CodeQL: Sanitize log entries created from user input (#1203)

Co-authored-by: claudiamurialdo <c.murialdo@globant.com>

Author: claudiamurialdo

dotnet/src/dotnetframework/GxClasses/Core/GXApplication.cs

@@ -3721,7 +3721,7 @@ internal string ClientTimeZoneId
 				if (!DateTimeUtil.ValidTimeZone(sTZ))
 				{
 					sTZ = (string)GetUndecodedCookie(GX_REQUEST_TIMEZONE);
-					GXLogging.Debug(Logger, "Try reading undecoded ClientTimeZone GX_REQUEST_TIMEZONE cookie:", sTZ);
+					GXLogging.DebugSanitized(Logger, "Try reading undecoded ClientTimeZone GX_REQUEST_TIMEZONE cookie:", sTZ);
 				}
 				try
 				{
@@ -3733,7 +3733,7 @@ internal string ClientTimeZoneId
 						}
 						catch (Exception ex)//DateTimeZoneNotFound
 						{
-							GXLogging.Warn(Logger, $"Client timezone not found: {sTZ}", ex);
+							GXLogging.WarnSanitized(Logger, ex, $"Client timezone not found: {sTZ}");
 						}
 						_currentTimeZoneId = DateTimeZoneProviders.Tzdb.GetSystemDefault().Id;
 						GXLogging.Warn(Logger, $"Setting Client timezone to System default: {_currentTimeZoneId}");

dotnet/src/dotnetframework/GxClasses/Data/GXDataCommon.cs

@@ -940,7 +940,7 @@ protected static byte[] GetBinary(string fileNameParm, bool dbBlob)
 							}
 							break;
 						default:
-							GXLogging.Error(log, "Schema not supported: ", fileName);
+							GXLogging.WarnSanitized(log, "Schema not supported: ", fileName);
 							break;
 					}				
 					GXLogging.Debug(log, "GetBinary fileName ", uri.AbsolutePath, ",ReadBytes:", binary != null ? binary.Length.ToString() : "0");

dotnet/src/dotnetframework/GxClasses/Helpers/GXLogging.cs

@@ -844,6 +844,18 @@ internal static void WarnSanitized(IGXLogger log, string msg, params string[] li
 				log.LogWarning(strBuilder.ToString());
 			}
 		}
+		internal static void WarnSanitized(IGXLogger log, Exception ex, params string[] list)
+		{
+			if (log.IsDebugEnabled)
+			{
+				StringBuilder strBuilder = new StringBuilder();
+				foreach (string parm in list)
+				{
+					strBuilder.Append(StringUtil.Sanitize(parm, StringUtil.LogUserEntryWhiteList));
+				}
+				log.LogWarning(ex, strBuilder.ToString());
+			}
+		}
 		public static void Warn(IGXLogger logger, string msg, params string[] list)
 		{
 			if (logger != null)