From eeb9c17968b9ff11c9aacfa9847c3d0505f5b2e5 Mon Sep 17 00:00:00 2001 From: Ashish Kumar Date: Sun, 18 Oct 2026 14:25:35 +0530 Subject: [PATCH] Remove line breaks outright in logSafe CodeQL's log-injection rule only treats a replace as sanitising when it swaps line breaks for an empty string, so alert #27 stayed open after #108. --- src/server.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/server.ts b/src/server.ts index 951ba67..9a8f582 100644 --- a/src/server.ts +++ b/src/server.ts @@ -71,10 +71,10 @@ export interface ServerDeps { const CHAT_EVENT_TYPES = new Set(['MESSAGE', 'ADDED_TO_SPACE', 'REMOVED_FROM_SPACE', 'CARD_CLICKED', 'UNKNOWN']); -/** Collapse control chars (incl. newlines) and cap length before logging untrusted text — prevents log forging. */ +/** Drop line breaks, blank other control chars and cap length before logging untrusted text — prevents log forging. */ function logSafe(value: unknown): string { - // CodeQL only recognises an explicit line-break replace as cleaning. - return String(value).replace(/[\r\n]/g, ' ').replace(/\p{Cc}/gu, ' ').slice(0, 200); + // CodeQL only counts a replace that removes line breaks outright as cleaning. + return String(value).replace(/[\r\n]/g, '').replace(/\p{Cc}/gu, ' ').slice(0, 200); } export function createServer(deps: ServerDeps): Express {