Skip to content

SonarCloud fix: javasecurity:S5145 Logging should not be vulnerable to injection attacks #10511

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

CDellaGiusta
Copy link
Contributor

@CDellaGiusta CDellaGiusta commented Jun 26, 2025

What does this PR change?

SonarCloud error reduction fix, rule javasecurity:S5145 Logging should not be vulnerable to injection attacks

Log injection occurs when an application fails to sanitize untrusted data used for logging.
An attacker can forge log content to prevent an organization from being able to trace back malicious activities.

GUI diff

No difference.

  • DONE

Documentation

  • No documentation needed: only internal and user invisible changes
  • DONE

Test coverage

  • No tests: already covered
  • DONE

Links

Issue(s): #9878
Port(s): not backported

  • DONE

Changelogs

  • No changelog needed

If you uncheck the checkbox after the PR is created, you will need to re-run changelog_test (see below)

Re-run a test

If you need to re-run a test, please mark the related checkbox, it will be unchecked automatically once it has re-run:

  • Re-run test "changelog_test"
  • Re-run test "backend_unittests_pgsql"
  • Re-run test "java_pgsql_tests"
  • Re-run test "schema_migration_test_pgsql"
  • Re-run test "susemanager_unittests"
  • Re-run test "javascript_lint"
  • Re-run test "spacecmd_unittests"

@CDellaGiusta CDellaGiusta requested a review from a team as a code owner June 26, 2025 05:53
@CDellaGiusta CDellaGiusta requested review from nadvornik and removed request for a team June 26, 2025 05:53
@CDellaGiusta CDellaGiusta self-assigned this Jun 26, 2025
@github-actions github-actions bot added the java label Jun 26, 2025
@CDellaGiusta CDellaGiusta removed the request for review from nadvornik June 26, 2025 05:53
Copy link
Contributor

👋 Hello! Thanks for contributing to our project.
Acceptance tests will take some time (aprox. 1h), please be patient ☕

You can see the progress at the end of this page and at https://github.com/uyuni-project/uyuni/pull/10511/checks
Once tests finish, if they fail, you can check 👀 the cucumber report. See the link at the output of the action.
You can also check the artifacts section, which contains the logs at https://github.com/uyuni-project/uyuni/pull/10511/checks.

If you are unsure the failing tests are related to your code, you can check the "reference jobs". These are jobs that run on a scheduled time with code from master. If they fail for the same reason as your build, it means the tests or the infrastructure are broken. If they do not fail, but yours do, it means it is related to your code.

Reference tests:

KNOWN ISSUES

Sometimes the build can fail when pulling new jar files from download.opensuse.org . This is a known limitation. Given this happens rarely, when it does, all you need to do is rerun the test. Sorry for the inconvenience.

For more tips on troubleshooting, see the troubleshooting guide.

Happy hacking!
⚠️ You should not merge if acceptance tests fail to pass. ⚠️

@CDellaGiusta CDellaGiusta requested review from cbosdo and lucidd June 26, 2025 08:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants