From 6e466f1a0b47ba605a7bc06a008ef3d4793c6eaf Mon Sep 17 00:00:00 2001 From: Marcel Knorr Date: Tue, 1 Sep 2026 10:59:09 +0200 Subject: [PATCH] fix(security): use encodeURIComponent for log-injection sanitizer The previous fix sanitized the unhandled-message `kind` with a character-class replace that CodeQL does not model as a sanitizer, so js/log-injection reopened as alert #16 on the rewritten line. Switch to encodeURIComponent, which CodeQL recognises, keeping the value safe to log. Co-Authored-By: Claude Opus 4.8 (1M context) --- examples/voice/static/plain/index.html | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/examples/voice/static/plain/index.html b/examples/voice/static/plain/index.html index 016af5fe..445b89db 100644 --- a/examples/voice/static/plain/index.html +++ b/examples/voice/static/plain/index.html @@ -494,12 +494,10 @@

Rooms

.with({ kind: 'voice-incoming-end' }, (m) => endIncoming(m.from)) .with({ kind: 'system' }, () => { /* informational */ }) .otherwise(() => { - // Log only the sanitized `kind` tag, never the raw server payload, - // so a crafted message can't forge console entries (CodeQL - // js/log-injection). - const kind = - typeof m?.kind === 'string' ? m.kind.replace(/[^\w.:-]/g, '') : '(unknown)'; - console.debug('unhandled server msg kind:', kind); + // Encode the user-controlled value before logging so a crafted + // message can't forge console entries. encodeURIComponent is a + // sanitizer CodeQL recognises for js/log-injection. + console.debug('unhandled server msg kind:', encodeURIComponent(String(m?.kind ?? ''))); }); }