preserve(security): weaker temporal log-forging repair pending #1055

.jules/sentinel.md

@@ -28,3 +28,8 @@
 **Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching.
 **Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities.
 **Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards.
+
+## 2025-02-14 - Log Injection / Log Forging (CWE-117) via Unsanitized Input
+**Vulnerability:** Untrusted file paths were logged directly using f-strings without sanitization, allowing log forging/injection via control characters (e.g., newlines) in the path.
+**Learning:** File paths can contain arbitrary characters, including newlines, which attackers can use to inject malicious log entries and manipulate log-based monitoring systems. F-strings also bypass deferred string interpolation.
+**Prevention:** Always sanitize untrusted input using `repr()` before logging, and use deferred string interpolation (e.g., `logger.info("msg %s", repr(var))`) instead of f-strings to align with logging best practices.

services/analysis-engine/src/bandscope_analysis/temporal/analyzer.py

@@ -73,7 +73,7 @@ def analyze(self, audio_path: str | Path) -> TemporalFeatures:
         if not path.exists() or not path.is_file():
             raise FileNotFoundError(f"Audio file not found: {path_str}")
 
-        logger.info(f"Loading and decoding audio: {path_str}")
+        logger.info("Loading and decoding audio: %s", repr(path_str))
 
         try:
             with path.open("rb") as fileobj:
@@ -128,7 +128,7 @@ def analyze(self, audio_path: str | Path) -> TemporalFeatures:
 
             bpm_val = float(tempo[0]) if isinstance(tempo, np.ndarray) else float(tempo)
 
-            logger.info(f"Analysis complete: {bpm_val:.1f} BPM, {len(beat_times)} beats detected.")
+            logger.info("Analysis complete: %.1f BPM, %d beats detected.", bpm_val, len(beat_times))
 
             return {
                 "bpm": bpm_val,
@@ -140,5 +140,5 @@ def analyze(self, audio_path: str | Path) -> TemporalFeatures:
             }
 
         except Exception as e:
-            logger.error(f"Failed to analyze audio {path_str}: {e}")
+            logger.error("Failed to analyze audio %s: %s", repr(path_str), e)
             raise ValueError(f"Temporal analysis failed: {e}") from e