fix(base.py, txt.py): fix security issues and CONTRIBUTING compliance

- base.py: get_state() no longer calls coe()/sys.exit() on malformed
  range specs, returns STATE_UNKNOWN instead
- base.py: oao() and cu() now escape HTML <> characters in messages
- base.py: get_perfdata() sanitizes labels (strips quotes, replaces =)
- txt.py: sanitize_sensitive_data() now also redacts JSON-style fields
  and HTTP Authorization headers

Author: markuslf

CHANGELOG.md

@@ -18,6 +18,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+* base.py: `get_perfdata()` now sanitizes labels by stripping single quotes and replacing `=` with `_`
 * base.py: deduplicate `get_state()` operator logic using `operator` module
 * base.py: deduplicate `sum_dict()` by delegating to `sum_lod()`
 * base.py: improve `get_table()` performance for large tables
@@ -38,10 +39,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* base.py: `cu()` now also escapes HTML characters in the error message, not just in the traceback
+* base.py: `get_state()` no longer calls `sys.exit()` on malformed range specs, returns UNKNOWN instead
+* base.py: `oao()` now escapes HTML characters in the output message to prevent injection in web UIs
 * base.py: fix `get_table()` using wrong separator for the second data row when called without a header
 * human.py: fix incorrect `seconds2human()` docstring example for sub-second values
 * powershell.py: fix outdated shebang line
 * txt.py: fix `exception2text()` missing `traceback` import (fallback path was dead code)
+* txt.py: `sanitize_sensitive_data()` now also redacts JSON-style fields and HTTP Authorization headers
 * txt.py: fix `sanitize_sensitive_data()` replacing the key name instead of the secret value
 * winrm.py: pass parameters correctly in `run_cmd()` when using pypsrp
 

base.py

@@ -12,7 +12,7 @@
 """
 
 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026030301'
+__version__ = '2026032101'
 
 import numbers
 import operator
@@ -120,7 +120,7 @@ def cu(msg=None):
     has_traceback = tb and 'NoneType: None' not in tb
 
     if msg is not None:
-        msg = txt.sanitize_sensitive_data(msg).strip()
+        msg = txt.sanitize_sensitive_data(msg).strip().replace('<', "'").replace('>', "'")
         print(msg, end='')
         print(' (Traceback for debugging purposes attached)\n' if has_traceback else '\n')
 
@@ -151,6 +151,7 @@ def get_perfdata(label, value, uom=None, warn=None, crit=None, _min=None, _max=N
     >>> get_perfdata('load1', 0.42, '', 1.0, 5.0, 0, 10)
     "'load1'=0.42;1.0;5.0;0;10 "
     """
+    label = str(label).replace("'", '').replace('=', '_')
     msg = f"'{label}'={value}{uom or ''};"
     msg += f'{warn};' if warn is not None else ';'
     msg += f'{crit};' if crit is not None else ';'
@@ -191,10 +192,18 @@ def get_state(value, warn, crit, _operator='ge'):
     value = float(value)
 
     if _operator == 'range':
-        if crit is not None and not coe(match_range(value, crit)):
-            return STATE_CRIT
-        if warn is not None and not coe(match_range(value, warn)):
-            return STATE_WARN
+        if crit is not None:
+            success, result = match_range(value, crit)
+            if not success:
+                return STATE_UNKNOWN
+            if not result:
+                return STATE_CRIT
+        if warn is not None:
+            success, result = match_range(value, warn)
+            if not success:
+                return STATE_UNKNOWN
+            if not result:
+                return STATE_WARN
         return STATE_OK
 
     op = _OPS.get(_operator)
@@ -602,7 +611,7 @@ def oao(msg, state=STATE_OK, perfdata='', always_ok=False):
     (and exits with code 2)
 
     """
-    msg = txt.sanitize_sensitive_data(msg.strip()).replace('|', '!')
+    msg = txt.sanitize_sensitive_data(msg.strip()).replace('|', '!').replace('<', "'").replace('>', "'")
     if always_ok and msg:
         # Instead of splitlines(), we just split('\n', 1), so only first line is touched.
         parts = msg.split('\n', 1)

txt.py

@@ -16,7 +16,7 @@
 """
 
 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026030301'
+__version__ = '2026032101'
 
 import operator
 import re
@@ -51,6 +51,23 @@
 # )                         # └ End of capture group 1
 # [^\s&]+                   # The secret value (not captured, will be replaced)
 
+SENSITIVE_JSON_PATTERN = re.compile(
+    r'(?i)("(?:password|pass|token|key|secret|api[_-]?key|access[_-]?token)"\s*:\s*")[^"]*(")'
+)
+# Matches JSON-style sensitive fields like:
+#   "password": "secret123"
+#   "api_key" : "abc"
+# Captures the prefix (group 1) and the closing quote (group 2),
+# replacing only the secret value between them.
+
+SENSITIVE_AUTH_PATTERN = re.compile(
+    r'(?i)(Authorization:\s*(?:Bearer|Basic|Digest|Token)\s+)\S+'
+)
+# Matches HTTP Authorization headers like:
+#   Authorization: Bearer abc123
+#   Authorization: Basic dXNlcjpwYXNz
+# Captures the prefix (group 1), replacing the credential value.
+
 
 def compile_regex(regex, key=''):
     """
@@ -425,7 +442,10 @@ def sanitize_sensitive_data(msg, replacement='******'):
     """
     if not isinstance(msg, str):
         return msg
-    return SENSITIVE_FIELDS_PATTERN.sub(rf'\1{replacement}', msg)
+    msg = SENSITIVE_FIELDS_PATTERN.sub(rf'\1{replacement}', msg)
+    msg = SENSITIVE_JSON_PATTERN.sub(rf'\1{replacement}\2', msg)
+    msg = SENSITIVE_AUTH_PATTERN.sub(rf'\1{replacement}', msg)
+    return msg
 
 
 def to_bytes(obj, encoding='utf-8', errors=None,