Clear the 19 py/log-injection CodeQL alerts on V2

application/single_app/config.py

@@ -100,7 +100,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.261.215"
+VERSION = "0.261.216"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 # Opt-out for deployments where App Service Easy Auth is active but the platform

application/single_app/functions_appinsights.py

@@ -199,6 +199,8 @@ def sanitize_log_message(message: Any) -> str:
         message_text,
     )
     message_text = LOG_CONTROL_CHAR_RE.sub(" ", message_text)
+    # No-ops after the regex above; they make its line-break removal visible to static analysis.
+    message_text = message_text.replace("\r\n", " ").replace("\n", " ").replace("\r", " ")
     if len(message_text) > MAX_LOG_STRING_LENGTH:
         return f"{message_text[:MAX_LOG_STRING_LENGTH]}... [truncated]"
     return message_text

application/single_app/route_backend_plugins.py

@@ -2211,7 +2211,11 @@
 @admin_required
 def update_core_plugin_settings():
     data = request.get_json(force=True)
-    logging.info("Received plugin settings update request: %s", data)
+    # Plugin settings payloads can carry secrets, so only their size is logged.
+    log_event(
+        "[PLUGINS] Received plugin settings update request.",
+        extra={"field_count": len(data) if isinstance(data, dict) else 0},
+    )
     # Validate input
     expected_keys = [
         'enable_time_plugin',

application/single_app/route_backend_workflows.py

@@ -20,7 +20,7 @@
     log_workflow_deletion,
     log_workflow_update,
 )
-from functions_appinsights import log_event
+from functions_appinsights import log_event, sanitize_log_message
 from functions_authentication import get_current_user_id, get_current_user_info, login_required, user_required
 from functions_file_sync import (
     FILE_SYNC_MANAGER_ROLES,
@@ -1933,16 +1933,16 @@
         except LookupError:
             logging.exception(
                 "LookupError while cancelling personal workflow run. workflow_id=%s run_id=%s user_id=%s",
-                workflow_id,
-                run_id,
+                sanitize_log_message(workflow_id),
+                sanitize_log_message(run_id),
                 user_id,
             )
             return jsonify({'error': 'Workflow run not found.'}), 404
         except WorkflowCancellationConflictError:
             logging.exception(
                 "WorkflowCancellationConflictError while cancelling personal workflow run. workflow_id=%s run_id=%s user_id=%s",
-                workflow_id,
-                run_id,
+                sanitize_log_message(workflow_id),
+                sanitize_log_message(run_id),
                 user_id,
             )
             return jsonify({'error': 'Workflow run cancellation conflict.'}), 409
@@ -2355,21 +2355,21 @@
             logging.exception(
                 "Invalid group workflow request during cancellation. user_id=%s workflow_id=%s",
                 user_id,
-                workflow_id,
+                sanitize_log_message(workflow_id),
             )
             return jsonify({'error': 'Invalid group workflow request.'}), 400
         except LookupError as exc:
             logging.exception(
                 "Group workspace lookup failed during workflow cancellation. user_id=%s workflow_id=%s",
                 user_id,
-                workflow_id,
+                sanitize_log_message(workflow_id),
             )
             return jsonify({'error': 'Group workspace not found.'}), 404
         except PermissionError as exc:
             logging.exception(
                 "Unauthorized group workflow cancellation attempt. user_id=%s workflow_id=%s",
                 user_id,
-                workflow_id,
+                sanitize_log_message(workflow_id),
             )
             return jsonify({'error': 'Not authorized to access this group workspace.'}), 403
 

application/single_app/utils_cache.py

@@ -29,6 +29,7 @@
     cosmos_public_documents_container,
     cosmos_search_cache_container
 )
+from functions_appinsights import sanitize_log_message
 from azure.cosmos.exceptions import CosmosResourceNotFoundError
 
 logger = logging.getLogger(__name__)
@@ -212,7 +213,10 @@
         return fingerprint
 
     except Exception as e:
-        logger.error(f"Error generating group document fingerprint for group {group_id}: {e}")
+        logger.error(
+            f"Error generating group document fingerprint for group {sanitize_log_message(group_id)}: "
+            f"{sanitize_log_message(e)}"
+        )
         _debug_print(f"ERROR generating fingerprint: {e}", "FINGERPRINT", group_id=group_id[:8])
         return hashlib.sha256(str(datetime.now().timestamp()).encode()).hexdigest()
 
@@ -262,7 +266,10 @@
         return fingerprint
 
     except Exception as e:
-        logger.error(f"Error generating public workspace document fingerprint for workspace {public_workspace_id}: {e}")
+        logger.error(
+            "Error generating public workspace document fingerprint for workspace "
+            f"{sanitize_log_message(public_workspace_id)}: {sanitize_log_message(e)}"
+        )
         _debug_print(f"ERROR generating fingerprint: {e}", "FINGERPRINT", workspace_id=public_workspace_id[:8])
         return hashlib.sha256(str(datetime.now().timestamp()).encode()).hexdigest()
 
@@ -498,7 +505,10 @@
                 partition_key=partition_key[:25],
                 ttl_remaining=f"{seconds_remaining:.1f}s"
             )
-            logger.info(f"Cache hit for key: {cache_key} (scope: {doc_scope}, partition: {partition_key[:25]})")
+            logger.info(
+                f"Cache hit for key: {sanitize_log_message(cache_key)} "
+                f"(scope: {sanitize_log_message(doc_scope)}, partition: {sanitize_log_message(partition_key[:25])})"
+            )
             return results
         else:
             # Expired - delete from cache
@@ -568,7 +578,11 @@
             partition_key=partition_key[:25]
         )
 
-        logger.debug(f"Cached search results with key: {cache_key}, scope: {doc_scope}, partition: {partition_key[:25]}, ttl: {ttl_seconds}s, expires at: {expiry_time}")
+        logger.debug(
+            f"Cached search results with key: {sanitize_log_message(cache_key)}, "
+            f"scope: {sanitize_log_message(doc_scope)}, partition: {sanitize_log_message(partition_key[:25])}, "
+            f"ttl: {ttl_seconds}s, expires at: {expiry_time}"
+        )
     except Exception as e:
         logger.error(f"Error caching search results to Cosmos DB: {e}")
         _debug_print(f"Cache write ERROR: {e}", "CACHE", cache_key=cache_key[:16])
@@ -632,7 +646,7 @@
                 "INVALIDATION",
                 user_id=user_id[:8]
             )
-            logger.info(f"Invalidated {count} cache entries for user {user_id}")
+            logger.info(f"Invalidated {count} cache entries for user {sanitize_log_message(user_id)}")
 
         return count
 
@@ -708,6 +722,9 @@
                 "INVALIDATION",
                 group_id=group_id[:8]
             )
+            # Rebound rather than wrapped inline so the log line keeps its text, and the
+            # clear-text CodeQL alert already reported on it keeps its identity.
+            group_id = sanitize_log_message(group_id)
             logger.info(f"Invalidated {count} cache entries for group {group_id}")
 
         return count
@@ -773,7 +790,9 @@
                 "INVALIDATION",
                 workspace_id=public_workspace_id[:8]
             )
-            logger.info(f"Invalidated {count} cache entries for public workspace {public_workspace_id}")
+            logger.info(
+                f"Invalidated {count} cache entries for public workspace {sanitize_log_message(public_workspace_id)}"
+            )
 
         return count