fix(security): prevent log forging and update tooling (#52)

- Sanitize user input before logging to prevent log forging attacks
- Add explicit least-privilege permissions to CI/CD workflow
- Upgrade CSharpier 0.30.6 → 1.2.5 (new CLI syntax)
- Remove unused dotnet-ef tool

Author: erlendellefsen

.config/dotnet-tools.json

@@ -3,9 +3,9 @@
   "isRoot": true,
   "tools": {
     "csharpier": {
-      "version": "0.30.6",
+      "version": "1.2.5",
       "commands": [
-        "dotnet-csharpier"
+        "csharpier"
       ],
       "rollForward": false
     }

.github/workflows/ci-cd.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Check formatting
         run: |
           dotnet tool restore
-          dotnet csharpier . --check
+          dotnet csharpier check .
 
       - name: Build
         run: dotnet build --no-restore --configuration Release

JsonApiToolkit.Tests/Extensions/IncludeFilterParserTests.cs

@@ -352,8 +352,8 @@ public void SeparateIncludeFilters_WithTooDeepNesting_ThrowsException()
         var includePaths = new List<string> { "a.b.c.d" };
 
         // Act & Assert
-        var exception = Assert.Throws<JsonApiBadRequestException>(
-            () => IncludeFilterParser.SeparateIncludeFilters(filters, includePaths)
+        var exception = Assert.Throws<JsonApiBadRequestException>(() =>
+            IncludeFilterParser.SeparateIncludeFilters(filters, includePaths)
         );
 
         Assert.Contains("Filter depth exceeds maximum", exception.Message);

JsonApiToolkit.Tests/Extensions/QueryHelpersTests.cs

@@ -24,8 +24,8 @@ public void ConvertToPropertyType_WithValidEnumIgnoreCase_ConvertsCorrectly()
     [Fact]
     public void ConvertToPropertyType_WithInvalidEnum_ThrowsArgumentException()
     {
-        var exception = Assert.Throws<FormatException>(
-            () => QueryHelpers.ConvertToPropertyType("InvalidStatus", typeof(TestStatus))
+        var exception = Assert.Throws<FormatException>(() =>
+            QueryHelpers.ConvertToPropertyType("InvalidStatus", typeof(TestStatus))
         );
 
         Assert.Contains(
@@ -45,8 +45,8 @@ public void ConvertToPropertyType_WithNullableEnum_ConvertsCorrectly()
     [Fact]
     public void ConvertToPropertyType_WithEmptyStringForEnum_ThrowsArgumentException()
     {
-        var exception = Assert.Throws<FormatException>(
-            () => QueryHelpers.ConvertToPropertyType("", typeof(TestStatus))
+        var exception = Assert.Throws<FormatException>(() =>
+            QueryHelpers.ConvertToPropertyType("", typeof(TestStatus))
         );
 
         Assert.Contains("Invalid enum value '' for type 'TestStatus'", exception.Message);
@@ -71,8 +71,8 @@ public void ConvertToPropertyType_WithInt_ConvertsCorrectly()
     [Fact]
     public void ConvertToPropertyType_WithInvalidInt_ThrowsFormatException()
     {
-        var exception = Assert.Throws<FormatException>(
-            () => QueryHelpers.ConvertToPropertyType("not-a-number", typeof(int))
+        var exception = Assert.Throws<FormatException>(() =>
+            QueryHelpers.ConvertToPropertyType("not-a-number", typeof(int))
         );
 
         Assert.Contains(

JsonApiToolkit.Tests/JsonApiToolkit.Tests.csproj

@@ -1,5 +1,4 @@
 <Project Sdk="Microsoft.NET.Sdk">
-
   <PropertyGroup>
     <TargetFramework>net9.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
@@ -24,5 +23,4 @@
   <ItemGroup>
     <ProjectReference Include="..\JsonApiToolkit\JsonApiToolkit.csproj" />
   </ItemGroup>
-
 </Project>

JsonApiToolkit/JsonApiToolkit.csproj

@@ -1,5 +1,4 @@
 <Project Sdk="Microsoft.NET.Sdk">
-
   <PropertyGroup>
     <TargetFramework>net9.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
@@ -15,7 +14,7 @@
     <RepositoryUrl>https://github.com/intility/Intility.JsonApiToolkit</RepositoryUrl>
     <RepositoryType>git</RepositoryType>
     <PackageReadmeFile>README.md</PackageReadmeFile>
-    
+
     <!-- Generate XML documentation -->
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
   </PropertyGroup>
@@ -25,7 +24,10 @@
     <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="2.3.0" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="9.0.2" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="9.0.2" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.2" />
+    <PackageReference
+      Include="Microsoft.Extensions.DependencyInjection.Abstractions"
+      Version="9.0.2"
+    />
   </ItemGroup>
   <ItemGroup>
     <None Include="README.md" Pack="true" PackagePath="\" />