",
                     method,
-                    url,
+                    "<redacted-url>",
                     attempt,
                     e,
                 )
@@ -125,7 +125,7 @@ def request(
                 transport_logger.info(
                     "retrying %s %s after %s (status=%d, attempt=%d)",
                     method,
-                    url,
+                    "<redacted-url>",
                     f"{retry_after:.2f}s" if retry_after else "backoff",
                     resp.status_code,
                     attempt,