Security hardening: secret detection, input guards, SecurityConfig, W3C size limits

26 files · 914+ · 193-

2 files changed

config.py New SecurityConfig dataclass: max_attr_count, max_attr_value_length, max_depth limits for sanitization
CONFIGURATION.md Configuration reference updated with SecurityConfig fields

SecurityConfig dataclass added to config.py with configurable limits: max_attr_count (max number of attributes per event), max_attr_value_length (truncation threshold), and max_depth (nested object depth limit for sanitization). Wired through the sanitize processor. harden behavioral
1 file
- config.py

2 files changed

pii.py Added ASIA prefix to AWS temporary credential detection; max_depth enforcement through sanitize processor
processors.py Sanitize processor passes max_depth from SecurityConfig

AWS key pattern detection in the PII sanitizer extended to cover ASIA-prefixed temporary session credentials (was only detecting AKIA permanent keys). max_depth from SecurityConfig now enforced through the sanitize processor, capping recursive sanitization of nested log event structures. harden behavioral
2 files
- pii.py
- processors.py

1 file changed

propagation.py Size guards on traceparent and tracestate header extraction to reject oversized values before parsing

W3C traceparent and tracestate header extraction now rejects values exceeding protocol size limits before parsing. Prevents DoS via oversized context propagation headers. harden behavioral
1 file
- propagation.py

4 files changed

test_input_hardening.py 463-line test suite: input poisoning, secret detection, protocol resilience, depth limit enforcement
test_pii_mutations.py 104-line PII mutation tests including ASIA prefix coverage
test_extract_w3c_field_wiring.py 85-line W3C field wiring tests for protocol size guard paths
test_hardening_properties.py 42-line property tests for hardening invariants

Added 463-line input hardening test suite covering: input poisoning (malicious log values, oversized payloads), secret detection (AKIA/ASIA AWS keys, generic token patterns), protocol resilience (oversized W3C headers, malformed traceparent), and depth limit enforcement. PII mutation tests kill survivors from ASIA detection. Property tests verify hardening invariants across arbitrary inputs. qualify internal
3 files
- test_input_hardening.py
- test_pii_mutations.py
- test_extract_w3c_field_wiring.py

5 files changed

release-please.yml release-please workflow removed (tag-based releases used instead)
.release-please-config.json release-please config removed
.release-please-manifest.json release-please manifest removed
release.yml Release workflow updated for tag-based trigger
ci-python.yml Mutation gates depend on quality jobs; fail-fast on quality matrix; broken mutation-pr jobs removed (full gate already runs)

release-please automation removed in favor of manual tag-based releases. Python CI updated so mutation gates depend on quality jobs completing first and fail-fast enabled on the Python version matrix. baseline internal
1 file
- ci-python.yml

1 file changed

cryptography upgraded from 46.0.5 to 46.0.6 and requests from 2.32.5 to 2.33.0 to address security CVEs. Performance smoke test threshold widened for secret scanning overhead on large payloads. remediate errata
1 file
- uv.lock