fix(security): neutralize NUL (0x00) in log records (CWE-117 gap from #1270/#1255)

[groupthinking]

Canonical issue

Closes #1421.

Outcome

StructuredFormatter now neutralizes NUL (0x00) alongside the other separators, closing a coverage gap that the #1270/#1255 CWE-117 consolidation left on main. A raw NUL can no longer reach a log sink where a C-based shipper would truncate the record.

Scope

• Included:
  • src/youtube_extension/backend/config/logging_config.py — add ord("\x00"): "\\u0000" to _UNSAFE_LOG_CHARS; comment updated to note NUL.
  • tests/unit/test_logging_config_crlf.py — focused test_nul_byte_is_neutralized; the existing table-driven tests auto-extend to cover the new codepoint.
• Explicitly excluded:
  • No change to the escaping scheme, the other separators, or call sites. This is purely the one missing codepoint.

Risk

• Risk level: low
• Failure mode: a NUL in log content now renders as the literal `` escape (content preserved, reversible, JSON-valid) instead of a raw byte. JSON logging is improved (a raw NUL is not valid inside a JSON string).
• Rollback: revert this commit; the table returns to its post-fix(security): neutralize CR/LF in rendered log records (CWE-117) #1270 state.

Verification

Tied to head 7ad248f3a816ff280d19f876fea68617ec63b2b2.

• Focused tests — pytest tests/unit/test_logging_config_crlf.py → 10 passed (9 pre-existing + NUL regression)
• Required CI — pending on this head
• Review threads resolved — n/a (new PR)

Regression evidence: origin/main @ 5934cbf _UNSAFE_LOG_CHARS has no 0x00 entry; #1255 (the sole NUL carrier) closed 2026-08-04, #1270 merged 2026-08-07 without it. See #1421.

Production evidence

Not applicable to runtime behavior: Python-only logging change with no web surface; the apps/web Vercel preview does not exercise it. Correctness is proven by the rendered-output regression suite, including a NUL round-trip and a JSON-parse check.

Agent handoff

• One canonical issue is linked (CWE-117: StructuredFormatter does not neutralize NUL (0x00) after #1270/#1255 consolidation #1421); no false Closes.
• No competing PR implements this — the cluster (fix(security): neutralize CR/LF in rendered log records (CWE-117 formatter gap) #1255/fix(security): neutralize CWE-117 log forging in StructuredFormatter #1263/fix(security): neutralize CR/LF in rendered log records (CWE-117) #1265/fix(security): neutralize CR/LF log forging in StructuredFormatter (CWE-117) #1266) is closed and fix(security): neutralize CR/LF in rendered log records (CWE-117) #1270 is merged without NUL.
• Acceptance criteria satisfied for the NUL codepoint.
• Required engineering checks expected to pass on the current head.
• Human decision requested for the governance/merge gate below.

Agent provenance

Produced by a scheduled, unattended PR-remediation routine running under the repo owner's account, as a follow-up after #1270 merged. Provenance is disclosed truthfully, but — consistent with the directive established on #810/#1270 not to weaken or impersonate agent-completion/truth-gate — this PR does not fabricate a frozen pre-dispatch intent snapshot or a trusted terminal-agent-result (it was not opened via the agent dispatch workflow). It therefore HALTS at the human/governance gate by design, kept as draft pending final human review and merge approval to protected main.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, v0	Aug 7, 2026 8:48pm

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f1cc0589-0d54-44dc-9a2c-b1f3d3bfce92

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 923a04d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: invalid_payload

Machine-readable verdict

{
  "details": {
    "collection_errors": [
      "incomplete_linked_issue_contract",
      "linked_issue_not_agent_task",
      "missing_intent_snapshot",
      "missing_agent_run_id",
      "missing_agent_login"
    ],
    "invalid_fields": [
      "policy.agent_login",
      "policy.run_id"
    ]
  },
  "reasons": [
    "invalid_payload"
  ],
  "verdict": "blocked"
}

Workflow evidence

[groupthinking]

Disposition: HALTED(awaiting_human_governance_gate) — engineering-green, no autonomous merge.

Check status on head 7ad248f:

• Engineering surface passing: lint-python, lint-frontend, guards, bandit, gitleaks, python-safety, dependency-review, validate, label, Canonical issue and evidence, and Vercel (Ready/Deployed) all green; test / build / trivy / coverage / CodeQL still running. PR Governance is neutral — the canonical-issue contract (CWE-117: StructuredFormatter does not neutralize NUL (0x00) after #1270/#1255 consolidation #1421) is satisfied. Focused suite verified locally: 10 passed.
• Only failing check: agent-completion/truth-gate (invalid_payload) — red by design. Its collection_errors (missing_intent_snapshot, missing_agent_run_id, missing_agent_login, linked_issue_not_agent_task) all stem from this PR not being opened through the agent-dispatch workflow. Consistent with the fix(security): sanitize user-controlled values in API logs (CWE-117 log injection) #810/fix(security): neutralize CR/LF in rendered log records (CWE-117) #1270 directive, I am not fabricating a pre-dispatch intent snapshot or a trusted terminal-agent-result to clear it.

Next step is human: final review + merge approval to protected main (this closes the NUL/0x00 CWE-117 gap #1270 left behind — see #1421). I won't re-post on subsequent truth-gate re-runs of the same by-design block; if a real engineering check fails I'll fix it and push.

---

Generated by Claude Code

[linear-code]

GRV-368