Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

.NET: sanitize redirectUrl for logs#2356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
DeagleGross merged 3 commits intomainfromdmkorolev/codeql-23
Nov 21, 2025
Merged

Conversation

@DeagleGross
Copy link
Contributor

@DeagleGrossDeagleGross commentedNov 20, 2025
edited
Loading

  1. Sanitizing redirect url
  2. Using redirect Url from the _basePath to not use input without validation
  • The code builds clean without any errors or warnings
  • The PR follows theContribution Guidelines
  • All unit tests pass, and I have added new tests where possible
  • Is this a breaking change? If yes, add "[BREAKING]" prefix to the title of the PR.

Copy link
Contributor

CopilotAI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Pull Request Overview

This PR adds security hardening to prevent log injection attacks by sanitizing theredirectUrl before logging. When redirecting requests to include a trailing slash, the URL is now sanitized to remove newline characters that could be used to inject malicious content into logs.

  • Introduces aGeneratedRegex pattern to match and remove newline characters (\r\n)
  • Changes the class topartial to support the source-generated regex
  • Sanitizes theredirectUrl before logging to prevent log injection vulnerabilities

Copy link
Member

@ReubenBondReubenBond left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I am not 100% sure on the right approach for sanitizing log lines. I think it's fine to just delete that log line, tbh. It's a false alarm anyway, becausepath ==_basePath which is a constant and cannot contain newlines.

@DeagleGross
Copy link
ContributorAuthor

I am not 100% sure on the right approach for sanitizing log lines. I think it's fine to just delete that log line, tbh. It's a false alarm anyway, becausepath ==_basePath which is a constant and cannot contain newlines.

I also consider this a false alarm, but I think DevUI should have more logs, not less, to improve dev experience and debugging. That's why decided to leave it.

Decided to do the simple regex for now - we can improve later once we find out best practice for sanitization

@DeagleGrossDeagleGross added this pull request to themerge queueNov 20, 2025
@github-merge-queuegithub-merge-queuebot removed this pull request from themerge queue due to failed status checksNov 20, 2025
@DeagleGrossDeagleGross added this pull request to themerge queueNov 20, 2025
@github-merge-queuegithub-merge-queuebot removed this pull request from themerge queue due to failed status checksNov 20, 2025
@DeagleGrossDeagleGross added this pull request to themerge queueNov 20, 2025
@github-merge-queuegithub-merge-queuebot removed this pull request from themerge queue due to failed status checksNov 20, 2025
@DeagleGrossDeagleGross added this pull request to themerge queueNov 21, 2025
Merged via the queue intomain with commit02b8ac2Nov 21, 2025
14 checks passed
@crickmancrickman deleted the dmkorolev/codeql-23 branchNovember 24, 2025 17:09
This was referencedDec 5, 2025
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

Copilot code reviewCopilotCopilot left review comments

@ReubenBondReubenBondReubenBond approved these changes

@victordibiavictordibiavictordibia approved these changes

@alliscodealliscodealliscode approved these changes

Assignees

@DeagleGrossDeagleGross

Labels

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@DeagleGross@ReubenBond@victordibia@alliscode@markwallace-microsoft

[8]ページ先頭

©2009-2025 Movatter.jp