You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "cziegeler (via GitHub)" <gi...@apache.org> on 2026/06/01 13:06:42 UTC

[PR] fix(auth): sanitize redirect target in log messages to prevent log injection [sling-org-apache-sling-auth-core]

cziegeler opened a new pull request, #25:
URL: https://github.com/apache/sling-org-apache-sling-auth-core/pull/25

   Prevents log injection attacks by sanitizing user-controlled values before they are passed to log statements in `isRedirectValid`.
   
   - Add `sanitizeForLog` helper that escapes `\r` and `\n` characters in strings
   - Sanitize `target` into `sanitizedTarget` before all warning log calls in both overloads of `isRedirectValid`
   - Sanitize `ctxPath` into `sanitizedCtxPath` at the point of use in the two log sites that include the context path
   - No change to validation logic or return values — only log arguments are affected
   
   Co-authored-by: Maia <ma...@noreply>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(auth): sanitize redirect target in log messages to prevent log injection [sling-org-apache-sling-auth-core]

Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #25:
URL: https://github.com/apache/sling-org-apache-sling-auth-core/pull/25#issuecomment-4593705892

   ## [![Quality Gate Failed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-failed-20px.png 'Quality Gate Failed')](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-auth-core&pullRequest=25) **Quality Gate failed**  
   Failed conditions  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/failed-16px.png '') [52.9% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-auth-core&pullRequest=25&metric=new_coverage&view=list) (required ≥ 80%)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/failed-16px.png '') [74.1% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-auth-core&pullRequest=25&metric=new_duplicated_lines_density&view=list) (required ≤ 3%)  
     
   <!-- sqra:qg_revision=ab18911b9dc04e50bc05779c642bc1af0df36743ec7ea09784d99b554e87c0a7 -->
   <!-- sqra-placement-anchor -->
   [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-auth-core&pullRequest=25)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(auth): sanitize redirect target in log messages to prevent log injection [sling-org-apache-sling-auth-core]

Posted by "cziegeler (via GitHub)" <gi...@apache.org>.
cziegeler merged PR #25:
URL: https://github.com/apache/sling-org-apache-sling-auth-core/pull/25


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org