fixed dependabot code smells

[reggeenr]

Summary

This pull request addresses several security vulnerabilities and improves logging practices across multiple services. The changes focus on preventing log injection attacks by sanitizing user-controlled data before logging, redacting sensitive information (passwords, header values) from logs, avoiding the exposure of raw request/response bodies in logs, and hardening path traversal protections. Additionally, minor Go style improvements (e.g., removing blank identifiers in range loops) are included.

Files Changed

📄 app2job/app.go

Improves the Handler function with two security fixes: removes the raw URL path from the bad-path error response to prevent XSS, and adds input validation that rejects job definition names containing characters outside of alphanumerics, hyphens, and underscores, guarding against injection attacks.

---

📄 cos-event/cos-listen.go

Replaces logging of the raw HTTP request body with a byte count summary (%d bytes received) to avoid exposing potentially sensitive payload data in logs.

---

📄 cron/cron.go

Redacts HTTP header values from logs (replacing them with [REDACTED]) to prevent leaking sensitive data such as authorization tokens. Also replaces raw body logging with a byte count. Removes the unused blank identifier in the range loop as a minor style cleanup.

---

📄 github/github.go

Adds the strings import and applies strings.ReplaceAll to sanitize newline characters from user-controlled fields (eventType, event body JSON, pusher name, commit SHA, and ref) before logging, preventing log injection attacks. Raw event body is also removed from the JSON parse error log to avoid leaking sensitive data.

---

📄 kafka/receiver.go

Redacts HTTP header values in logs, replacing them with [REDACTED], and replaces raw event body logging with a byte count to prevent sensitive data exposure. Removes the blank identifier from the range loop as a minor style fix. Also corrects a typo in a comment (headrs → headers).

---

📄 kafka/sender.go

Redacts the Kafka password from logs entirely (replacing a partial reveal with [REDACTED]). Sanitizes the Kafka topic name by stripping newline characters before logging to prevent log injection.

---

📄 thumbnail/eventer/eventer.go

Sanitizes objectName and bucketName by stripping newline characters before logging throughout the file to prevent log injection. Replaces raw event body logging with a byte count. Fixes an incorrect use of log.Print (which does not support format verbs) to log.Printf.

---

📄 thumbnail/v1/app.go

Sanitizes the URL path before logging by stripping newline characters. Strengthens the path traversal check by also rejecting paths containing / (subdirectory access), and removes the raw path value from the error response to prevent information leakage. Replaces the deprecated strings.Index check with the more idiomatic strings.Contains.

---

📄 thumbnail/v2/app.go

Mirrors the path traversal hardening from v1/app.go: strips the leading / upfront, rejects paths containing .. or /, removes the raw path from the error response, and eliminates the redundant inline strip in the os.ReadFile call. Replaces strings.Index with strings.Contains.

---

📄 websocket/server.go

Replaces logging of raw WebSocket message content with a byte count (%d bytes) to avoid exposing potentially sensitive message data in server logs.

[Luke-Roy-IBM]

LGTM