fix(security): sanitize v1 router log inputs (CWE-117) — partial - #1691
fix(security): sanitize v1 router log inputs (CWE-117) — partial#1691linear-code[bot] wants to merge 1 commit into
Conversation
…-117) Add _safe_log() helper (reusing sanitize_log_record from logging_config) and apply it to f-string log interpolations of user-controlled values (exceptions, video/job/action/agent IDs, messages, session IDs, URLs). Partial: %s-style arg sites, extra= dict, and focused regressions in tests/unit/test_v1_router_extended.py still pending. Generated with [Linear](https://linear.app/myxstack/agent-session/40d7adf7-65c1-44da-869e-0f24ef588c46) Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. Scanned FilesNone |
groupthinking
added
high-priority
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Backlog triage: leaving open. CWE-117 v1 router sanitize (successor to closed #810) is CONFLICTING + trivy red. Rebase + core-green; no force-merge. |
|
CoS hold: named timeout cut in flight. Touches |
|
Please add a See governance: #898 |
Ports the call-site log sanitization from #810 onto current
main. Adds a_safe_log()helper insrc/youtube_extension/backend/api/v1/router.pythat reuses the centralsanitize_log_recordtable fromlogging_config.py(already merged formatter-level hardening), and applies it to 35 f-string log interpolations of user-controlled values: exception text, video/job/action/agent IDs, chat messages, session IDs, and video URLs.Incomplete — session was cut short by workspace funding limits. Still pending:
%s-style log arg sites (router.py lines ~140, ~1441, ~1461, ~1556, ~1647, ~1836) and theextra={"video_url": ...}site (~516)tests/unit/test_v1_router_extended.py