Skip to content

Conversation

@DeagleGross
Copy link
Contributor

@DeagleGross DeagleGross commented Nov 20, 2025

  1. Sanitizing redirect url
  2. Using redirect Url from the _basePath to not use input without validation
  • The code builds clean without any errors or warnings
  • The PR follows the Contribution Guidelines
  • All unit tests pass, and I have added new tests where possible
  • Is this a breaking change? If yes, add "[BREAKING]" prefix to the title of the PR.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds security hardening to prevent log injection attacks by sanitizing the redirectUrl before logging. When redirecting requests to include a trailing slash, the URL is now sanitized to remove newline characters that could be used to inject malicious content into logs.

  • Introduces a GeneratedRegex pattern to match and remove newline characters (\r\n)
  • Changes the class to partial to support the source-generated regex
  • Sanitizes the redirectUrl before logging to prevent log injection vulnerabilities

Copy link
Member

@ReubenBond ReubenBond left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not 100% sure on the right approach for sanitizing log lines. I think it's fine to just delete that log line, tbh. It's a false alarm anyway, because path == _basePath which is a constant and cannot contain newlines.

@DeagleGross
Copy link
Contributor Author

I am not 100% sure on the right approach for sanitizing log lines. I think it's fine to just delete that log line, tbh. It's a false alarm anyway, because path == _basePath which is a constant and cannot contain newlines.

I also consider this a false alarm, but I think DevUI should have more logs, not less, to improve dev experience and debugging. That's why decided to leave it.

Decided to do the simple regex for now - we can improve later once we find out best practice for sanitization

@DeagleGross DeagleGross added this pull request to the merge queue Nov 20, 2025
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Nov 20, 2025
@DeagleGross DeagleGross added this pull request to the merge queue Nov 20, 2025
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Nov 20, 2025
@DeagleGross DeagleGross added this pull request to the merge queue Nov 20, 2025
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Nov 20, 2025
@DeagleGross DeagleGross added this pull request to the merge queue Nov 21, 2025
Merged via the queue into main with commit 02b8ac2 Nov 21, 2025
14 checks passed
@crickman crickman deleted the dmkorolev/codeql-23 branch November 24, 2025 17:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants