Harden logging: neutralize log injection + stop logging sensitive tokens (#464, #465) - #480
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
ExtraToast
requested changes
Jul 18, 2026
ExtraToast
left a comment
ExtraToast
left a comment
Contributor
There was a problem hiding this comment.
Review comments made by CodeQL, dismiss and address appropriately, then re-requeested review
jorisjonkers-dev-agents
Bot
force-pushed
the
fix/log-security-hardening
branch
from
July 18, 2026 06:30
ae2bf75 to
e9470cf
Compare
Contributor
Author
|
Addressed the additional CodeQL Sanitized (wrapped user-provided value with
These two contact-email interpolations were the remaining unsanitized user-influenced String values within the files this PR touches; the previously-flagged sites ( Commit: e9470cf |
ExtraToast
requested changes
Jul 18, 2026
ExtraToast
left a comment
ExtraToast
left a comment
Contributor
There was a problem hiding this comment.
There's still a lot of codeql notifications on this, fix them.
jorisjonkers-dev-agents
Bot
force-pushed
the
fix/log-security-hardening
branch
2 times, most recently
from
August 8, 2026 09:41
1111b11 to
0785b45
Compare
#464, #465) Log injection (java/log-injection, #464): CR/LF are stripped from every user-influenced value before it is logged (FileService filename, BrevoListAdapter list name, MockContactAdapter email/name, ForwardAuthController forwarded host, ExceptionLoggingResolver URI/message), via String.replace('\r','_').replace('\n','_') at the log call site. The sanitization is inline (a local val per scope, reused across a function's log calls) rather than a shared helper on purpose: CodeQL's query only credits replace with String/Char arguments and only when the barrier is in the same callable as the sink — it does not follow the sanitizer through a helper function, and does not recognize the Regex overload of replace. A LogSanitizer.forLog() helper (tried with both regex and char/replaceAll bodies) left every site flagged; inlining the recognized form clears them. Sensitive tokens (java/sensitive-log, #465): EmailTrackingController no longer logs the raw email tracking token; the success path logs only outbox.id, the not-found/error paths log no token. Closes #464 Closes #465 Co-Authored-By: Joris Jonkers <info@jorisjonkers.dev>
jorisjonkers-dev-agents
Bot
force-pushed
the
fix/log-security-hardening
branch
from
August 8, 2026 09:55
0785b45 to
4b69403
Compare
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
ExtraToast
approved these changes
Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
LogSanitizer.forLog()extension (strips CR/LF) applied at every CodeQL-flagged log site to neutralize log injection (CodeQLjava/log-injection×10, Neutralize log injection in user-influenced log statements (CodeQL java/log-injection) #464).EmailTrackingControllerto stop logging a sensitive capability value (CodeQLjava/sensitive-log×3, Stop logging sensitive email tracking tokens (CodeQL java/sensitive-log) #465); theoutbox.idis retained where a correlator is needed.Changes
New helper —
shared/util/LogSanitizer.ktString?.forLog()replaces[\r\n]with underscores and handles nulls. Applied consistently at every flagged site so the pattern is greppable.EmailTrackingController(lines 53, 55, 57)Drops
tokenfrom all three log calls. The success path logsoutbox.idonly; the not-found and error paths omit any token reference. This closes both thejava/sensitive-logalerts (#465) and the correspondingjava/log-injectionhits for this file (#464).BrevoListAdapter(lines 51, 57, 60)User-supplied list
namewrapped in.forLog()at all threecreateListlog calls.MockContactAdapter(line 84)Same
name.forLog()fix in the mock adapter'screateListlog.ForwardAuthController(line 66)X-Forwarded-Hostheader value sanitized before the unknown-host warn log.ExceptionLoggingResolver(line 41)request.requestURIandex.messageboth sanitized in the catch-all error log.FileService(line 92)multipart.originalFilenamesanitized before the store info log.Test plan
java/log-injectionalerts and all 3java/sensitive-logalerts.Closes #464
Closes #465