From d609a41222671fc547deb62b48416798bcbe5cba Mon Sep 17 00:00:00 2001 From: Ajay Ghanwat Date: Tue, 4 Aug 2026 17:26:02 +0530 Subject: [PATCH] docs: widen logSafe to Unicode line separators in the Task 5 plan snippet The re-review confirmed the log-injection fix works for C0 and DEL, but U+0085 (NEL) and U+2028/U+2029 pass through. Those are line terminators to some log shippers and to JavaScript's own lexical grammar, so they can still split a record downstream. Co-Authored-By: Claude Opus 5 --- docs/plans/2026-08-04-authz-permissions-implementation.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/plans/2026-08-04-authz-permissions-implementation.md b/docs/plans/2026-08-04-authz-permissions-implementation.md index f46f58bf..00fee161 100644 --- a/docs/plans/2026-08-04-authz-permissions-implementation.md +++ b/docs/plans/2026-08-04-authz-permissions-implementation.md @@ -1093,7 +1093,11 @@ function logSafe(value: string): string { let out = ""; for (const character of value) { const code = character.codePointAt(0)!; - out += code < 0x20 || code === 0x7f ? " " : character; + // C0 + DEL, plus NEL and the Unicode line/paragraph separators, which some + // log shippers and JSON consumers also treat as line terminators. + const isLineBreaking = + code < 0x20 || code === 0x7f || code === 0x85 || code === 0x2028 || code === 0x2029; + out += isLineBreaking ? " " : character; } return out; }