chore(core): upgrade to .NET 9 and apply various fixes and improvements #59
Conversation
… other optimization
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| _logger?.LogInformation($"Connection {Context.ConnectionId} added to group {groupName}"); | ||
| _logger?.LogInformation("Connection {ConnectionId} added to group {GroupName}", | ||
| Context.ConnectionId, LogSanitizer.Sanitize(groupName)); |
Check failure
Code scanning / CodeQL
Log entries created from user input High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fully mitigate log forging risks as per CodeQL's guidance and best practices, we should:
- Ensure that user input used in logging is not only stripped of control characters, but also of curly braces (
{}and}), which are special in Microsoft logging templates and may cause confusion or malformed logs. - Optionally, clearly delimit user input (e.g., quote or bracket it) in logs.
Edit required:
- Update
LogSanitizer.Sanitizeinsrc/WART-Core/Utilities/LogSanitizer.csto remove{and}characters from input strings, in addition to control characters. - No changes needed in how
Sanitizeis used inWartHubBase.cs, since it is already applied.
No additional dependencies are required.
| @@ -16,7 +16,7 @@ | ||
| if (string.IsNullOrEmpty(input)) return input; | ||
|
|
||
| return new string(input | ||
| .Where(c => !char.IsControl(c)) | ||
| .Where(c => !char.IsControl(c) && c != '{' && c != '}') | ||
| .ToArray()); | ||
| } | ||
| } |
No description provided.