Conversation
# Reviewed, transaction id: 49711
fix: 限制server请求url
# Reviewed, transaction id: 50255
fix: unzip解压处理
# Reviewed, transaction id: 58097
feat: --story=127136780 支持在数据库配置允许远程函数访问的主域名
# Reviewed, transaction id: 59666
feat: --story=127795383 vue3项目预览时， 容器样式隔离不生效 & 对接新版bkvision
# Reviewed, transaction id: 60455
feat: 防范属性输入公共方法抽取 & 升级axios版本
# Reviewed, transaction id: 64339
feat: xss防护
# Reviewed, transaction id: 65983
feat: --story=128886695 升级typeorm
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| if (!isSafePropertyKey(key)) { | ||
| if (strict) { | ||
| console.warn(`[Security] Rejected unsafe property key: ${key}`) |
Check warning
Code scanning / CodeQL
Log injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix this log injection problem, the specific line (console.warn at line 105 in lib/shared/security/property-injection-guard.js and the similar usage at line 81) should sanitize the key value before writing it to the logs.
The recommended way, in case log files are plain text, is to remove line breaks (\n and \r) or replace them with a visible marker. Also, if the key is not a string for some reason, we should safely coerce it. The most straightforward fix is to replace all instances of ${key} with ${sanitizeForLog(key)}, where sanitizeForLog strips or escapes problematic characters.
This can be achieved by:
- Adding a helper function
sanitizeForLoginlib/shared/security/property-injection-guard.jsthat removes or encodes newline and carriage return characters from the string. - Rewriting log statements on lines 81 and 105 to use
sanitizeForLog(key)instead of interpolating the raw key value.
No external dependencies are required.
Suggested changeset
1
lib/shared/security/property-injection-guard.js
| @@ -3,6 +3,13 @@ | ||
| * @author LessCode Security Team | ||
| */ | ||
|
|
||
| // Helper to sanitize user input before logging (removes newline/carriage returns etc.) | ||
| function sanitizeForLog(value) { | ||
| if (typeof value !== 'string') value = String(value) | ||
| // Remove line breaks and carriage returns to avoid log injection | ||
| return value.replace(/[\r\n]/g, '') | ||
| } | ||
|
|
||
| // 禁止的属性名，这些属性可能被用于原型链污染攻击 | ||
| const FORBIDDEN_KEYS = [ | ||
| '__proto__', | ||
| @@ -78,7 +85,7 @@ | ||
| } | ||
| } else if (strict) { | ||
| // 严格模式下，记录不安全的属性但拒绝合并 | ||
| console.warn(`[Security] Rejected unsafe property key: ${key}`) | ||
| console.warn(`[Security] Rejected unsafe property key: ${sanitizeForLog(key)}`) | ||
| } | ||
| } | ||
| } | ||
| @@ -102,7 +109,7 @@ | ||
|
|
||
| if (!isSafePropertyKey(key)) { | ||
| if (strict) { | ||
| console.warn(`[Security] Rejected unsafe property key: ${key}`) | ||
| console.warn(`[Security] Rejected unsafe property key: ${sanitizeForLog(key)}`) | ||
| return false | ||
| } | ||
| return false | ||
| @@ -128,7 +135,7 @@ | ||
| if (isSafePropertyKey(key)) { | ||
| callback(key, obj[key]) | ||
| } else if (strict) { | ||
| console.warn(`[Security] Skipped unsafe property key: ${key}`) | ||
| console.warn(`[Security] Skipped unsafe property key: ${sanitizeForLog(key)}`) | ||
| } | ||
| } | ||
| } |
Copilot is powered by AI and may make mistakes. Always verify output.
|
|
ielgnaw
approved these changes
Nov 27, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.