Neutralize CR/LF in rendered log records (CWE-117)

[groupthinking]

Escape all line/record separators (and ESC) in the final formatted log record so attacker-controlled CR/LF can’t forge or break downstream logs.

[linear-code]

GRV-342

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• GRV-259
• fix(security): StructuredFormatter does not strip CR/LF from exc_info tracebacks / extra fields (CWE-117) #1271

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[groupthinking]

Covered on main.

Acceptance: CR/LF (and ESC) in formatted log records must not forge downstream logs (CWE-117).

tests/unit/test_logging_config_crlf.py is the CWE-117 suite for StructuredFormatter. Line/record separators are escaped in the formatter; #1515 closed residual JSON-fallback holes that could still drop a record.

Closing as done.