- Notifications
You must be signed in to change notification settings - Fork920
.NET: sanitize redirectUrl for logs#2356
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Pull Request Overview
This PR adds security hardening to prevent log injection attacks by sanitizing theredirectUrl before logging. When redirecting requests to include a trailing slash, the URL is now sanitized to remove newline characters that could be used to inject malicious content into logs.
- Introduces a
GeneratedRegexpattern to match and remove newline characters (\r\n) - Changes the class to
partialto support the source-generated regex - Sanitizes the
redirectUrlbefore logging to prevent log injection vulnerabilities
Uh oh!
There was an error while loading.Please reload this page.
ReubenBond left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I am not 100% sure on the right approach for sanitizing log lines. I think it's fine to just delete that log line, tbh. It's a false alarm anyway, becausepath ==_basePath which is a constant and cannot contain newlines.
DeagleGross commentedNov 20, 2025
I also consider this a false alarm, but I think DevUI should have more logs, not less, to improve dev experience and debugging. That's why decided to leave it. Decided to do the simple regex for now - we can improve later once we find out best practice for sanitization |
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
02b8ac2Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.