Skip to content

Fail-safe JSON encoding, multibyte-safe redactions, and log injection prevention via newline/CR/tab sanitization in log headers.#7

Merged
gustavofreze merged 2 commits intomainfrom
feature/develop
Apr 21, 2026
Merged

Fail-safe JSON encoding, multibyte-safe redactions, and log injection prevention via newline/CR/tab sanitization in log headers.#7
gustavofreze merged 2 commits intomainfrom
feature/develop

Conversation

@gustavofreze
Copy link
Copy Markdown
Member

No description provided.

…ction prevention via newline/CR/tab sanitization in log headers.
…ction prevention via newline/CR/tab sanitization in log headers.
Copilot AI review requested due to automatic review settings April 21, 2026 21:27
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the structured logger by making JSON encoding fail-safe, improving redaction correctness for multibyte strings, and reducing log injection risk by escaping control characters in log header fields.

Changes:

  • Add fail-safe JSON encoding with a fallback payload when encoding fails, plus control-character escaping in log headers.
  • Update redaction strategies (email/name/phone/document) to be multibyte-aware and apply redactions recursively across nested context data.
  • Normalize project tooling/config (Composer normalization, mutation testing config, packaging/export ignores, editor/ignore files).

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
tests/StructuredLoggerTest.php Adds tests for encoding failure fallback, log header escaping, multibyte redactions, and recursive redaction behavior.
src/Redactions/PhoneRedaction.php Switches suffix masking to multibyte-safe operations.
src/Redactions/NameRedaction.php Switches prefix masking to multibyte-safe operations.
src/Redactions/EmailRedaction.php Makes @ detection and masking multibyte-safe.
src/Redactions/DocumentRedaction.php Switches suffix masking to multibyte-safe operations.
src/Internal/Redactor/Redactions.php Simplifies applying multiple redactions by reducing over the redaction collection.
src/Internal/LogFormatter.php Adds JSON_THROW_ON_ERROR handling with fallback payload and escapes \\n/\\r/\\t in header fields.
infection.json.dist Adjusts Infection mutators configuration.
composer.json Updates dependencies/dev tooling and plugin allow-list; reorganizes scripts/config.
Makefile Adds composer normalize, tweaks test-file help text, and introduces show-outdated.
.gitignore Expands ignore patterns (IDE/agents, Composer lock/vendor, coverage/build artifacts).
.github/copilot-instructions.md Adds Copilot guidance referencing .claude rule sources.
.gitattributes Adds LF normalization and refines export-ignore list for Packagist packaging.
.editorconfig Introduces consistent editor defaults (LF, indentation, whitespace rules).
.claude/rules/php-library-testing.md Adds repository-specific PHPUnit/BDD/testing rules.
.claude/rules/php-library-modeling.md Adds library modeling/architecture rules.
.claude/rules/php-library-documentation.md Adds documentation standards for markdown docs.
.claude/rules/php-library-code-style.md Adds PHP code-style rules and constraints.
.claude/rules/github-workflows.md Adds conventions for GitHub Actions workflow structure and security.
.claude/CLAUDE.md Adds project overview, command guidance, and formatting/validation expectations.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/Redactions/DocumentRedaction.php
Comment thread .gitattributes
Comment thread infection.json.dist
Comment thread src/Internal/LogFormatter.php
Comment thread tests/StructuredLoggerTest.php
Comment thread composer.json
Comment thread src/Redactions/PhoneRedaction.php
@gustavofreze gustavofreze merged commit e4f62fc into main Apr 21, 2026
10 checks passed
@gustavofreze gustavofreze deleted the feature/develop branch April 21, 2026 21:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants