From 14437fd568cab2321993c3f05ebca622e4d019dc Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Sat, 29 Aug 2026 23:13:24 +0200 Subject: [PATCH] fix(example-dlna-server): sanitize logged request values CodeQL alert 313 (go/log-injection). The access-log middleware logged r.URL.Path and SOAP-body-derived objectID/browseFlag verbatim, without stripping newlines -- an attacker-controlled request could inject fake log lines or control characters. Add the same sanitizeLog helper this repo already uses in ~18 other packages for exactly this class of finding. Alert 312 (go/reflected-xss, same file/area) was investigated and left open deliberately: objectID is only ever used as a lookup key in pkg/dlna/dlnatest, never echoed into the response, and every actual output field goes through xmlEsc/xmlAttr (encoding/xml.EscapeText) before being written -- looks like a CodeQL false positive rather than a real gap, but not dismissing it yet per discussion. Co-Authored-By: Claude Sonnet 5 --- cmd/example-dlna-server/logutil.go | 13 +++++++++++++ cmd/example-dlna-server/main.go | 6 +++--- 2 files changed, 16 insertions(+), 3 deletions(-) create mode 100644 cmd/example-dlna-server/logutil.go diff --git a/cmd/example-dlna-server/logutil.go b/cmd/example-dlna-server/logutil.go new file mode 100644 index 00000000..bd484699 --- /dev/null +++ b/cmd/example-dlna-server/logutil.go @@ -0,0 +1,13 @@ +package main + +import "strings" + +// sanitizeLog strips newline characters from s to prevent log-injection +// (CodeQL go/log-injection). Values from HTTP requests may contain +// attacker-controlled newlines. +func sanitizeLog(s string) string { + s = strings.ReplaceAll(s, "\n", `\n`) + s = strings.ReplaceAll(s, "\r", `\r`) + + return s +} diff --git a/cmd/example-dlna-server/main.go b/cmd/example-dlna-server/main.go index 22a3e4b9..d1bd47c2 100644 --- a/cmd/example-dlna-server/main.go +++ b/cmd/example-dlna-server/main.go @@ -654,8 +654,8 @@ func withAccessLog(logger *slog.Logger, next http.Handler) http.Handler { r.Body = io.NopCloser(bytes.NewReader(body)) browseAttrs = []any{ - "objectID", between(string(body), "", ""), - "browseFlag", between(string(body), "", ""), + "objectID", sanitizeLog(between(string(body), "", "")), + "browseFlag", sanitizeLog(between(string(body), "", "")), } } @@ -664,7 +664,7 @@ func withAccessLog(logger *slog.Logger, next http.Handler) http.Handler { attrs := []any{ "method", r.Method, - "path", r.URL.Path, + "path", sanitizeLog(r.URL.Path), "status", rec.status, "bytes", rec.bytes, "from", r.RemoteAddr,