Add certificate search and display system with API endpoints and UI #27
Conversation
Co-authored-by: Hemavathi15sg <224925058+Hemavathi15sg@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return BadRequest(new { message = "Student name is required" }); | ||
| } | ||
|
|
||
| _logger.LogInformation("Searching certificates for student name: {StudentName}", studentName); |
Check failure
Code scanning / CodeQL
Log entries created from user input High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
To fix the problem, sanitize the studentName parameter to remove (or otherwise escape) any newline or carriage return characters before logging it. This should be done immediately before the logging statement, only for the purpose of recording the log, so as not to affect the actual application logic or query.
The fix involves:
- Defining a local variable, e.g.,
safeStudentName, just before logging. - Assigning
safeStudentNamethe value ofstudentNamewith all newline-related characters removed (\r,\n, and optionally others). - Passing
safeStudentNameto the logger in place of the rawstudentName.
Only lines in the method containing the logged user data should be changed. No changes are needed elsewhere.
| @@ -90,7 +90,9 @@ | ||
| return BadRequest(new { message = "Student name is required" }); | ||
| } | ||
|
|
||
| _logger.LogInformation("Searching certificates for student name: {StudentName}", studentName); | ||
| // Remove newlines from user input before logging to prevent log forging | ||
| var safeStudentName = studentName.Replace("\r", "").Replace("\n", ""); | ||
| _logger.LogInformation("Searching certificates for student name: {StudentName}", safeStudentName); | ||
| var certificates = await _certificateService.GetCertificatesByStudentNameAsync(studentName); | ||
| return Ok(certificates); | ||
| } |
| } | ||
| catch (Exception ex) | ||
| { | ||
| _logger.LogError(ex, "Error searching certificates for student name {StudentName}", studentName); |
Check failure
Code scanning / CodeQL
Log entries created from user input High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
The best way to fix this problem is to sanitize the studentName variable before logging it. Specifically, remove any line break characters from the value, since log forging usually relies on inserting newlines. In general terms, update the logging line at line 99 (and optionally at line 93 for consistency) to log a sanitized version of studentName in place of the raw input.
Detailed steps:
- Before logging at line 99, create a sanitized version of
studentNameby removing (replacing) all occurrences of\rand\n. - Use the sanitized value in the logging statement.
- Do this for line 99.
- (Optional/recommended: do the same for line 93, which also logs user input.)
No new imports are required, as string.Replace is built in.
Only lines within the SearchCertificates method in api/CourseRegistration.API/Controllers/CertificatesController.cs are changed.
| @@ -90,13 +90,16 @@ | ||
| return BadRequest(new { message = "Student name is required" }); | ||
| } | ||
|
|
||
| _logger.LogInformation("Searching certificates for student name: {StudentName}", studentName); | ||
| // Sanitize user input before logging to prevent log forging by removing newlines | ||
| var sanitizedStudentName = studentName.Replace("\r", "").Replace("\n", ""); | ||
| _logger.LogInformation("Searching certificates for student name: {StudentName}", sanitizedStudentName); | ||
| var certificates = await _certificateService.GetCertificatesByStudentNameAsync(studentName); | ||
| return Ok(certificates); | ||
| } | ||
| catch (Exception ex) | ||
| { | ||
| _logger.LogError(ex, "Error searching certificates for student name {StudentName}", studentName); | ||
| var sanitizedStudentName = studentName?.Replace("\r", "").Replace("\n", ""); | ||
| _logger.LogError(ex, "Error searching certificates for student name {StudentName}", sanitizedStudentName); | ||
| return StatusCode(StatusCodes.Status500InternalServerError, | ||
| new { message = "An error occurred while searching certificates" }); | ||
| } |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| catch (Exception ex) | ||
| { | ||
| _logger.LogError(ex, "Error retrieving certificate {CertificateId}", id); | ||
| return StatusCode(StatusCodes.Status500InternalServerError, | ||
| new { message = "An error occurred while retrieving the certificate" }); | ||
| } |
| catch (Exception ex) | ||
| { | ||
| _logger.LogError(ex, "Error retrieving certificates for student {StudentId}", studentId); | ||
| return StatusCode(StatusCodes.Status500InternalServerError, | ||
| new { message = "An error occurred while retrieving certificates" }); | ||
| } |
| catch (Exception ex) | ||
| { | ||
| _logger.LogError(ex, "Error searching certificates for student name {StudentName}", studentName); | ||
| return StatusCode(StatusCodes.Status500InternalServerError, | ||
| new { message = "An error occurred while searching certificates" }); | ||
| } |
| catch (Exception ex) | ||
| { | ||
| _logger.LogError(ex, "Error creating certificate"); | ||
| return StatusCode(StatusCodes.Status500InternalServerError, | ||
| new { message = "An error occurred while creating the certificate" }); | ||
| } |
Co-authored-by: Hemavathi15sg <224925058+Hemavathi15sg@users.noreply.github.com>
Co-authored-by: Hemavathi15sg <224925058+Hemavathi15sg@users.noreply.github.com>
1 participant
Implements certificate generation, search, and display functionality for completed courses. Users can search by student name or certificate ID and view detailed certificate information.
Backend Changes
GET /api/certificates/{id}- retrieve by IDGET /api/certificates/search?studentName={name}- search by nameGET /api/certificates/student/{studentId}- get by studentPOST /api/certificates- create new certificateCertificatesDbSet with entity configuration and unique constraint on certificate numbersICertificateServiceFrontend Changes
API Example
Screenshots
Certificate Search Results
Certificate Details Modal
Security
CodeQL analysis: No vulnerabilities detected
Original prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.