-
Notifications
You must be signed in to change notification settings - Fork 3
Elig 403 ff api endpoints for create read and update foster families #356
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Elig 403 ff api endpoints for create read and update foster families #356
Conversation
…or-FosterFamily Fostercarer and child tables
…d-Update-Foster-Families
…ster-Families' into ELIG-2563-Create-Foster-Family-Endpoint
…ly-Endpoint Create Foster Family endpoint, basic setup
…d-Update-Foster-Families
Elig 2564 read foster family
| } | ||
| catch (Exception ex) | ||
| { | ||
| _logger.LogError(ex, "Error retrieving foster family with GUID: -", guid); |
Check failure
Code scanning / CodeQL
Log entries created from user input High
user-provided value
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
To fix the problem, sanitize the user-provided guid before including it in any log entries. For plain-text logs, this typically means removing line breaks and other control characters that could be interpreted as log delimiters, and optionally trimming whitespace. We should also avoid altering the behavior of the application itself, so the original guid value must still be used for the database query and exceptions; only the logged representation should be sanitized.
The best minimal fix here is to introduce a local sanitized variable inside GetFosterFamily, derived from guid by removing \r and \n (and optionally trimming). Then use this sanitized variable in the _logger.LogError call while leaving all other logic untouched. We do not need new imports; string.Replace and string.Trim are part of the BCL. Concretely, inside GetFosterFamily(string guid), right before the try (or at the top of the method), define var safeGuid = guid?.Replace("\r", "").Replace("\n", "").Trim(); and change the logging call on line 84 to use safeGuid instead of guid. No other files strictly need changes; the controller already sanitizes guid in its own logging statement using Replace(Environment.NewLine, "").
-
Copy modified lines R67-R70 -
Copy modified line R88
| @@ -64,6 +64,10 @@ | ||
|
|
||
| public async Task<FosterFamilyResponse?> GetFosterFamily(string guid) | ||
| { | ||
| var safeGuid = guid? | ||
| .Replace("\r", string.Empty) | ||
| .Replace("\n", string.Empty) | ||
| .Trim(); | ||
|
|
||
| try | ||
| { | ||
| @@ -81,7 +85,7 @@ | ||
| } | ||
| catch (Exception ex) | ||
| { | ||
| _logger.LogError(ex, "Error retrieving foster family with GUID: -", guid); | ||
| _logger.LogError(ex, "Error retrieving foster family with GUID: -", safeGuid); | ||
| throw new NotFoundException($"Unable to find foster family: - {guid}, {ex.Message}"); | ||
| } | ||
|
|
No description provided.