diff --git a/app/quickapi.py b/app/quickapi.py index 875a312..15e264f 100644 --- a/app/quickapi.py +++ b/app/quickapi.py @@ -40,7 +40,10 @@ async def create_item(item: UserColorEntry): """Create an item with a username and users favourite colour and return it.""" user_colour.append(item) print(user_colour) - logger.info(item) + # Sanitize log message to prevent log injection + sanitized_username = item.name.replace('\r\n', '').replace('\n', '') + sanitized_color = item.favorite_color.replace('\r\n', '').replace('\n', '') + logger.info("New user-color entry added: name=%s, favorite_colour=%s", sanitized_username, sanitized_color) return item # List all user_colour mappings