Skip to content

.NET: Sanitize user input in log statements for durable agent samples#4656

Merged
kshyju merged 1 commit intomainfrom
shkr/scan-55
Mar 13, 2026
Merged

.NET: Sanitize user input in log statements for durable agent samples#4656
kshyju merged 1 commit intomainfrom
shkr/scan-55

Conversation

@kshyju
Copy link
Contributor

@kshyju kshyju commented Mar 12, 2026

Description

Sanitize user input in log statements for durable agent samples.

Contribution Checklist

  • The code builds clean without any errors or warnings
  • The PR follows the Contribution Guidelines
  • All unit tests pass, and I have added new tests where possible
  • Is this a breaking change? If yes, add "[BREAKING]" prefix to the title of the PR.

Copilot AI review requested due to automatic review settings March 12, 2026 18:02
@github-actions github-actions bot changed the title Sanitize user input in log statements for durable agent samples .NET: Sanitize user input in log statements for durable agent samples Mar 12, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds log sanitization to two durable agent Azure Functions samples to prevent log forging/injection attacks by stripping \r and \n from user-provided values before they are included in structured log statements.

Changes:

  • Added SanitizeLogValue helper methods to Tools.cs (non-nullable) and FunctionTriggers.cs (nullable) to strip carriage return and newline characters from log parameters.
  • Wrapped user-provided values (topic, instanceId, conversationId, cursor) with SanitizeLogValue() in all log statements across both files.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
dotnet/samples/.../06_LongRunningTools/Tools.cs Sanitizes topic and instanceId in log calls; adds non-nullable SanitizeLogValue helper
dotnet/samples/.../08_ReliableStreaming/FunctionTriggers.cs Sanitizes conversationId and cursor in log calls; adds nullable SanitizeLogValue helper

@kshyju kshyju requested a review from cgillum March 12, 2026 18:17
@kshyju kshyju added this pull request to the merge queue Mar 13, 2026
Merged via the queue into main with commit 83ce6a9 Mar 13, 2026
26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants