From 063f6caaad053cbd04b0d247d285b5187df2b5f8 Mon Sep 17 00:00:00 2001 From: Gasic Gaming Date: Sat, 18 Apr 2026 20:19:47 -0500 Subject: [PATCH 1/3] Potential fix for code scanning alert no. 82: Log injection Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- fixtures/flight/server/global.js | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fixtures/flight/server/global.js b/fixtures/flight/server/global.js index 0883faf627cf..0d7d316561a8 100644 --- a/fixtures/flight/server/global.js +++ b/fixtures/flight/server/global.js @@ -86,6 +86,10 @@ function request(options, body) { }); } +function sanitizeForLog(value) { + return String(value).replace(/[\r\n]+/g, ' '); +} + async function renderApp(req, res, next) { // Proxy the request to the regional server. const proxiedHeaders = { @@ -202,7 +206,8 @@ async function renderApp(req, res, next) { }, }); } catch (e) { - console.error(`Failed to SSR: ${e.stack}`); + const safeStack = sanitizeForLog(e && e.stack ? e.stack : e); + console.error(`Failed to SSR: ${safeStack}`); res.statusCode = 500; res.end(); } @@ -219,7 +224,8 @@ async function renderApp(req, res, next) { res.end(); }); } catch (e) { - console.error(`Failed to proxy request: ${e.stack}`); + const safeStack = sanitizeForLog(e && e.stack ? e.stack : e); + console.error(`Failed to proxy request: ${safeStack}`); res.statusCode = 500; res.end(); } From 3a579a5278f6314bafbf946ebb142707b8bb1276 Mon Sep 17 00:00:00 2001 From: SoftwareExplorer6600 Date: Sun, 30 Aug 2026 20:04:19 -0500 Subject: [PATCH 2/3] Potential fix for pull request finding 'CodeQL / Log injection' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- fixtures/flight/server/global.js | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fixtures/flight/server/global.js b/fixtures/flight/server/global.js index 0d7d316561a8..4b8caaddc0b3 100644 --- a/fixtures/flight/server/global.js +++ b/fixtures/flight/server/global.js @@ -87,7 +87,10 @@ function request(options, body) { } function sanitizeForLog(value) { - return String(value).replace(/[\r\n]+/g, ' '); + return String(value) + .replace(/[\r\n]+/g, ' ') + .replace(/[\x00-\x1F\x7F]+/g, ' ') + .trim(); } async function renderApp(req, res, next) { From 2c123cdaa4401f10761e5eedb6e66b903123bd96 Mon Sep 17 00:00:00 2001 From: SoftwareExplorer6600 Date: Sun, 30 Aug 2026 20:04:29 -0500 Subject: [PATCH 3/3] Potential fix for pull request finding 'CodeQL / Log injection' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- fixtures/flight/server/global.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fixtures/flight/server/global.js b/fixtures/flight/server/global.js index 4b8caaddc0b3..039e1a0e49e1 100644 --- a/fixtures/flight/server/global.js +++ b/fixtures/flight/server/global.js @@ -227,8 +227,7 @@ async function renderApp(req, res, next) { res.end(); }); } catch (e) { - const safeStack = sanitizeForLog(e && e.stack ? e.stack : e); - console.error(`Failed to proxy request: ${safeStack}`); + console.error('Failed to proxy request.'); res.statusCode = 500; res.end(); }