Skip to content

Fix GitHub Code Scanning alerts (Security and quality) #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Xenne93 merged 4 commits into from
Aug 16, 2026
Merged

Fix GitHub Code Scanning alerts (Security and quality) #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
02820e6
Fix GitHub Code Scanning alerts (Security and quality)
Xenne93 Aug 16, 2026
5e83375
test: inline Replace() sanitizer instead of helper method to validate…
Xenne93 Aug 16, 2026
374ba20
Replace LogSanitizer helper with inline .Replace() calls
Xenne93 Aug 16, 2026
ac64bdd
Fix remaining 4 alerts: sanitize steamId logging, drop email from Ema…
Xenne93 Aug 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/build-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ on:
- main
workflow_dispatch:

permissions:
contents: read

jobs:
build:
runs-on: ubuntu-latest
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/remove-old-packages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@ on:
- cron: '0 0 * * 0' # elke zondag
workflow_dispatch:

permissions:
contents: read
packages: write

jobs:
cleanup:
runs-on: ubuntu-latest
Expand Down
4 changes: 2 additions & 2 deletions RustRconServerManager.Backend/Controllers/AuthController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -472,7 +472,7 @@ private async Task<List<RconServer>> GetAccessibleServers(ApplicationUser user)
[HttpPost("forgot-password")]
public async Task<IActionResult> ForgotPassword(Authorization_ForgotPasswordDTO model)
{
_logger.LogDebug("[FORGOT-PASSWORD] Request received for email: {Email}", model.Email);
_logger.LogDebug("[FORGOT-PASSWORD] Request received");

// Always return 200 to prevent email enumeration
var genericMessage = "If an account with that email exists, a recovery code has been sent.";
Expand All @@ -490,7 +490,7 @@ public async Task<IActionResult> ForgotPassword(Authorization_ForgotPasswordDTO
return Ok(new { message = genericMessage });
}

_logger.LogDebug("[FORGOT-PASSWORD] User found: {Email}", user.Email);
_logger.LogDebug("[FORGOT-PASSWORD] User found: {UserId}", user.Id);

// Generate random 6-digit code (overwrites any existing code)
var code = RandomNumberGenerator.GetInt32(100000, 999999).ToString();
Expand Down
22 changes: 11 additions & 11 deletions RustRconServerManager.Backend/Controllers/DashboardController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -352,12 +352,12 @@ public async Task<IActionResult> BanPlayer([FromBody] BanPlayerRequest request)
{
string banCommand = $"banid {request.SteamId} \"{request.PlayerName}\" \"[GLOBAL BAN] {request.Reason}\" {request.DurationHours}";
_rconService.SendRconCommand(banCommand, server.Id);
_logger.LogInformation("Sent global ban command to server {ServerName} (ID: {ServerId}) for player {PlayerName}", server.Name, server.Id, request.PlayerName);
_logger.LogInformation("Sent global ban command to server {ServerName} (ID: {ServerId}) for player {PlayerName}", server.Name?.Replace("\r", "").Replace("\n", ""), server.Id, request.PlayerName?.Replace("\r", "").Replace("\n", ""));
}
catch (Exception ex)
{
// Log but don't fail if server is offline - ban is still tracked in database
_logger.LogWarning(ex, "Could not send global ban command to server {ServerName}", server.Name);
_logger.LogWarning(ex, "Could not send global ban command to server {ServerName}", server.Name?.Replace("\r", "").Replace("\n", ""));
}
}
}
Expand Down Expand Up @@ -870,7 +870,7 @@ public async Task<IActionResult> ToggleGlobalBan(int banId, [FromBody] ToggleGlo
// If toggling OFF a global ban, unban from all servers
if (ban.IsGlobalBan && !request.IsGlobalBan)
{
_logger.LogInformation("[GLOBAL UNBAN] Toggling off global ban for {SteamId}. Unbanning from all servers...", ban.SteamId);
_logger.LogInformation("[GLOBAL UNBAN] Toggling off global ban for {SteamId}. Unbanning from all servers...", ban.SteamId?.Replace("\r", "").Replace("\n", ""));

// Get current user email for audit trail
var userEmail = User.FindFirst(System.Security.Claims.ClaimTypes.Email)?.Value ?? "System";
Expand Down Expand Up @@ -902,7 +902,7 @@ public async Task<IActionResult> ToggleGlobalBan(int banId, [FromBody] ToggleGlo
{
string unbanCommand = $"unban {playerBan.SteamId}";
_rconService.SendRconCommand(unbanCommand, playerBan.ServerId);
_logger.LogInformation("[GLOBAL UNBAN] Sent unban command for {SteamId} on server {ServerId}", ban.SteamId, playerBan.ServerId);
_logger.LogInformation("[GLOBAL UNBAN] Sent unban command for {SteamId} on server {ServerId}", ban.SteamId?.Replace("\r", "").Replace("\n", ""), playerBan.ServerId);
}
catch (Exception ex)
{
Expand All @@ -914,7 +914,7 @@ public async Task<IActionResult> ToggleGlobalBan(int banId, [FromBody] ToggleGlo
}

await dbContext.SaveChangesAsync();
_logger.LogInformation("[GLOBAL UNBAN] Removed all bans for {SteamId} from database", ban.SteamId);
_logger.LogInformation("[GLOBAL UNBAN] Removed all bans for {SteamId} from database", ban.SteamId?.Replace("\r", "").Replace("\n", ""));

return Ok(new { message = $"Player {ban.SteamId} has been unbanned from all servers" });
}
Expand Down Expand Up @@ -966,7 +966,7 @@ public async Task<IActionResult> DeleteBan(int banId, [FromBody] DeleteBanReques
// If this is a global ban, unban from all servers
if (ban.IsGlobalBan && ban.ServerId == -1)
{
_logger.LogInformation("[GLOBAL UNBAN] Removing global ban for {SteamId}", ban.SteamId);
_logger.LogInformation("[GLOBAL UNBAN] Removing global ban for {SteamId}", ban.SteamId?.Replace("\r", "").Replace("\n", ""));

// Find all server-specific bans created by this global ban
var relatedServerBans = await dbContext.PlayerBans
Expand Down Expand Up @@ -994,7 +994,7 @@ public async Task<IActionResult> DeleteBan(int banId, [FromBody] DeleteBanReques
{
string unbanCommand = $"unban {serverBan.SteamId}";
_rconService.SendRconCommand(unbanCommand, serverBan.ServerId);
_logger.LogInformation("[GLOBAL UNBAN] Sent unban command for {SteamId} on server {ServerId}", ban.SteamId, serverBan.ServerId);
_logger.LogInformation("[GLOBAL UNBAN] Sent unban command for {SteamId} on server {ServerId}", ban.SteamId?.Replace("\r", "").Replace("\n", ""), serverBan.ServerId);
}
catch (Exception ex)
{
Expand Down Expand Up @@ -1057,7 +1057,7 @@ public async Task<IActionResult> DeleteBan(int banId, [FromBody] DeleteBanReques
{
string unbanCommand = $"unban {ban.SteamId}";
_rconService.SendRconCommand(unbanCommand, ban.ServerId);
_logger.LogInformation("[UNBAN] Sent unban command for SteamID {SteamId} on server {ServerId}", ban.SteamId, ban.ServerId);
_logger.LogInformation("[UNBAN] Sent unban command for SteamID {SteamId} on server {ServerId}", ban.SteamId?.Replace("\r", "").Replace("\n", ""), ban.ServerId);
}
catch (Exception ex)
{
Expand All @@ -1068,7 +1068,7 @@ public async Task<IActionResult> DeleteBan(int banId, [FromBody] DeleteBanReques
// Remove the ban record from database
dbContext.PlayerBans.Remove(ban);
await dbContext.SaveChangesAsync();
_logger.LogInformation("[UNBAN] Removed ban record for SteamID {SteamId} from database", ban.SteamId);
_logger.LogInformation("[UNBAN] Removed ban record for SteamID {SteamId} from database", ban.SteamId?.Replace("\r", "").Replace("\n", ""));

return Ok(new { message = "Player unbanned successfully on server and database updated" });
}
Expand Down Expand Up @@ -1342,12 +1342,12 @@ public async Task<IActionResult> GiveItem([FromBody] GiveItemRequest request)
// Build the RCON command: inventory.giveto <steamid> <shortname> <quantity>
var command = $"inventory.giveto {request.SteamId} {request.ShortName} {request.Quantity}";

_logger.LogInformation("[GIVE ITEM] Executing command: {Command} for player {PlayerName}", command, request.PlayerName);
_logger.LogInformation("[GIVE ITEM] Executing command: {Command} for player {PlayerName}", command?.Replace("\r", "").Replace("\n", ""), request.PlayerName?.Replace("\r", "").Replace("\n", ""));

// Execute the RCON command
var response = await _rconService.ExecuteCommandWithResponse(command, request.ServerId);

_logger.LogDebug("[GIVE ITEM] Command response: {Response}", response);
_logger.LogDebug("[GIVE ITEM] Command response: {Response}", response?.Replace("\r", "").Replace("\n", ""));

return Ok(new {
success = true,
Expand Down
26 changes: 13 additions & 13 deletions RustRconServerManager.Backend/Controllers/ModsController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ public async Task<IActionResult> GetPlugins()
// Execute RCON command to get plugins
string? rconResponse = await _rconBackgroundService.ExecuteCommandWithResponse(command, serverId);

_logger.LogInformation("RCON Response for '{Command}': {Response}", command, rconResponse ?? "NULL");
_logger.LogInformation("RCON Response for '{Command}': {Response}", command?.Replace("\r", "").Replace("\n", ""), rconResponse?.Replace("\r", "").Replace("\n", "") ?? "NULL");

if (string.IsNullOrWhiteSpace(rconResponse))
{
Expand Down Expand Up @@ -182,12 +182,12 @@ public async Task<IActionResult> LoadPlugin([FromBody] Mods_ReloadPluginDTO requ
? $"c.load {request.PluginName}"
: $"o.load {request.PluginName}";

_logger.LogInformation("Executing command: {Command} for server {ServerId}", command, serverId);
_logger.LogInformation("Executing command: {Command} for server {ServerId}", command?.Replace("\r", "").Replace("\n", ""), serverId);

// Execute RCON command
string? rconResponse = await _rconBackgroundService.ExecuteCommandWithResponse(command, serverId);

_logger.LogInformation("RCON Response for '{Command}': {Response}", command, rconResponse ?? "NULL");
_logger.LogInformation("RCON Response for '{Command}': {Response}", command?.Replace("\r", "").Replace("\n", ""), rconResponse?.Replace("\r", "").Replace("\n", "") ?? "NULL");

return Ok(new
{
Expand Down Expand Up @@ -249,12 +249,12 @@ public async Task<IActionResult> ReloadPlugin([FromBody] Mods_ReloadPluginDTO re
? $"c.reload {request.PluginName}"
: $"o.reload {request.PluginName}";

_logger.LogInformation("Executing command: {Command} for server {ServerId}", command, serverId);
_logger.LogInformation("Executing command: {Command} for server {ServerId}", command?.Replace("\r", "").Replace("\n", ""), serverId);

// Execute RCON command
string? rconResponse = await _rconBackgroundService.ExecuteCommandWithResponse(command, serverId);

_logger.LogInformation("RCON Response for '{Command}': {Response}", command, rconResponse ?? "NULL");
_logger.LogInformation("RCON Response for '{Command}': {Response}", command?.Replace("\r", "").Replace("\n", ""), rconResponse?.Replace("\r", "").Replace("\n", "") ?? "NULL");

return Ok(new
{
Expand Down Expand Up @@ -316,12 +316,12 @@ public async Task<IActionResult> UnloadPlugin([FromBody] Mods_UnloadPluginDTO re
? $"c.unload {request.PluginName}"
: $"o.unload {request.PluginName}";

_logger.LogInformation("Executing command: {Command} for server {ServerId}", command, serverId);
_logger.LogInformation("Executing command: {Command} for server {ServerId}", command?.Replace("\r", "").Replace("\n", ""), serverId);

// Execute RCON command
string? rconResponse = await _rconBackgroundService.ExecuteCommandWithResponse(command, serverId);

_logger.LogInformation("RCON Response for '{Command}': {Response}", command, rconResponse ?? "NULL");
_logger.LogInformation("RCON Response for '{Command}': {Response}", command?.Replace("\r", "").Replace("\n", ""), rconResponse?.Replace("\r", "").Replace("\n", "") ?? "NULL");

return Ok(new
{
Expand Down Expand Up @@ -377,12 +377,12 @@ public async Task<IActionResult> ReloadAll()
? "c.reload *"
: "o.reload *";

_logger.LogInformation("Executing command: {Command} for server {ServerId}", command, serverId);
_logger.LogInformation("Executing command: {Command} for server {ServerId}", command?.Replace("\r", "").Replace("\n", ""), serverId);

// Execute RCON command
string? rconResponse = await _rconBackgroundService.ExecuteCommandWithResponse(command, serverId);

_logger.LogInformation("RCON Response for '{Command}': {Response}", command, rconResponse ?? "NULL");
_logger.LogInformation("RCON Response for '{Command}': {Response}", command?.Replace("\r", "").Replace("\n", ""), rconResponse?.Replace("\r", "").Replace("\n", "") ?? "NULL");

return Ok(new
{
Expand Down Expand Up @@ -444,7 +444,7 @@ public async Task<IActionResult> SetPluginSource([FromBody] Mods_SetPluginSource
_dbContext.ServerPluginSources.Remove(existingEntry);
await _dbContext.SaveChangesAsync();

_logger.LogInformation("Removed plugin source for {PluginName} on server {ServerId}", request.PluginName, serverId);
_logger.LogInformation("Removed plugin source for {PluginName} on server {ServerId}", request.PluginName?.Replace("\r", "").Replace("\n", ""), serverId);

return Ok(new
{
Expand All @@ -468,7 +468,7 @@ public async Task<IActionResult> SetPluginSource([FromBody] Mods_SetPluginSource
await _dbContext.SaveChangesAsync();

_logger.LogInformation("Updated plugin source for {PluginName} on server {ServerId} to {Source}",
request.PluginName, serverId, request.Source.Value);
request.PluginName?.Replace("\r", "").Replace("\n", ""), serverId, request.Source.Value);

return Ok(new
{
Expand All @@ -491,7 +491,7 @@ public async Task<IActionResult> SetPluginSource([FromBody] Mods_SetPluginSource
await _dbContext.SaveChangesAsync();

_logger.LogInformation("Created plugin source for {PluginName} on server {ServerId} as {Source}",
request.PluginName, serverId, request.Source.Value);
request.PluginName?.Replace("\r", "").Replace("\n", ""), serverId, request.Source.Value);

return Ok(new
{
Expand Down Expand Up @@ -636,7 +636,7 @@ public async Task<IActionResult> CheckPluginVersion([FromQuery] string pluginNam
}
catch (Exception ex)
{
_logger.LogError(ex, $"Error checking version for plugin {pluginName}");
_logger.LogError(ex, "Error checking version for plugin {PluginName}", pluginName?.Replace("\r", "").Replace("\n", ""));
return StatusCode(500, ApiErrorHelper.FormatError("Error checking plugin version", ex));
}
}
Expand Down
Loading
Loading