-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Closed
Assignees
Labels
@antoineco
Description
Description of the false positive
CodeQL reports (via GitHub integration) that the following log write receives unsanitized user input:
switch eventType := sanitizeUserInput(event.Type); eventType { // ... default: h.logger.Warn("Content not supported: ", strconv.Quote(eventType)) // <-- false positive 'go/log-injection' }
This is untrue.
The user input is explicitly sanitized at the beginning of the switch case (in fact, we fixed it earlier this year thanks to CodeQL! 🙌 ):
var newlineToSpace = strings.NewReplacer("\n", " ", "\r", " ") // sanitizeUserInput removes unwanted characters from the given string. // It also guarantees the safe logging of data that potentially originates from // user input (CWE-117, https://cwe.mitre.org/data/definitions/117.html). func sanitizeUserInput(s string) string { return newlineToSpace.Replace(s) }