Summary
StructuredFormatter (src/youtube_extension/backend/config/logging_config.py)
sanitizes nothing at the record level: formatException() only prepends an
"Exception Details:" header and format() returns the base-rendered string
unchanged. As a result, any attacker-controlled CR/LF reaching a sink via
logger.error(..., exc_info=True), logger.exception(...), str(exc), or a
structured extra field can forge or corrupt downstream log lines (CWE-117),
even when the interpolated message was sanitized inline (e.g. via _safe_log
in the v1 router).
Provenance
This gap was surfaced and independently confirmed on
#810 discussion r3699651770,
which noted the fix belongs centrally in the formatter — outside #810's
router.py scope — so it warrants its own focused change.
Acceptance criteria
Fix
Tracked by PR #1270 (central escape of line separators in the final rendered
record via sanitize_log_record() / _UNSAFE_LOG_CHARS).
Summary
StructuredFormatter(src/youtube_extension/backend/config/logging_config.py)sanitizes nothing at the record level:
formatException()only prepends an"Exception Details:"header andformat()returns the base-rendered stringunchanged. As a result, any attacker-controlled CR/LF reaching a sink via
logger.error(..., exc_info=True),logger.exception(...),str(exc), or astructured
extrafield can forge or corrupt downstream log lines (CWE-117),even when the interpolated message was sanitized inline (e.g. via
_safe_login the v1 router).
Provenance
This gap was surfaced and independently confirmed on
#810 discussion r3699651770,
which noted the fix belongs centrally in the formatter — outside #810's
router.pyscope — so it warrants its own focused change.Acceptance criteria
exc_infotraceback, andextrafields cannot forge a new log line.sanitizer's return value.
Fix
Tracked by PR #1270 (central escape of line separators in the final rendered
record via
sanitize_log_record()/_UNSAFE_LOG_CHARS).