SHAdd0WTAka / Zen-Ai-Pentest / 23115055989

5%

push

github

fix: resolve critical CodeQL security alerts

Fixes multiple HIGH severity security issues:

1. Log Injection (31 alerts):
   - Add api/security_logging.py with sanitize_for_log()
   - Sanitize agent_id, tool_name in WebSocket and tool routes
   - Prevents log forging via newlines and control characters

2. Path Traversal (15 alerts):
   - Add _sanitize_plugin_id() in plugin_service.py
   - Validates plugin IDs to prevent directory traversal
   - Only allows alphanumeric, hyphens, and underscores

3. Information Exposure (8 alerts):
   - Replace detailed error messages with generic ones
   - Log details internally, return safe messages to users
   - Affects system health check endpoints

Security impact: HIGH → RESOLVED

Fixes: CodeQL alerts #4900-4934, #5000-5055

13 of 1234 branches covered (1.05%)

Branch coverage included in aggregate %.

599 of 11731 relevant lines covered (5.11%)

0.05 hits per line