v1.2.14: CodeQL Security Hardening & PBKDF2 Tenant Cryptographic Isolation
·
80 commits
to main
since this release
33b11e3
This commit was signed with the committer鈥檚 verified signature.
ninadphalak
Ninad Phalak
What's Changed in v1.2.14
馃敀 Cryptographic & Security Hardening (CodeQL Resolution)
- PBKDF2-HMAC Key Derivation for Multi-Tenant Virtual Keys: Replaced unsalted single-pass
sha256hashing in dynamic virtual key resolution with cryptographically saltedhashlib.pbkdf2_hmac(get_virtual_key_id), utilizing 600,000 rounds, salt, and LRU cache for 0ms routing overhead. Resolves CodeQL alert py/weak-sensitive-data-hashing. - Strict URI/Hostname Sanitization: Updated test assertions in antifragile dispatcher to enforce explicit URL hostname verification via
urllib.parse.urlparse, eliminating potential domain substring spoofing vulnerabilities. Resolves CodeQL alert py/incomplete-url-substring-sanitization.
馃И Quality Assurance & Test Verification
- 128 Automated Unit, Integration & Stress Tests Passing (100% test suite pass rate).
- Complete verification against Python 3.10, 3.11, and 3.12 runtimes.
- 0 linter errors across the entire codebase (
ruff check .).
Full Changelog: v1.2.13...v1.2.14
Full Changelog: v1.2.13...v1.2.14