fix(security): neutralize CR/LF in rendered log records (CWE-117)

[groupthinking]

Canonical issue

Closes #1271. Relands #1270 on a branch based on current main.

Outcome

Every rendered log record emits as a single physical line. Attacker-controlled line separators can no longer forge, corrupt, or split downstream log entries — including via logger.error(..., exc_info=True), logger.exception(...), and structured extra fields — and JSON logs stay parseable.

Scope

• Included: src/youtube_extension/backend/config/logging_config.py — StructuredFormatter.format() escapes every str.splitlines() boundary (LF, CR, VT, FF, FS, GS, RS, NEL, LS, PS) plus ESC in the final rendered record via a shared sanitize_log_record() / _UNSAFE_LOG_CHARS table. Escapes are JSON-valid \uXXXX sequences; backslash is escaped first so the transform is unambiguous and reversible. tests/unit/test_logging_config_crlf.py — regression tests against rendered handler output.
• Explicitly excluded: any call-site inline sanitization changes; the unrelated perf work that once shared fix(security): neutralize CR/LF in rendered log records (CWE-117) #1270's branch (canonical home: perf: read and encode GitHub upload payloads off the event loop #1269).

Risk

• Risk level: low
• Failure mode: multi-line tracebacks render on one line with separators shown as \uXXXX escapes; content is fully preserved and losslessly reversible.
• Rollback: revert this commit; the formatter returns to pass-through behavior.

Verification

Tied to head ca889eb.

• Focused tests — pytest tests/unit/test_logging_config_crlf.py → 9 passed
• ruff check clean on both changed files
• Required CI on this head
• Review threads resolved

Production evidence

Not applicable: Python-only logging change with no web surface; correctness is proven by the rendered-output regression suite.

[linear-code]

GRV-295

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Canceled	v0	Aug 4, 2026 3:04am

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e506f556-ad16-4e69-a18d-1063c61740da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ca889eb.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

Agent Completion Truth Gate: NOT_APPLICABLE

Evidence agrees.

Machine-readable verdict

{
  "details": {},
  "reasons": [],
  "verdict": "not_applicable"
}

Workflow evidence

[groupthinking]

Closing in favour of #1270 — the patches are byte-identical

This branch is a re-land attempt of #1270. Comparing the two diffs against their merge bases, ignoring only index lines:

$ diff <(git diff <mb> claude/determined-maxwell-j8w4lt   | grep -v '^index ')
        <(git diff <mb> land-pr-1270-...-grv-295-ffc0     | grep -v '^index ')
   (no output — IDENTICAL patches)

Both are 2 files, +215 / −1. There is no content difference to choose between, so the tiebreak is review evidence: #1270 already carries CodeRabbit approval, a resolved review thread, and a READY preview (verified at b393c8fc per the Aug 3 control log). This branch carries none of that and would have to re-earn all of it.

This re-land only exists because #1270 could not clear the merge gate. That root cause — the truth gate being unsatisfiable for PRs with no linked dispatch contract — is fixed in #1377, so #1270 no longer needs a re-land to get through.

Closing this; #1270 is canonical for the CWE-117 CR/LF log-injection fix. Branch retained and will be archive-tagged before any deletion.

---

Generated by Claude Code