Closed
Description
Description of the false positive
CodeQL reports (via GitHub integration) that the following log write receives unsanitized user input:
switch eventType := sanitizeUserInput(event.Type); eventType {
// ...
default:
h.logger.Warn("Content not supported: ", strconv.Quote(eventType)) // <-- false positive 'go/log-injection'
}This is untrue.
The user input is explicitly sanitized at the beginning of the switch case (in fact, we fixed it earlier this year thanks to CodeQL! 🙌 ):
var newlineToSpace = strings.NewReplacer("\n", " ", "\r", " ")
// sanitizeUserInput removes unwanted characters from the given string.
// It also guarantees the safe logging of data that potentially originates from
// user input (CWE-117, https://cwe.mitre.org/data/definitions/117.html).
func sanitizeUserInput(s string) string {
return newlineToSpace.Replace(s)
}