Skip to content

CodeQL: Sanitize more log entries created from user input #1203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 8, 2025
Merged

CodeQL: Sanitize more log entries created from user input #1203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions dotnet/src/dotnetframework/GxClasses/Core/GXApplication.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3721,7 +3721,7 @@ internal string ClientTimeZoneId
if (!DateTimeUtil.ValidTimeZone(sTZ))
{
sTZ = (string)GetUndecodedCookie(GX_REQUEST_TIMEZONE);
GXLogging.Debug(Logger, "Try reading undecoded ClientTimeZone GX_REQUEST_TIMEZONE cookie:", sTZ);
GXLogging.DebugSanitized(Logger, "Try reading undecoded ClientTimeZone GX_REQUEST_TIMEZONE cookie:", sTZ);
}
try
{
Expand All @@ -3733,7 +3733,7 @@ internal string ClientTimeZoneId
}
catch (Exception ex)//DateTimeZoneNotFound
{
GXLogging.Warn(Logger, $"Client timezone not found: {sTZ}", ex);
GXLogging.WarnSanitized(Logger, ex, $"Client timezone not found: {sTZ}");
}
_currentTimeZoneId = DateTimeZoneProviders.Tzdb.GetSystemDefault().Id;
GXLogging.Warn(Logger, $"Setting Client timezone to System default: {_currentTimeZoneId}");
Expand Down
2 changes: 1 addition & 1 deletion dotnet/src/dotnetframework/GxClasses/Data/GXDataCommon.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -940,7 +940,7 @@ protected static byte[] GetBinary(string fileNameParm, bool dbBlob)
}
break;
default:
GXLogging.Error(log, "Schema not supported: ", fileName);
GXLogging.WarnSanitized(log, "Schema not supported: ", fileName);
break;
}
GXLogging.Debug(log, "GetBinary fileName ", uri.AbsolutePath, ",ReadBytes:", binary != null ? binary.Length.ToString() : "0");
Expand Down
12 changes: 12 additions & 0 deletions dotnet/src/dotnetframework/GxClasses/Helpers/GXLogging.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -844,6 +844,18 @@ internal static void WarnSanitized(IGXLogger log, string msg, params string[] li
log.LogWarning(strBuilder.ToString());
}
}
internal static void WarnSanitized(IGXLogger log, Exception ex, params string[] list)
{
if (log.IsDebugEnabled)
{
StringBuilder strBuilder = new StringBuilder();
foreach (string parm in list)
{
strBuilder.Append(StringUtil.Sanitize(parm, StringUtil.LogUserEntryWhiteList));
}
log.LogWarning(ex, strBuilder.ToString());
}
}
public static void Warn(IGXLogger logger, string msg, params string[] list)
{
if (logger != null)
Expand Down
Loading