Potential fix for code scanning alert no. 113: Log entries created from user input

[aurelianware]

Potential fix for https://github.com/aurelianware/cloudhealthoffice/security/code-scanning/113

In general, to fix log-forging issues, user-controlled values should be sanitized before being logged, at least by removing newline and carriage-return characters (and optionally other control characters). This ensures a malicious header value cannot inject extra log lines or otherwise alter log structure.

For this case, the single best fix with minimal functional change is to sanitize TenantId at the controller boundary, where it enters the system, and then log and propagate the sanitized value throughout the services and repository. That way, any downstream logging involving tenantId or entities whose TenantId is derived from it (like SponsorEntity.TenantId) will automatically use the safe version. Specifically:

• In EnrollmentController.ImportEnrollment, after checking that tenantId is not null or empty, create a sanitized version that strips \r and \n characters (and optionally trims whitespace), e.g. var safeTenantId = tenantId.Replace("\r", "").Replace("\n", "");.
• Use safeTenantId in the _logger.LogInformation call in the controller.
• Pass safeTenantId to _importService.ImportEnrollmentAsync(...) instead of the raw tenantId.

No changes are required to EnrollmentImportService or EnrollmentRepository to maintain existing functionality; they will continue to receive the tenantId argument and set SponsorEntity.TenantId the same way, but now it will already be sanitized. This directly addresses the CodeQL finding because the logged sponsor.TenantId in EnrollmentRepository.CreateSponsorAsync can no longer contain line breaks injected by an attacker.

Concretely:

• Edit services/enrollment-import-service/Controllers/EnrollmentController.cs within ImportEnrollment:
  • Introduce a safeTenantId variable after the null/empty check.
  • Use safeTenantId in both the LogInformation call and the service call.
• No import changes are needed, as we use only string.Replace, which is in System and already available.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

Mitigates code-scanning finding #113 (log-forging via user-controlled input) by sanitizing request-derived values before writing them to structured logs in the enrollment import API.

Changes:

• Sanitize tenantId from X-Tenant-ID header to strip \r/\n, and propagate the sanitized value downstream.
• Sanitize enrollment.FileName before logging to prevent log line injection.
• Update controller logging/service call to use sanitized values.

[Copilot]

tenantId is validated before sanitization, so a header value containing only CR/LF (or whitespace + CR/LF) will pass IsNullOrEmpty, be sanitized to an empty string, and then be used for logging and passed downstream as the tenant context. Re-validate after sanitization (or reject when tenantId contains CR/LF/control chars) and return BadRequest if the resulting tenant id is empty/whitespace.