René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"False positive in `go/log-injection`","articleBody":"**Description of the false positive**\r\n\r\n📄 [Code snippet](https://github.com/triggermesh/triggermesh/blob/c8ed975ea7d2538ff32c79884d319fc8f408532e/pkg/sources/adapter/slacksource/slack.go#L128-L148)\r\n\r\nCodeQL reports (via [GitHub integration](https://github.com/github/codeql-action)) that the following log write receives unsanitized user input:\r\n\r\n```go\r\nswitch eventType := sanitizeUserInput(event.Type); eventType {\r\n// ...\r\ndefault:\r\n\th.logger.Warn(\"Content not supported: \", strconv.Quote(eventType))  // \u003c-- false positive 'go/log-injection'\r\n}\r\n```\r\n\r\nThis is untrue.\r\nThe user input is explicitly sanitized at the beginning of the switch case (in fact, we fixed it earlier this year thanks to CodeQL! 🙌 ):\r\n\r\n```go\r\nvar newlineToSpace = strings.NewReplacer(\"\\n\", \" \", \"\\r\", \" \")\r\n\r\n// sanitizeUserInput removes unwanted characters from the given string.\r\n// It also guarantees the safe logging of data that potentially originates from\r\n// user input (CWE-117, https://cwe.mitre.org/data/definitions/117.html).\r\nfunc sanitizeUserInput(s string) string {\r\n\treturn newlineToSpace.Replace(s)\r\n}\r\n```","author":{"url":"https://github.com/antoineco","@type":"Person","name":"antoineco"},"datePublished":"2022-05-03T08:33:35.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/9016/codeql/issues/9016"}