merge: merge develop to master #1483
Conversation
# Reviewed, transaction id: 49711
fix: 限制server请求url
# Reviewed, transaction id: 50255
fix: unzip解压处理
# Reviewed, transaction id: 58097
feat: --story=127136780 支持在数据库配置允许远程函数访问的主域名
# Reviewed, transaction id: 59666
feat: --story=127795383 vue3项目预览时， 容器样式隔离不生效 & 对接新版bkvision
# Reviewed, transaction id: 60455
feat: 防范属性输入公共方法抽取 & 升级axios版本
# Reviewed, transaction id: 64339
feat: xss防护
# Reviewed, transaction id: 65983
feat: --story=128886695 升级typeorm
![github-advanced-security[bot]](https://waps.l3s.uni-hannover.de/live/im_/https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| if (!isSafePropertyKey(key)) { | ||
| if (strict) { | ||
| console.warn(`[Security] Rejected unsafe property key: ${key}`) |
Check warning
Code scanning / CodeQL
Log injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To fix this log injection problem, the specific line (console.warn at line 105 in lib/shared/security/property-injection-guard.js and the similar usage at line 81) should sanitize the key value before writing it to the logs.
The recommended way, in case log files are plain text, is to remove line breaks (\n and \r) or replace them with a visible marker. Also, if the key is not a string for some reason, we should safely coerce it. The most straightforward fix is to replace all instances of ${key} with ${sanitizeForLog(key)}, where sanitizeForLog strips or escapes problematic characters.
This can be achieved by:
- Adding a helper function
sanitizeForLoginlib/shared/security/property-injection-guard.jsthat removes or encodes newline and carriage return characters from the string. - Rewriting log statements on lines 81 and 105 to use
sanitizeForLog(key)instead of interpolating the raw key value.
No external dependencies are required.
| @@ -3,6 +3,13 @@ | ||
| * @author LessCode Security Team | ||
| */ | ||
|
|
||
| // Helper to sanitize user input before logging (removes newline/carriage returns etc.) | ||
| function sanitizeForLog(value) { | ||
| if (typeof value !== 'string') value = String(value) | ||
| // Remove line breaks and carriage returns to avoid log injection | ||
| return value.replace(/[\r\n]/g, '') | ||
| } | ||
|
|
||
| // 禁止的属性名，这些属性可能被用于原型链污染攻击 | ||
| const FORBIDDEN_KEYS = [ | ||
| '__proto__', | ||
| @@ -78,7 +85,7 @@ | ||
| } | ||
| } else if (strict) { | ||
| // 严格模式下，记录不安全的属性但拒绝合并 | ||
| console.warn(`[Security] Rejected unsafe property key: ${key}`) | ||
| console.warn(`[Security] Rejected unsafe property key: ${sanitizeForLog(key)}`) | ||
| } | ||
| } | ||
| } | ||
| @@ -102,7 +109,7 @@ | ||
|
|
||
| if (!isSafePropertyKey(key)) { | ||
| if (strict) { | ||
| console.warn(`[Security] Rejected unsafe property key: ${key}`) | ||
| console.warn(`[Security] Rejected unsafe property key: ${sanitizeForLog(key)}`) | ||
| return false | ||
| } | ||
| return false | ||
| @@ -128,7 +135,7 @@ | ||
| if (isSafePropertyKey(key)) { | ||
| callback(key, obj[key]) | ||
| } else if (strict) { | ||
| console.warn(`[Security] Skipped unsafe property key: ${key}`) | ||
| console.warn(`[Security] Skipped unsafe property key: ${sanitizeForLog(key)}`) | ||
| } | ||
| } | ||
| } |
|
|
No description provided.