Fail-safe JSON encoding, multibyte-safe redactions, and log injection prevention via newline/CR/tab sanitization in log headers.#7
Merged
gustavofreze merged 2 commits intomainfrom Apr 21, 2026
Conversation
…ction prevention via newline/CR/tab sanitization in log headers.
…ction prevention via newline/CR/tab sanitization in log headers.
There was a problem hiding this comment.
Pull request overview
This PR hardens the structured logger by making JSON encoding fail-safe, improving redaction correctness for multibyte strings, and reducing log injection risk by escaping control characters in log header fields.
Changes:
- Add fail-safe JSON encoding with a fallback payload when encoding fails, plus control-character escaping in log headers.
- Update redaction strategies (email/name/phone/document) to be multibyte-aware and apply redactions recursively across nested context data.
- Normalize project tooling/config (Composer normalization, mutation testing config, packaging/export ignores, editor/ignore files).
Reviewed changes
Copilot reviewed 19 out of 20 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/StructuredLoggerTest.php | Adds tests for encoding failure fallback, log header escaping, multibyte redactions, and recursive redaction behavior. |
| src/Redactions/PhoneRedaction.php | Switches suffix masking to multibyte-safe operations. |
| src/Redactions/NameRedaction.php | Switches prefix masking to multibyte-safe operations. |
| src/Redactions/EmailRedaction.php | Makes @ detection and masking multibyte-safe. |
| src/Redactions/DocumentRedaction.php | Switches suffix masking to multibyte-safe operations. |
| src/Internal/Redactor/Redactions.php | Simplifies applying multiple redactions by reducing over the redaction collection. |
| src/Internal/LogFormatter.php | Adds JSON_THROW_ON_ERROR handling with fallback payload and escapes \\n/\\r/\\t in header fields. |
| infection.json.dist | Adjusts Infection mutators configuration. |
| composer.json | Updates dependencies/dev tooling and plugin allow-list; reorganizes scripts/config. |
| Makefile | Adds composer normalize, tweaks test-file help text, and introduces show-outdated. |
| .gitignore | Expands ignore patterns (IDE/agents, Composer lock/vendor, coverage/build artifacts). |
| .github/copilot-instructions.md | Adds Copilot guidance referencing .claude rule sources. |
| .gitattributes | Adds LF normalization and refines export-ignore list for Packagist packaging. |
| .editorconfig | Introduces consistent editor defaults (LF, indentation, whitespace rules). |
| .claude/rules/php-library-testing.md | Adds repository-specific PHPUnit/BDD/testing rules. |
| .claude/rules/php-library-modeling.md | Adds library modeling/architecture rules. |
| .claude/rules/php-library-documentation.md | Adds documentation standards for markdown docs. |
| .claude/rules/php-library-code-style.md | Adds PHP code-style rules and constraints. |
| .claude/rules/github-workflows.md | Adds conventions for GitHub Actions workflow structure and security. |
| .claude/CLAUDE.md | Adds project overview, command guidance, and formatting/validation expectations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.