Sanitize user input at log call sites

Author: Christdej

api/Services/AnalysisTriggerService.cs

@@ -38,23 +38,6 @@ public async Task OnInspectionRecordCreated(InspectionRecordCreatedEvent created
             return;
         }
 
-        inspectionRecord.InspectionId = Sanitize.SanitizeUserInput(inspectionRecord.InspectionId);
-        if (createdEvent.AnalysisGroup is not null)
-        {
-            createdEvent.AnalysisGroup.AnalysisGroupId = Sanitize.SanitizeUserInput(
-                createdEvent.AnalysisGroup.AnalysisGroupId
-            );
-            createdEvent.AnalysisGroup.AnalysisGroupAnalyses = createdEvent
-                .AnalysisGroup.AnalysisGroupAnalyses.Select(Sanitize.SanitizeUserInput)
-                .ToList();
-        }
-        if (createdEvent.RequiredAnalysis is not null)
-        {
-            createdEvent.RequiredAnalysis = createdEvent
-                .RequiredAnalysis.Select(Sanitize.SanitizeUserInput)
-                .ToList();
-        }
-
         var analysisNames = GetAnalysesToRun(createdEvent, inspectionRecord);
         if (analysisNames.Count == 0)
         {
@@ -87,9 +70,9 @@ public async Task OnInspectionRecordCreated(InspectionRecordCreatedEvent created
             {
                 logger.LogInformation(
                     "Deferring analysis '{AnalysisName}' for InspectionId: {InspectionId} — waiting for group {GroupId}",
-                    analysisName,
-                    inspectionRecord.InspectionId,
-                    group!.GroupId
+                    Sanitize.SanitizeUserInput(analysisName),
+                    Sanitize.SanitizeUserInput(inspectionRecord.InspectionId),
+                    Sanitize.SanitizeUserInput(group!.GroupId)
                 );
             }
             else
@@ -137,7 +120,7 @@ extension is not null
         {
             logger.LogInformation(
                 "No analyses to run for InspectionId: {InspectionId}",
-                inspectionRecord.InspectionId
+                Sanitize.SanitizeUserInput(inspectionRecord.InspectionId)
             );
             return [];
         }
@@ -150,8 +133,8 @@ extension is not null
             logger.LogError(
                 "Unknown analyses [{UnknownAnalyses}] for InspectionId: {InspectionId} — "
                     + "not found in configuration. These will be skipped.",
-                string.Join(", ", unknownNames),
-                inspectionRecord.InspectionId
+                Sanitize.SanitizeUserInput(string.Join(", ", unknownNames)),
+                Sanitize.SanitizeUserInput(inspectionRecord.InspectionId)
             );
         }
 
@@ -161,15 +144,15 @@ extension is not null
         {
             logger.LogInformation(
                 "No known analyses to run for InspectionId: {InspectionId}",
-                inspectionRecord.InspectionId
+                Sanitize.SanitizeUserInput(inspectionRecord.InspectionId)
             );
             return [];
         }
 
         logger.LogInformation(
             "Resolved analyses for InspectionId: {InspectionId}: {Analyses}",
-            inspectionRecord.InspectionId,
-            string.Join(", ", knownNames)
+            Sanitize.SanitizeUserInput(inspectionRecord.InspectionId),
+            Sanitize.SanitizeUserInput(string.Join(", ", knownNames))
         );
 
         return knownNames;
@@ -185,7 +168,6 @@ IsarAnalysisGroupMessage groupMessage
 
         if (existing is not null)
         {
-            existing.GroupId = Sanitize.SanitizeUserInput(existing.GroupId);
             return existing;
         }
 
@@ -202,7 +184,7 @@ IsarAnalysisGroupMessage groupMessage
 
         logger.LogInformation(
             "Created analysis group {GroupId} expecting {ExpectedSize} records, timeout at {TimeoutAt}",
-            group.GroupId,
+            Sanitize.SanitizeUserInput(group.GroupId),
             group.ExpectedSize,
             group.TimeoutAt
         );
@@ -255,7 +237,7 @@ IReadOnlyList<InspectionRecord> inspectionRecords
         {
             logger.LogWarning(
                 "Analysis '{AnalysisName}' has an empty workflow chain",
-                analysis.Name
+                Sanitize.SanitizeUserInput(analysis.Name)
             );
             return;
         }
@@ -264,7 +246,7 @@ IReadOnlyList<InspectionRecord> inspectionRecords
         {
             logger.LogWarning(
                 "TriggerAnalysis called for analysis '{AnalysisName}' with no InspectionRecords — skipping",
-                analysis.Name
+                Sanitize.SanitizeUserInput(analysis.Name)
             );
             return;
         }
@@ -368,7 +350,7 @@ private async Task CheckAndCompleteGroup(AnalysisGroup group, List<string> group
         {
             logger.LogInformation(
                 "Group {GroupId}: {RecordCount}/{ExpectedSize} records received",
-                group.GroupId,
+                Sanitize.SanitizeUserInput(group.GroupId),
                 recordCount,
                 group.ExpectedSize
             );
@@ -380,8 +362,8 @@ private async Task CheckAndCompleteGroup(AnalysisGroup group, List<string> group
 
         logger.LogInformation(
             "Group {GroupId} is complete. Triggering grouped analyses: {Analyses}",
-            group.GroupId,
-            string.Join(", ", groupedAnalyses)
+            Sanitize.SanitizeUserInput(group.GroupId),
+            Sanitize.SanitizeUserInput(string.Join(", ", groupedAnalyses))
         );
 
         // Resolve all records in the group up-front so we can pass them to TriggerAnalysis
@@ -425,12 +407,6 @@ public async Task RerunAnalysis(Guid analysisId)
             throw new KeyNotFoundException($"Analysis with id {analysisId} not found");
         }
 
-        analysis.Name = Sanitize.SanitizeUserInput(analysis.Name);
-        foreach (var record in analysis.InspectionRecords)
-        {
-            record.InspectionId = Sanitize.SanitizeUserInput(record.InspectionId);
-        }
-
         if (!_options.Analyses.ContainsKey(analysis.Name))
         {
             throw new InvalidOperationException(

api/Services/ThermalReferenceMetadataService.cs

@@ -92,10 +92,6 @@ public async Task<ThermalReferenceMetadata> CreateThermalReferenceMetadata(
         BlobStorageLocation referencePolygonLocation
     )
     {
-        input.InstallationCode = Sanitize.SanitizeUserInput(input.InstallationCode);
-        input.TagId = Sanitize.SanitizeUserInput(input.TagId);
-        input.InspectionDescription = Sanitize.SanitizeUserInput(input.InspectionDescription);
-
         await ThrowIfDuplicateExists(input, null);
 
         var thermalReferenceMetadata = new ThermalReferenceMetadata
@@ -119,10 +115,6 @@ public async Task<ThermalReferenceMetadata> UpdateThermalReferenceMetadata(
         BlobStorageLocation referencePolygonLocation
     )
     {
-        input.InstallationCode = Sanitize.SanitizeUserInput(input.InstallationCode);
-        input.TagId = Sanitize.SanitizeUserInput(input.TagId);
-        input.InspectionDescription = Sanitize.SanitizeUserInput(input.InspectionDescription);
-
         var thermalReferenceMetadata =
             await ReadById(id)
             ?? throw new KeyNotFoundException(
@@ -169,9 +161,9 @@ private async Task ThrowIfDuplicateExists(ThermalReferenceMetadataInput input, G
 
         _logger.LogWarning(
             "Thermal reference metadata already exists for InstallationCode {InstallationCode}, TagId {TagId}, InspectionDescription {InspectionDescription}",
-            input.InstallationCode,
-            input.TagId,
-            input.InspectionDescription
+            Sanitize.SanitizeUserInput(input.InstallationCode),
+            Sanitize.SanitizeUserInput(input.TagId),
+            Sanitize.SanitizeUserInput(input.InspectionDescription)
         );
         throw new ArgumentException(
             "A thermal reference metadata already exists for this installation code, tag ID, and inspection description"