Fix log injection and information disclosure vulnerabilities

[Copilot]

Security audit of the codebase identified two classes of vulnerabilities: log forging via embedded newlines in user-controlled input, and exception message leakage to RESP clients.

Log injection in FileLoggerProvider (CWE-117)

FileLoggerOutput.Log() wrote formatter output directly to file without sanitizing newlines. RESP commands like DEBUG LOG or CLIENT KILL accept arbitrary user input that flows into structured logging parameters — an attacker could inject fake log entries:

DEBUG LOG "benign\n[000.2026-01-01] (Error) <Security> Admin access granted from 10.0.0.1"

Fix: escape \r\n, \r, \n in the formatted message before writing. Exception stack traces (appended separately) are unaffected.

var formattedMessage = (formatter(state, exception) ?? string.Empty)
    .Replace("\r\n", "\\r\\n")
    .Replace("\r", "\\r")
    .Replace("\n", "\\n");

Information disclosure in error responses (CWE-209)

• ACL SAVE and PURGEBP catch handlers forwarded raw ex.Message to clients via TryWriteError($"ERR {ex.Message}", ...), potentially exposing file paths, OS details, or internal state.
• Replaced with static generic error messages. Full exceptions remain in server-side logs.

Tests

• FileLoggerOutputTests — verifies newlines are escaped, exceptions preserve real newlines, and normal messages pass through unchanged.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.