From 90bb837a5dce64fe82db03ad474cc8d67d518716 Mon Sep 17 00:00:00 2001 From: Lukasz Raczylo Date: Thu, 20 Aug 2026 15:06:34 +0100 Subject: [PATCH] fix: escape request path in auth event logs logAuthEvent (logger.go) formatted r.URL.Path with %s in both the failure and success log lines. An unauthenticated client controls that path and can embed a raw newline (%0A) in it, letting a single request forge additional, attacker-chosen log lines. Switched both to %q, which escapes control characters (newlines included) while still rendering the path as a quoted string. No test changes needed: both existing tests (llmgateway_test.go) assert via strings.Contains on the bare path substring, which %q's quoted output still contains. Gates: go test ./... -count=1 green, gofmt -l . empty, go vet clean. --- logger.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/logger.go b/logger.go index af06bd9..1af1c0a 100644 --- a/logger.go +++ b/logger.go @@ -27,10 +27,10 @@ func (g *Gateway) errorf(format string, args ...any) { // key it authenticated. func (g *Gateway) logAuthEvent(ok bool, userName string, r *http.Request) { if !ok { - g.logf("auth failed: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr) + g.logf("auth failed: %s %q from %s", r.Method, r.URL.Path, r.RemoteAddr) return } - g.logf("auth ok: user %q %s %s", userName, r.Method, r.URL.Path) + g.logf("auth ok: user %q %s %q", userName, r.Method, r.URL.Path) } // authEventUserName extracts u's name for logAuthEvent's userName