Update dependencies and create new session on reconnect rather than trying to recreate session #2375
Conversation
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -921,22 +969,25 @@ | |||
| { | |||
| case SessionState.Connected: // only valid when connected. | |||
| Debug.Assert(_reconnectHandler.State == SessionReconnectHandler.ReconnectState.Ready); | |||
| _logger.LogInformation("{Client}: Reconnecting session {Session} due to {Reason}...", | |||
| this, _sessionName, (context is ServiceResult sr) ? "error " + sr : "RESET"); | |||
Check failure
Code scanning / CodeQL
Log entries created from user input High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 4 hours ago
To fix the problem, we need to sanitize the user input before logging it. Specifically, we should remove any newline characters from the _sessionName variable to prevent log forging. This can be done using the String.Replace method to replace newline characters with an empty string.
The best way to fix the problem without changing existing functionality is to modify the logging statements to sanitize the _sessionName variable. This involves updating the logging statements on lines 973 and 979 to use a sanitized version of _sessionName.
| @@ -971,4 +971,5 @@ | ||
| Debug.Assert(_reconnectHandler.State == SessionReconnectHandler.ReconnectState.Ready); | ||
| var sanitizedSessionName = _sessionName?.Replace(Environment.NewLine, "").Replace("\n", "").Replace("\r", ""); | ||
| _logger.LogInformation("{Client}: Reconnecting session {Session} due to {Reason}...", | ||
| this, _sessionName, (context is ServiceResult sr) ? "error " + sr : "RESET"); | ||
| this, sanitizedSessionName, (context is ServiceResult sr) ? "error " + sr : "RESET"); | ||
|
|
||
| @@ -978,3 +979,3 @@ | ||
| _logger.LogInformation("{Client}: Begin reconnecting session {Session}...", | ||
| this, _sessionName); | ||
| this, sanitizedSessionName); | ||
| Debug.Assert(_session != null); |
| _logger.LogInformation("{Client}: Reconnecting session {Session} due to {Reason}...", | ||
| this, _sessionName, (context is ServiceResult sr) ? "error " + sr : "RESET"); | ||
| _logger.LogInformation("{Client}: Begin reconnecting session {Session}...", | ||
| this, _sessionName); |
Check failure
Code scanning / CodeQL
Log entries created from user input High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 4 hours ago
To fix the problem, we need to sanitize the user input before logging it. Specifically, we should remove any newline characters from the _sessionName to prevent log forging. This can be done using the Replace method to ensure that no new lines are present in the user input.
- Identify the lines where
_sessionNameis logged. - Sanitize
_sessionNameby replacing newline characters with an empty string before logging it. - Ensure that the sanitization does not alter the existing functionality of the application.
| @@ -972,3 +972,3 @@ | ||
| _logger.LogInformation("{Client}: Reconnecting session {Session} due to {Reason}...", | ||
| this, _sessionName, (context is ServiceResult sr) ? "error " + sr : "RESET"); | ||
| this, _sessionName?.Replace(Environment.NewLine, ""), (context is ServiceResult sr) ? "error " + sr : "RESET"); | ||
|
|
||
| @@ -978,3 +978,3 @@ | ||
| _logger.LogInformation("{Client}: Begin reconnecting session {Session}...", | ||
| this, _sessionName); | ||
| this, _sessionName?.Replace(Environment.NewLine, "")); | ||
| Debug.Assert(_session != null); |
| @@ -962,6 +1013,8 @@ | |||
| switch (currentSessionState) | |||
| { | |||
| case SessionState.Reconnecting: | |||
| _logger.LogInformation("{Client}: Completed reconnecting session {Session}...", | |||
| this, _sessionName); | |||
Check failure
Code scanning / CodeQL
Log entries created from user input High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 4 hours ago
To fix the problem, we need to sanitize the _sessionName variable before logging it. This can be done by removing any newline characters from the user input to prevent log forging. We will use the Replace method to remove newline characters from _sessionName before it is logged.
- Identify the line where
_sessionNameis logged. - Sanitize
_sessionNameby replacing newline characters with an empty string. - Ensure that the sanitization does not alter the existing functionality of the code.
| @@ -1015,4 +1015,5 @@ | ||
| case SessionState.Reconnecting: | ||
| var sanitizedSessionName = _sessionName?.Replace(Environment.NewLine, "").Replace("\n", "").Replace("\r", ""); | ||
| _logger.LogInformation("{Client}: Completed reconnecting session {Session}...", | ||
| this, _sessionName); | ||
| this, sanitizedSessionName); | ||
| // |
No description provided.