Skip to content

Conversation

Copilot
Copy link

@Copilot Copilot AI commented Jul 14, 2025

This PR hardens the input handling for the name query parameter to improve security, logging safety, and user experience.

Changes Made

Input Validation in CreateGreeting

  • Whitespace trimming: Uses strings.TrimSpace() to remove leading/trailing whitespace
  • Empty input handling: Returns "Hello, Guest" for empty strings after trimming
  • Length limiting: Truncates names to 100 characters maximum to prevent abuse
  • Control character sanitization: Strips newlines, tabs, and other control characters using unicode.IsControl()

Logging Safety in HTTP Handler

  • Log injection prevention: Sanitizes the name parameter before logging to remove control characters
  • Empty name logging: Shows "<empty>" in logs for empty names instead of blank entries

Comprehensive Test Coverage

Added 8 new test functions covering all edge cases:

  • TestGreeting_WhitespaceOnly: Whitespace-only names → "Hello, Guest"
  • TestGreeting_LongName: Names >100 chars → proper truncation
  • TestGreeting_NewlineInjection: Control characters → safely removed
  • TestGreeting_SpecialSymbols: Special symbols like !@# → preserved correctly
  • TestGreeting_TrimWhitespace: Leading/trailing spaces → properly trimmed
  • TestSanitizeControlChars: Unit test for control character removal
  • TestSanitizeForLogging: Unit test for logging sanitization

Before/After Examples

Whitespace handling:

Input: "   " → Output: "Hello, Guest"
Input: " John " → Output: "Hello, John"

Security improvements:

Input: "Jane\nAdmin" → Output: "Hello, JaneAdmin" (newline removed)
Input: "User\x00" → Output: "Hello, User" (null byte removed)

Length limiting:

Input: 150 'a' characters → Output: "Hello, " + 100 'a' characters

All tests pass (10/10) and manual verification confirms the server correctly handles malicious inputs, logging is safe, and UX is improved.

Fixes #3.


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

@Copilot Copilot AI changed the title [WIP] Improve input sanitization and test coverage for name query param Improve input sanitization and test coverage for name query param Jul 14, 2025
@Copilot Copilot AI requested a review from nofarblue July 14, 2025 09:41
Copilot finished work on behalf of nofarblue July 14, 2025 09:41
@nofarblue nofarblue marked this pull request as ready for review July 14, 2025 09:42
@nofarblue
Copy link
Owner

@copilot continue working on this PR

  • Update the README - make it longer.

Copy link
Author

Copilot AI commented Jul 20, 2025

@copilot continue working on this PR

  • Update the README - make it longer.
    ...

Updated the README with comprehensive documentation. Expanded from 29 to 276 lines including project features, security enhancements, installation guides, API documentation, testing details, Docker deployment, CI/CD info, and contributing guidelines. Commit: 615fcee

@Copilot Copilot AI requested a review from nofarblue July 20, 2025 12:26
Copilot finished work on behalf of nofarblue July 20, 2025 12:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve input sanitization and test coverage for name query param

2 participants