Potential fix for code scanning alert no. 553: Log Injection

[aegilops]

Potential fix for https://github.com/advanced-security/python-lint-code-scanning-action/security/code-scanning/553

To fix the issue, we need to sanitize the user-provided input (args.linter) before logging it. Specifically:

1. Remove any newline characters (\n and \r) from the input to prevent log injection.
2. Optionally, escape or replace other potentially harmful characters to ensure the log entry is safe and unambiguous.

The best approach is to use Python's str.replace() method to remove newline characters from the args.linter value before including it in the log message. This ensures that the log entry remains safe while preserving the original functionality.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a log injection vulnerability by sanitizing user-provided linter names before logging them.

• Strips \n and \r characters from each entry in args.linter
• Logs the sanitized list instead of the raw input to prevent injection

Comments suppressed due to low confidence (1)

python_lint.py:773

• Add a unit test for this sanitization logic to ensure inputs containing newlines or other control characters are correctly cleaned before logging.

sanitized_linter = [linter.replace('\n', '').replace('\r', '') for linter in args.linter]